Merge main into the untyped-store branch

.github/workflows/release.yml

@@ -101,8 +101,8 @@ jobs:
           if (receiptRun) appendFileSync(process.env.GITHUB_OUTPUT, `receipt_run=${receiptRun}\n`);
           NODE
 
-  # Collects the native compiler's profile and function layout on this commit
-  # (scripts/refresh-cli-profile.mjs, scripts/refresh-cli-layout.mjs), so every
+  # Collects the native compiler's function layout and profile on this commit
+  # (scripts/refresh-cli-layout.mjs, scripts/refresh-cli-profile.mjs), so every
   # platform's CLI build optimizes and lays out the code it compiles. The
   # committed ones fall behind main within a day or two. If this job fails,
   # the CLI builds use the committed profile and layout.
@@ -111,7 +111,7 @@ jobs:
     needs: check-release
     if: needs.check-release.outputs.should_release == 'true' && needs.check-release.outputs.reuse_artifacts != 'true'
     runs-on: ubuntu-24.04
-    timeout-minutes: 45
+    timeout-minutes: 75
     continue-on-error: true
     permissions:
       contents: read
@@ -136,14 +136,20 @@ jobs:
           git clone --quiet --depth 1 https://github.com/vercel-labs/tsc-ts "$RUNNER_TEMP/tsc-ts"
           echo "tsc-ts $(git -C "$RUNNER_TEMP/tsc-ts" rev-parse HEAD)"
           npm ci --prefix "$RUNNER_TEMP/tsc-ts"
+      # The layout comes first: the profile matches the functions of builds
+      # with the layout its instrumented compiler was built with, so the
+      # profile is collected with a second instrumented compiler built with
+      # this layout.
+      - name: Collect the function layout
+        run: >-
+          node scripts/refresh-cli-layout.mjs --jobs 4
+          --output "$RUNNER_TEMP/cli-profile/cli.layout.gz" --work "$RUNNER_TEMP/cli-layout-work"
       - name: Collect the profile
+        env:
+          SCRIPTC_NATIVE_LAYOUT: ${{ runner.temp }}/cli-profile/cli.layout.gz
         run: >-
           node scripts/refresh-cli-profile.mjs --tsc-ts "$RUNNER_TEMP/tsc-ts" --jobs 4
           --output "$RUNNER_TEMP/cli-profile/cli.profdata.gz" --work "$RUNNER_TEMP/cli-profile-work"
-      - name: Collect the function layout
-        run: >-
-          node scripts/refresh-cli-layout.mjs --jobs 4 --instrumented "$RUNNER_TEMP/cli-profile-work/cli"
-          --output "$RUNNER_TEMP/cli-profile/cli.layout.gz"
       - uses: actions/upload-artifact@v4
         with:
           name: cli-profile

AGENTS.md

@@ -25,6 +25,8 @@ their supported native-clang contracts locally; other hosts retain those
 checks in the Sandboxes. Both lanes green is the bar before shipping any
 change.
 
