fix(codegen): harden packed loop invalidation

Author: Ralph Küpper

crates/perry-codegen/src/collectors/proven_this_routing_tests.rs

@@ -738,7 +738,7 @@ fn single_arm_method_shape_guard_is_inlined_with_the_runtime_contract() {
             && probe.contains("getelementptr i8, ptr")
             && probe.contains("i64 -8")
             && probe.contains("and i32")
-            && probe.contains(", 134250751")
+            && probe.contains(", 142639359")
             && probe.contains("icmp eq i32")
             && probe.contains(", 2")
             && probe.contains("load i64, ptr")
@@ -751,7 +751,7 @@ fn single_arm_method_shape_guard_is_inlined_with_the_runtime_contract() {
             && probe.contains(", -2147483648")
             && probe.contains("icmp ult i32")
             && probe.contains(", 1073741824"),
-        "the packed header block must check the GC type, forwarding flag, own-descriptor bit, exact class/ShapeId pair, and ShapeId domain:\n{probe}"
+        "the packed header block must check the GC type, forwarding flag, own-descriptor/packed-proof bits, exact class/ShapeId pair, and ShapeId domain:\n{probe}"
     );
 }
 

crates/perry-codegen/src/expr/class_field_barrier_tests.rs

@@ -232,6 +232,19 @@ pub(super) fn ir() -> String {
         .expect("LLVM IR should be UTF-8")
 }
 
+/// #8690: pointer-free tagged writes (SSO and booleans) skip the shared
+/// value-is-pointer bookkeeping arm. The receiver precheck must therefore
+/// reject the packed-numeric authority bit before entering the inline store.
+#[test]
+fn class_field_set_precheck_blocks_packed_numeric_proof_receivers() {
+    let ir = ir();
+    assert!(
+        ir.lines()
+            .any(|line| line.contains("and i16") && line.trim_end().ends_with(", 128")),
+        "class-field set admission must mask OBJ_FLAG_PACKED_NUMERIC_PROOF (0x80)\n{ir}"
+    );
+}
+
 /// The `br i1 %cond, label %class_field_set.barrier.N, label %...` line, plus
 /// the body of the block that contains it.
 ///

crates/perry-codegen/src/expr/class_field_inline_guard.rs

@@ -48,9 +48,10 @@ const GC_FLAG_FORWARDED_I8: &str = "-128"; // 0x80 as i8
 const TYPED_LAYOUT_INTACT_BIT: &str = "4096"; // GC_OBJ_TYPED_LAYOUT_INTACT (0x1000)
 const OBJ_FLAG_FROZEN_BIT: &str = "1"; // OBJ_FLAG_FROZEN (0x01)
 const OBJ_FLAG_HAS_DESCRIPTORS_BIT: &str = "2048"; // OBJ_FLAG_HAS_DESCRIPTORS (0x800)
-/// `OBJ_FLAG_FROZEN | OBJ_FLAG_HAS_DESCRIPTORS` — both live in the same
-/// `GcHeader::_reserved` i16, so one mask tests both.
-const OBJ_FLAG_FROZEN_OR_DESCRIPTORS: &str = "2049";
+const OBJ_FLAG_PACKED_NUMERIC_PROOF_BIT: &str = "128"; // OBJ_FLAG_PACKED_NUMERIC_PROOF (0x080)
+/// `OBJ_FLAG_FROZEN | OBJ_FLAG_HAS_DESCRIPTORS | OBJ_FLAG_PACKED_NUMERIC_PROOF`
+/// — all live in the same `GcHeader::_reserved` i16, so one mask tests them.
+const OBJ_FLAG_WRITE_FAST_PATH_BLOCKED: &str = "2177";
 const F64_EXP_MASK: &str = "9218868437227405312"; // 0x7FF0_0000_0000_0000
 
 /// A widening arm for the class-field shape check: one concrete subclass whose
@@ -308,9 +309,9 @@ pub(crate) fn emit_class_field_loop_preheader_check(
         }
 
         if require_not_frozen {
-            let frozen = blk.and(I16, &reserved, OBJ_FLAG_FROZEN_BIT);
-            let not_frozen = blk.icmp_eq(I16, &frozen, "0");
-            acc = blk.and(I1, &acc, &not_frozen);
+            let blocked = blk.and(I16, &reserved, OBJ_FLAG_WRITE_FAST_PATH_BLOCKED);
+            let write_fast_path_ok = blk.icmp_eq(I16, &blocked, "0");
+            acc = blk.and(I1, &acc, &write_fast_path_ok);
         }
 
