perf: loop regions admit real loop bodies over arrays (#10741)

changelog.d/11790-loop-admission.md

@@ -0,0 +1,24 @@
+**perf: loop regions admit real loop bodies over arrays (#10741)**
+
+The loop tiers admitted only single-statement, call-free bodies, so a
+multi-statement, branching loop over arrays got none of the region win: every
+element access ran its full guarded tier. The issue's particle step (`x[i] +=
+vx[i]; ...` over 400 elements) cost 995 instructions per step over `number[]`
+(19x node) and 661 over `Float64Array` (10x node).
+
+Loop regions (#11680) now take these loops:
+
+- An index is proven when it is the loop COUNTER of `for (...; i < B; i++)`,
+  with every write of `i` and `B` accounted for (the update writes `i`;
+  nothing else in the body, condition or update writes `i` or `B`), or a
+  body-local copy of it (the compound-assignment spill of `a[i] += v` makes
+  two). The guard checks the entry value of `i` and `B <= length` once.
+- An array the region stores into, or reads by the counter in a Number
+  context, is guarded as a dense raw-f64 array (or, unless it is declared a
+  plain Array, an owning `Float64Array`): a bare read is one `load double`
+  typed as a Number (a typed slot's NaN is canonicalised), and an element
+  store of a value proven a canonical double is one `store double`.
+- Pure `Math.*` over primitives no longer stales the region's facts.
+- A statement that may run JS (a call) no longer refuses the loop: F-body sets
+  the region's dirty flag right after it, the accesses after it in that
+  iteration take the guarded tier, and the next iteration re-checks.

crates/perry-codegen/src/expr/index_get.rs

@@ -47,7 +47,9 @@ pub(crate) use foreign_counter::{
     packed_f64_loop_index_parts, packed_f64_loop_offset_read,
 };
 use foreign_counter::{affine_packed_loop_read, emit_affine_index_i64, foreign_packed_loop_read};
-pub(crate) use guarded_array::emit_array_region_guard;
+pub(crate) use guarded_array::{
+    emit_array_region_guard, emit_typed_f64_region_guard, ArrayRegionDense,
+};
 mod inline_dyn_typed_array;
 
 use guarded_array::{

crates/perry-codegen/src/expr/index_get/guarded_array.rs

@@ -229,17 +229,36 @@ fn emit_array_guard_word_ok(blk: &mut crate::block::LlBlock, word: &str) -> Stri
     blk.icmp_eq(I32, &masked, ARRAY_READ_GUARD_EXPECT_I32)
 }
 
+/// What a [`emit_array_region_guard`] receiver needs beyond the read facts.
+#[derive(Clone, Copy)]
+pub(crate) struct ArrayRegionDense<'a> {
+    /// The region stores elements: the integrity bits must be clear too.
+    pub(crate) store: bool,
+    /// The counter's bound (an `f64`): `bound <= length`.
+    pub(crate) len_bound: Option<&'a str>,
+}
+
 /// A loop region's array guard (#11650 regions, array slice S3): the S1 guard
 /// word, the prototype facts a hole read needs, and `max_index <u capacity`,
 /// checked once in the preheader (and at a re-check). On a pass it also
 /// derives the element base from the same header and stores it into
 /// `base_slot`; F-body's element reads then load `base + 8 * idx` and select
 /// `undefined` for a hole. Returns the `i1` pass flag. The receiver is tested
 /// against the heap band before anything is dereferenced.
+///
+/// #10741: a receiver whose region also STORES elements, or indexes them by
+/// the loop counter, needs more, and `dense` asks for it: the store word
+/// (integrity bits clear), the dense raw-f64 layout bit (every slot in
+/// `[0, length)` a canonical double), and the bounds against `length`
+/// as well as `capacity` (`max_index < min(length, capacity)`, and
+/// `len_bound <= min(length, capacity)` for the counter's bound, an `f64`). A bare read is then one `load double`
+/// and a bare store of a proven double one `store double`: neither changes
+/// the length, the layout or any pointer the collector traces.
 pub(crate) fn emit_array_region_guard(
     ctx: &mut FnCtx<'_>,
     recv_box: &str,
     max_index: u32,
+    dense: Option<ArrayRegionDense<'_>>,
     base_slot: &str,
 ) -> String {
     let deref_idx = ctx.new_block("rloop.arr.deref");
@@ -262,7 +281,23 @@ pub(crate) fn emit_array_region_guard(
         let blk = ctx.block();
         let handle = blk.add(I64, &band_offset, "1048576");
         let word = emit_array_guard_word(blk, &handle);
-        let word_ok = emit_array_guard_word_ok(blk, &word);
+        let word_ok = match dense {
+            None => emit_array_guard_word_ok(blk, &word),
+            Some(d) => {
+                let mask = if d.store {
+                    ARRAY_STORE_GUARD_MASK_I32
+                } else {
+                    ARRAY_READ_GUARD_MASK_I32
+                };
+                let masked = blk.and(I32, &word, mask);
+                let ok = blk.icmp_eq(I32, &masked, ARRAY_READ_GUARD_EXPECT_I32);
+                // GC_ARRAY_RAW_F64_LAYOUT (0x80 in `_reserved`, the word's
+                // upper half): dense canonical raw f64, no holes.
+                let f64_bit = blk.and(I32, &word, "8388608"); // 0x80 << 16
+                let is_f64 = blk.icmp_ne(I32, &f64_bit, "0");
+                blk.and(I1, &ok, &is_f64)
+            }
+        };
         blk.cond_br(&word_ok, &cap_label, &join_label);
         handle
     };
@@ -275,7 +310,27 @@ pub(crate) fn emit_array_region_guard(
         let capacity_addr = blk.add(I64, &handle, "4");
         let capacity_ptr = blk.inttoptr(I64, &capacity_addr);
         let capacity = blk.load(I32, &capacity_ptr);
-        let fits = blk.icmp_ult(I32, &max_index.to_string(), &capacity);
+        let fits = match dense {
+            None => blk.icmp_ult(I32, &max_index.to_string(), &capacity),
+            Some(d) => {
+                // #9784: the logical length does not prove the backing
+                // store (a presized array's capacity can be smaller): every
+                // slot the region touches is below BOTH.
+                let length_ptr = blk.inttoptr(I64, &handle);
+                let length = blk.load(I32, &length_ptr);
+                let shorter = blk.icmp_ult(I32, &length, &capacity);
+                let limit = blk.select(I1, &shorter, I32, &length, &capacity);
+                let fits = blk.icmp_ult(I32, &max_index.to_string(), &limit);
+                match d.len_bound {
+                    Some(bound) => {
+                        let len_f = blk.uitofp(I32, &limit, DOUBLE);
+                        let within = blk.fcmp("ole", bound, &len_f);
+                        blk.and(I1, &fits, &within)
+                    }
+                    None => fits,
+                }
+            }
+        };
         let pass = blk.and(I1, &proto_ok, &fits);
         let base = blk.array_elements_addr_with_capacity(&handle, &capacity);
         blk.br(&join_label);
@@ -299,6 +354,91 @@ pub(crate) fn emit_array_region_guard(
     pass
 }
 