         // No terminator: the caller branches after verifying the fast clone.
@@ -394,7 +395,7 @@ pub(crate) fn emit_proven_shape_recheck(
 
     let res_ptr = blk.gep(I8, &obj_ptr, &[(I64, "-6")]);
     let reserved = blk.load(I16, &res_ptr);
-    let latched = blk.and(I16, &reserved, OBJ_FLAG_FROZEN_OR_DESCRIPTORS);
+    let latched = blk.and(I16, &reserved, OBJ_FLAG_WRITE_FAST_PATH_BLOCKED);
     let unlatched = blk.icmp_eq(I16, &latched, "0");
 
     // `class_id` @0 was already matched by the tower. ShapeId @4 proves the
@@ -554,6 +555,13 @@ pub(crate) fn emit_class_field_inline_precheck(
             let not_frozen = blk.icmp_eq(I16, &frozen, "0");
             acc = blk.and(I1, &acc, &not_frozen);
 
+            // #8690: an inline field write can overlap an Array-subclass
+            // numeric prefix. Route proof-authoritative receivers through the
+            // runtime setter so pointer-free SSO/boolean stores retire it too.
+            let numeric_proof = blk.and(I16, &reserved, OBJ_FLAG_PACKED_NUMERIC_PROOF_BIT);
+            let no_numeric_proof = blk.icmp_eq(I16, &numeric_proof, "0");
+            acc = blk.and(I1, &acc, &no_numeric_proof);
+
             if require_raw_f64 {
                 // Only a plain finite number may be stored raw. Non-finite
                 // (exponent all-ones: ±Inf/NaN — rare) and every NaN-boxed tag

crates/perry-codegen/src/expr/literals_vars.rs

@@ -14,7 +14,7 @@ use crate::lower_string_concat::{
 };
 use crate::nanbox::double_literal;
 use crate::native_value::ExpectedNativeRep;
-use crate::type_analysis::{is_map_expr, is_numeric_expr, is_set_expr, receiver_class_name};
+use crate::type_analysis::{is_map_expr, is_set_expr, receiver_class_name};
 use crate::types::{DOUBLE, I32, I64};
 
 use super::{
@@ -637,20 +637,20 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
             // still see the current value.
             if let Some(i32_slot) = ctx.i32_counter_slots.get(id).cloned() {
                 let structurally_i32 = can_lower_expr_as_i32_in_current_region(ctx, value);
-                // When `x` is proven numeric, `x | 0` may feed the canonical
+                // When `x` is a canonical raw Number, `x | 0` may feed the canonical
                 // i32 slot directly: materializing a double here only to
                 // convert it back would duplicate the spec ToInt32. Keep the
-                // numeric gate explicit — an untyped `x` can be a String, and
-                // its `+` expression must preserve concatenation before `|0`.
+                // canonical gate explicit — declared Number types are erased,
+                // so a local can still hold a String or BigInt at runtime.
                 let explicit_numeric_toint32 = matches!(
-                    value.as_ref(),
-                    Expr::Binary {
-                        op: BinaryOp::BitOr,
-                        left,
-                        right,
-                        ..
-                    } if matches!(right.as_ref(), Expr::Integer(0))
-                        && is_numeric_expr(ctx, left)
+                value.as_ref(),
+                Expr::Binary {
+                    op: BinaryOp::BitOr,
+                    left,
+                    right,
+                    ..
+                } if matches!(right.as_ref(), Expr::Integer(0))
+                    && crate::type_analysis::expr_produces_canonical_raw_f64(ctx, left)
                 );
                 if !ctx.closure_captures.contains_key(id)
                     && !(ctx.boxed_vars.contains(id) && !ctx.module_globals.contains_key(id))

crates/perry-codegen/src/expr/mod.rs

@@ -1616,10 +1616,6 @@ pub(crate) struct StablePackedLoopFact {
     /// an untagged IEEE Number. This is requested only when the indexed value
     /// appears below a numeric operator in the cloned body.
     pub numeric_elements: bool,
-    /// The clone was emitted against a preheader-cached receiver. Its entry is
-    /// enabled only after an emitted-IR scan proves the whole clone call-free,
-    /// so no allocation, collection, or proof-revoking runtime funnel can run.
-    pub preheader_stable: bool,
     /// Preheader-derived numeric storage bases. Admission proved the complete
     /// range is raw f64 and the call-free clone keeps these addresses stable.
     pub numeric_access: Option<StablePackedNumericAccess>,