+/// The `Float64Array` twin of [`emit_array_region_guard`]'s dense facts
+/// (#10741): a heap pointer whose GC header names a typed array (never
+/// forwarded: typed arrays live in the non-moving space), of element kind
+/// `Float64`, with inline storage (`PERRY_TA_VIEW_GUARD == 0`: no aliasing
+/// view exists, so every typed array's elements start at payload `+16`), and
+/// the same bounds against its `length` (payload `+0`). On a pass it stores
+/// the element base into `base_slot`; F-body's reads and stores are then the
+/// same raw `f64` slots as a dense array's, its reads canonicalising a NaN
+/// (a typed array may hold any NaN payload). A typed array's length and kind
+/// never change and it is never moved, so nothing but a view creation (JS)
+/// can invalidate the facts.
+pub(crate) fn emit_typed_f64_region_guard(
+    ctx: &mut FnCtx<'_>,
+    recv_box: &str,
+    max_index: u32,
+    len_bound: Option<&str>,
+    base_slot: &str,
+) -> String {
+    let deref_idx = ctx.new_block("rloop.ta.deref");
+    let len_idx = ctx.new_block("rloop.ta.len");
+    let join_idx = ctx.new_block("rloop.ta.join");
+    let deref_label = ctx.block_label(deref_idx);
+    let len_label = ctx.block_label(len_idx);
+    let join_label = ctx.block_label(join_idx);
+    let pre_label = ctx.block().label.clone();
+    let band_offset = {
+        let blk = ctx.block();
+        let bits = blk.bitcast_double_to_i64(recv_box);
+        let band_offset = blk.sub(I64, &bits, HEAP_POINTER_BAND_BASE_I64);
+        let in_band = blk.icmp_ult(I64, &band_offset, HEAP_POINTER_BAND_SPAN_I64);
+        blk.cond_br(&in_band, &deref_label, &join_label);
+        band_offset
+    };
+    ctx.current_block = deref_idx;
+    let handle = {
+        let blk = ctx.block();
+        let handle = blk.add(I64, &band_offset, "1048576");
+        let word = emit_array_guard_word(blk, &handle);
+        // obj_type GC_TYPE_TYPED_ARRAY (11), not forwarded (0x80 in byte 1).
+        let masked = blk.and(I32, &word, "33023"); // 0x80FF
+        let is_ta = blk.icmp_eq(I32, &masked, "11");
+        let kind_addr = blk.add(I64, &handle, "8");
+        let kind_ptr = blk.inttoptr(I64, &kind_addr);
+        let kind = blk.load(I8, &kind_ptr);
+        let is_f64 = blk.icmp_eq(I8, &kind, "7"); // KIND_FLOAT64
+        let vg = blk.load(I64, "@PERRY_TA_VIEW_GUARD");
+        let no_views = blk.icmp_eq(I64, &vg, "0");
+        let ok = blk.and(I1, &is_ta, &no_views);
+        let ok = blk.and(I1, &ok, &is_f64);
+        blk.cond_br(&ok, &len_label, &join_label);
+        handle
+    };
+    ctx.current_block = len_idx;
+    let (pass, base) = {
+        let blk = ctx.block();
+        let length_ptr = blk.inttoptr(I64, &handle);
+        let length = blk.load(I32, &length_ptr);
+        let mut fits = blk.icmp_ult(I32, &max_index.to_string(), &length);
+        if let Some(bound) = len_bound {
+            let len_f = blk.uitofp(I32, &length, DOUBLE);
+            let within = blk.fcmp("ole", bound, &len_f);
+            fits = blk.and(I1, &fits, &within);
+        }
+        let base = blk.add(I64, &handle, "16");
+        blk.br(&join_label);
+        (fits, base)
+    };
+    ctx.current_block = join_idx;
+    let blk = ctx.block();
+    let pass = blk.phi(
+        I1,
+        &[
+            ("false", &pre_label),
+            ("false", &deref_label),
+            (&pass, &len_label),
+        ],
+    );
+    let base = blk.phi(
+        I64,
+        &[("0", &pre_label), ("0", &deref_label), (&base, &len_label)],
+    );
+    blk.store(I64, &base, base_slot);
+    pass
+}
+
 pub(super) fn lower_guarded_array_index_get(
     ctx: &mut FnCtx<'_>,
     arr_box: &str,

crates/perry-codegen/src/expr/index_set.rs

@@ -517,6 +517,14 @@ pub(crate) fn lower(
             index,
             value,
         } => {
+            // Step 4b / #10741: a planned-bare element store inside a loop
+            // region (a dense raw-f64 array, the index and value proven).
+            if let Some(result) = crate::stmt::region_loop::try_lower_bare_index_set(ctx, expr)? {
+                if value_discarded {
+                    return Ok(double_literal(0.0));
+                }
+                return Ok(result);
+            }
             if let Some(result) = super::typed_array_rmw::try_lower_guarded_uint32_add(
                 ctx,
                 object,

crates/perry-codegen/src/expr/mod.rs

@@ -233,6 +233,8 @@ mod index_set_barrier_tests;
 mod instanceof_imported_rhs_tests;
 mod record_value;
 #[cfg(test)]
+mod region_array_loop_tests;
+#[cfg(test)]
 mod region_loop_tests;
 mod repsel_gates;
 mod scalar_slot_root;
@@ -3082,8 +3084,8 @@ mod unary_bigint_tests;
 mod unary_bitnot_tests;
 pub(crate) use index_get::{
     affine_counter_occurrences, affine_index_fits_i64, emit_affine_index_i64_with,
-    emit_array_region_guard, numeric_index_has_integer_array_index_proof,
-    packed_f64_loop_index_parts,
+    emit_array_region_guard, emit_typed_f64_region_guard,
+    numeric_index_has_integer_array_index_proof, packed_f64_loop_index_parts, ArrayRegionDense,
 };
 pub(crate) use masked_window::masked_window_fact_for_index;
 /// Rooting coverage for the computed-store arms the TS corpora cannot reach

crates/perry-codegen/src/expr/proxy_reflect.rs

@@ -1422,6 +1422,10 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
                 {
                     return Ok(v);
                 }
+                // #10741: a planned-bare element store (`a[i] = v`).
+                if let Some(v) = crate::stmt::region_loop::try_lower_bare_index_set(ctx, expr)? {
+                    return Ok(v);
+                }
             }
             if let Expr::String(property) = key.as_ref() {
                 if matches!(property.as_str(), "caller" | "arguments")