crates/perry-codegen/src/lower_call/method_override.rs

@@ -21,11 +21,11 @@ const GC_TYPE_OBJECT: &str = "2";
 //
 //   gtype == GC_TYPE_OBJECT
 //   flags & GC_FLAG_FORWARDED == 0
-//   reserved & OBJ_FLAG_HAS_DESCRIPTORS == 0
+//   reserved & (OBJ_FLAG_HAS_DESCRIPTORS | OBJ_FLAG_PACKED_NUMERIC_PROOF) == 0
 //
-// Mask: 0x0800_0000 (descriptor bit) | 0x0000_8000 (forwarded bit) |
-// 0x0000_00ff (the complete gtype byte).
-const GC_OBJECT_METHOD_GUARD_MASK_I32: &str = "134250751"; // 0x0800_80ff
+// Mask: 0x0800_0000 (descriptor bit) | 0x0080_0000 (packed proof bit) |
+// 0x0000_8000 (forwarded bit) | 0x0000_00ff (the complete gtype byte).
+const GC_OBJECT_METHOD_GUARD_MASK_I32: &str = "142639359"; // 0x0880_80ff
 const SHAPE_ID_BASE_NEG_I32: &str = "-2147483648"; // subtract 0x8000_0000
 const SHAPE_ID_RANGE_LEN: &str = "1073741824"; // 0x4000_0000
 
@@ -136,13 +136,15 @@ mod packed_guard_tests {
         let obj_type_mask = 0x0000_00ffu32;
         let forwarded = u32::from(0x80u8) << 8;
         let has_descriptors = 0x0800u32 << 16;
-        let mask = obj_type_mask | forwarded | has_descriptors;
+        let packed_numeric_proof = 0x0080u32 << 16;
+        let mask = obj_type_mask | forwarded | has_descriptors | packed_numeric_proof;
         let expected = u32::from(2u8);
 
         assert_eq!(GC_OBJECT_METHOD_GUARD_MASK_I32, mask.to_string());
         assert_eq!(expected & mask, expected);
         assert_ne!((expected | forwarded) & mask, expected);
         assert_ne!((expected | has_descriptors) & mask, expected);
+        assert_ne!((expected | packed_numeric_proof) & mask, expected);
         assert_ne!((expected ^ 1) & mask, expected);
     }
 

crates/perry-codegen/src/stmt/loops.rs

@@ -4965,11 +4965,11 @@ pub(super) fn lower_for_after_init_with_i32_bound(
     // Saves ~25-30% on `for (let i = 0; i < arr.length; i++) arr[i] = i`
     // and `for (let i = 0; i < arr.length; i++) for (let j = 0; j <
     // arr.length; j++) ...` patterns.
-    let raw_hoist_classification: Option<LengthHoist> = if precomputed_i32_bound.is_some() {
-        None
-    } else {
-        condition.and_then(|cond| classify_for_length_hoist(ctx, cond, update, body))
-    };
+    // A precomputed bound replaces only the emitted length LOAD. Keep the
+    // structural classification: bounded-index facts, buffer-width facts and
+    // the counter's i32 slot are independent proofs consumed inside clones.
+    let raw_hoist_classification: Option<LengthHoist> =
+        condition.and_then(|cond| classify_for_length_hoist(ctx, cond, update, body));
     let hoist_rejection = if raw_hoist_classification.is_none() && precomputed_i32_bound.is_none() {
         condition.and_then(|cond| classify_for_length_hoist_rejection(ctx, cond, update, body))
     } else {
@@ -5024,8 +5024,10 @@ pub(super) fn lower_for_after_init_with_i32_bound(
     // i32 counter slot below are proofs and storage, not emitted work, and the
     // clone's other lowering may depend on them; suppressing those too would
     // trade one silent loss for another.
-    let in_call_free_clone =
-        !ctx.element_shape_loop_facts.is_empty() || !ctx.class_field_loop_facts.is_empty();
+    let in_call_free_clone = !ctx.element_shape_loop_facts.is_empty()
+        || !ctx.class_field_loop_facts.is_empty()
+        || !ctx.stable_packed_loop_facts.is_empty()
+        || precomputed_i32_bound.is_some();
     let hoisted_length_slot: Option<String> = if let Some(hoist) = hoist_classification {
         let hoisted_slot = if in_call_free_clone {
             None
@@ -5405,7 +5407,6 @@ pub(super) fn lower_for_after_init_with_i32_bound(
 
     // Body block.
     ctx.current_block = body_idx;
-    super::stable_packed_loop::emit_iteration_guard(ctx)?;
     super::versioned_indexed_loop::emit_iteration_guard(ctx);
     if let Some(cond) = condition {
         let mut guarded =
@@ -5632,10 +5633,7 @@ pub(crate) fn emit_gc_loop_safepoint(
     // scope is popped — keeps its poll either way.
     if !ctx.element_shape_loop_facts.is_empty()
         || !ctx.class_field_loop_facts.is_empty()
-        || ctx
-            .stable_packed_loop_facts
-            .last()
-            .is_some_and(|fact| fact.preheader_stable)
+        || !ctx.stable_packed_loop_facts.is_empty()
     {
         return;
     }

crates/perry-codegen/src/stmt/stable_packed_loop.rs

@@ -1,16 +1,16 @@
 //! Guarded loop versions for counted Array and Array-subclass iteration.
 //!
 //! A one-time runtime admission publishes scalar layout facts. The fast copy
-//! reloads the receiver root at iteration entry, compares compact header words,
-//! and performs the indexed load directly. Any failed proof resumes the
-//! unchanged generic loop at the current counter.
+//! is entered only after its emitted blocks are proven call-free, so its
+//! preheader-cached receiver and storage bases stay valid for the whole copy.
+//! Failed admission runs the unchanged generic loop from the current counter.
 
 use anyhow::Result;
 use perry_hir::{CompareOp, Expr, Stmt, UpdateOp};
 
 use crate::expr::{FnCtx, StablePackedLoopFact, StablePackedNumericAccess};
 use crate::native_value::{BoundsState, BufferAccessMode, LoweredValue, MaterializationReason};
-use crate::types::{DOUBLE, I1, I32, I64, I8, PTR};
+use crate::types::{DOUBLE, I1, I32, I64, PTR};
 
 #[derive(Clone, Copy)]
 enum LoopBound {
@@ -291,88 +291,6 @@ fn record_artifacts(ctx: &mut FnCtx<'_>, array_id: u32, receiver: &str) {
     );
 }
 
-pub(super) fn emit_iteration_guard(ctx: &mut FnCtx<'_>) -> Result<bool> {
-    let Some(fact) = ctx.stable_packed_loop_facts.last().cloned() else {
-        return Ok(false);
-    };
-    if fact.preheader_stable {
-        return Ok(true);
-    }
-    let receiver = crate::expr::lower_expr(ctx, &Expr::LocalGet(fact.array_local_id))?;
-    let bits = ctx.block().bitcast_double_to_i64(&receiver);
-    let raw = ctx.block().and(I64, &bits, crate::nanbox::POINTER_MASK_I64);
-    let tag = ctx.block().lshr(I64, &bits, "48");
-    let is_pointer = ctx.block().icmp_eq(I64, &tag, "32765");
-    let floor =
-        crate::target_layout::heap_addr_lower_bound_inclusive(ctx.target_triple).to_string();
-    let ceiling =
-        crate::target_layout::heap_addr_upper_bound_exclusive(ctx.target_triple).to_string();
-    let above = ctx.block().icmp_uge(I64, &raw, &floor);
-    let below = ctx.block().icmp_ult(I64, &raw, &ceiling);
-    let in_heap = ctx.block().and(I1, &above, &below);
-    let safe = ctx.block().and(I1, &is_pointer, &in_heap);
-
-    let deref_idx = ctx.new_block("stable_packed.iteration.deref");
-    let plain_idx = ctx.new_block("stable_packed.iteration.plain");
-    let object_idx = ctx.new_block("stable_packed.iteration.object");
-    let fast_idx = ctx.new_block("stable_packed.iteration.fast");
-    let deref_label = ctx.block_label(deref_idx);
-    let plain_label = ctx.block_label(plain_idx);
-    let object_label = ctx.block_label(object_idx);
-    let fast_label = ctx.block_label(fast_idx);
-    ctx.block()
-        .cond_br(&safe, &deref_label, &fact.side_exit_label);
-
-    ctx.current_block = deref_idx;
-    let gc_addr = ctx.block().sub(I64, &raw, "8");
-    let gc_ptr = ctx.block().inttoptr(I64, &gc_addr);
-    let live_gc = ctx.block().load_aligned(I64, &gc_ptr, 8);
-    let receiver_ptr = ctx.block().inttoptr(I64, &raw);
-    let live_header = ctx.block().load(I64, &receiver_ptr);
-    let expected_gc = descriptor_word(ctx, &fact.descriptor, 1);
-    let expected_header = descriptor_word(ctx, &fact.descriptor, 2);
-    let gc_ok = ctx.block().icmp_eq(I64, &live_gc, &expected_gc);
-    let header_ok = ctx.block().icmp_eq(I64, &live_header, &expected_header);
-    let header_words_ok = ctx.block().and(I1, &gc_ok, &header_ok);
-    let kind = descriptor_word(ctx, &fact.descriptor, 0);
-    let is_plain = ctx.block().icmp_eq(I64, &kind, "1");
-    let header_and_plain = ctx.block().and(I1, &header_words_ok, &is_plain);
-    ctx.block()
-        .cond_br(&header_and_plain, &plain_label, &object_label);
-
-    ctx.current_block = plain_idx;
-    let invalidated = ctx
-        .block()
-        .load_volatile(I8, "@PERRY_ARRAY_INDEX_FAST_PATH_INVALIDATED");
-    let prototype_ok = ctx.block().icmp_eq(I8, &invalidated, "0");
-    ctx.block()
-        .cond_br(&prototype_ok, &fast_label, &fact.side_exit_label);
-
-    ctx.current_block = object_idx;
-    let is_object = ctx.block().icmp_eq(I64, &kind, "2");
-    let mut object_ok = ctx.block().and(I1, &header_words_ok, &is_object);
-    let length_slot = descriptor_word(ctx, &fact.descriptor, 3);
-    let object_header_size =
-        crate::target_layout::object_header_size_bytes(ctx.target_triple).to_string();
-    let length_bytes = ctx.block().shl(I64, &length_slot, "3");
-    let length_offset = ctx.block().add(I64, &length_bytes, &object_header_size);
-    let length_addr = ctx.block().add(I64, &raw, &length_offset);
-    let length_ptr = ctx.block().inttoptr(I64, &length_addr);
-    let live_length = ctx.block().load(DOUBLE, &length_ptr);
-    let bound64 = descriptor_word(ctx, &fact.descriptor, 6);
-    let bound = ctx.block().uitofp(I64, &bound64, DOUBLE);
-    let length_covers_bound = ctx.block().fcmp("oge", &live_length, &bound);
-    object_ok = ctx.block().and(I1, &object_ok, &length_covers_bound);
-    ctx.block()
-        .cond_br(&object_ok, &fast_label, &fact.side_exit_label);
-
-    ctx.current_block = fast_idx;
-    if let Some(active) = ctx.stable_packed_loop_facts.last_mut() {
-        active.live_receiver_handle = Some(raw);
-    }
-    Ok(true)
-}
-
 pub(crate) fn try_lower_index_get(
     ctx: &mut FnCtx<'_>,
     object: &Expr,
@@ -540,8 +458,7 @@ pub(crate) fn has_numeric_index_fact(ctx: &FnCtx<'_>, expr: &Expr) -> bool {
         return false;
     };
     ctx.stable_packed_loop_facts.iter().rev().any(|fact| {
-        fact.preheader_stable
-            && fact.numeric_elements
+        fact.numeric_elements
             && fact.array_local_id == *array_id
             && fact.counter_local_id == *counter_id
     })
@@ -708,7 +625,6 @@ pub(super) fn lower(
         descriptor,
         live_receiver_handle: Some(fast_raw),
         numeric_elements: candidate.numeric_elements,
-        preheader_stable: true,
         numeric_access,
     });
     super::loops::lower_for_after_init_with_i32_bound(

crates/perry-codegen/src/stmt/versioned_indexed_loop.rs

@@ -351,7 +351,7 @@ pub(super) fn emit_iteration_guard(ctx: &mut FnCtx<'_>) -> bool {
     let object_ptr = ctx.block().inttoptr(I64, &this_handle);
     let gc_header_ptr = ctx.block().gep(I8, &object_ptr, &[(I64, "-8")]);
     let gc_header = ctx.block().load(I32, &gc_header_ptr);
-    let guarded_gc_bits = ctx.block().and(I32, &gc_header, "134250751");
+    let guarded_gc_bits = ctx.block().and(I32, &gc_header, "142639359");
     let gc_ok = ctx.block().icmp_eq(I32, &guarded_gc_bits, "2");
     let class_shape = ctx.block().load(I64, &object_ptr);
     let expected_shape_i64 = ctx.block().zext(I32, &fact.method.expected_shape_id, I64);
@@ -439,11 +439,9 @@ pub(super) fn lower(
             .get(position + 1)
             .map(String::as_str)
             .unwrap_or(method_entry_label.as_str());
-        let Some((local_slot, expected_fingerprint)) =
+        let (local_slot, expected_fingerprint) =
             emit_array_admission(ctx, local_id, &bound_i32, next, &slow_pre_label)
-        else {
-            return Ok(false);
-        };
+                .expect("matched array local has storage");
         array_facts.push(VersionedIndexedArrayFact {
             local_id,
             local_slot,