+`SCRIPTC_SANDBOX_NATIVE_REFERENCE` names a built checkout inside a prepared `SCRIPTC_SANDBOX_SNAPSHOT` or image: each lane copies that checkout's LLVM helper and runtime pack instead of rebuilding them when their source inputs are identical. Sandbox creation is rate limited per team in vCPUs per minute, so the runner retries a rate-limited creation with backoff. Larger Sandboxes (`SCRIPTC_SANDBOX_VCPUS` up to 32, with `SCRIPTC_TEST_WORKERS` at half the vCPUs) shorten the lanes most.
+
 `VERCEL_OIDC_TOKEN` is the preferred credential. `VERCEL_TOKEN` remains
 supported with explicit `VERCEL_TEAM_ID` and `VERCEL_PROJECT_ID`. The custom
 `SCRIPTC_SANDBOX_IMAGE` is optional: without it, the gate starts from
@@ -58,6 +60,8 @@ A change that must not cost good code anything, such as a compatibility fix that
 node scripts/zero-cost-gate.mjs --baseline=/vercel/sandbox/prev --candidate=. --allow='\barguments\b'
 ```
 
+The whole gate takes 30 to 75 minutes on one 8-vCPU Sandbox, so shard it across Sandboxes. `--shard=i/n` splits the bench and corpus programs; the self-hosted compiler runs in shard 1, or alone with `--set=self`, and its candidate-source build overlaps its comparison build on hosts with 40 GB or more. Each shard writes `--json`, and `node scripts/zero-cost-merge.mjs <shard.json>...` merges them into one verdict, recomputing the compile-time intervals over every shard. `--record-baseline-cache=<file>` builds only the baseline and records each program's artifact hashes; `--baseline-cache=<file>` then skips the baseline build of every program whose candidate artifacts hash the same, which halves the work for a change that leaves most programs identical. A record applies only to the built baseline checkout, toolchain, and paths it was made with, and is ignored otherwise; a program whose entry, relative imports, or optimization level changed since the record builds its baseline.
+
 Test location follows scope:
 
 - Co-locate white-box unit tests with implementation files under

RELEASING.md

@@ -16,9 +16,9 @@ CI (`.github/workflows/release.yml`) compares the version in `packages/cli/packa
 
 The release job builds each pinned LLVM helper, precompiled runtime pack, and native CLI on its matching host. The native CLI package bundles its TypeScript checker, declarations, and comptime evaluator, and depends on its platform's LLVM helper and runtime pack packages at the same version; the compiler resolves them beside itself. The standalone archives bundle the helper and runtime pack too. npm postinstall installs the matching native executable; Node is needed for npm installation but not native compilation or execution. The user's toolchain performs the final platform link. Sanitized builds also use it to instrument program LLVM and compile the C runtime. Platform packages publish ahead of `@scriptc/compiler` and `scriptc`. The GitHub release attaches standalone compiler archives, their SHA-256 checksums, and the surface manifest after npm publication succeeds.
 
-Release builds of the native CLI optimize the compiler with a profile collected on the release commit. The `cli-profile` job runs `node scripts/refresh-cli-profile.mjs` on Linux x64, which builds an instrumented compiler, runs it on tsc-ts, a slice of the corpus, and the runtime benchmark workloads, and writes the merged sparse profile. Every platform's CLI build uses that profile (`SCRIPTC_NATIVE_PROFILE_USE`), and the GitHub release attaches it as `scriptc-<version>-cli.profdata.gz`. Code the profile does not describe, or describes from older compiler sources, is optimized as without a profile. When the profile job fails, the CLI builds use the committed profile `packages/compiler/native/cli.profdata.gz`, which local and CI builds of the native compiler also use. Refresh the committed profile when compiler code has changed substantially since the last refresh: run `node scripts/refresh-cli-profile.mjs --tsc-ts <tsc-ts checkout>` on a quiet Linux x64 host and commit the new profile on its own.
+Release builds of the native CLI optimize the compiler with a profile collected on the release commit. The `cli-profile` job runs `node scripts/refresh-cli-profile.mjs` on Linux x64, which builds an instrumented compiler, runs it on tsc-ts, a slice of the corpus, and the runtime benchmark workloads, and writes the merged profile. The profile keeps the functions that training never ran, with zero counts, so the CLI builds optimize them as cold code and place them after the code that ran. Every platform's CLI build uses that profile (`SCRIPTC_NATIVE_PROFILE_USE`), and the GitHub release attaches it as `scriptc-<version>-cli.profdata.gz`. Code the profile does not describe, or describes from older compiler sources, is optimized as without a profile. When the profile job fails, the CLI builds use the committed profile `packages/compiler/native/cli.profdata.gz`, which local and CI builds of the native compiler also use. Refresh the committed profile when compiler code has changed substantially since the last refresh: run `node scripts/refresh-cli-profile.mjs --tsc-ts <tsc-ts checkout>` on a quiet Linux x64 host and commit the new profile on its own.
 
-Builds of the native compiler also order its functions by the committed layout `packages/compiler/native/cli.layout.gz`: the functions that `--version` and rebuilds of unchanged programs run come first, then the ones other builds run, ordered by the share of the layout's training builds that run each, so a run maps fewer pages of the executable. Functions the layout does not list keep their usual order. Function names of closures and generated helpers change with nearby edits, so the `cli-profile` job also collects a layout on the release commit (`scripts/refresh-cli-layout.mjs`, reusing the job's instrumented compiler), and the CLI builds use it (`SCRIPTC_NATIVE_LAYOUT`). Refresh the committed layout the same way as the profile, with `node scripts/refresh-cli-layout.mjs`, and commit it on its own.
+Builds of the native compiler also order its functions by the committed layout `packages/compiler/native/cli.layout.gz`: the functions that `--version` and rebuilds of unchanged programs run come first, then the ones other builds run, ordered by the share of the layout's training builds that run each, so a run maps fewer pages of the executable. Functions the layout does not list keep their usual order. Function names of closures and generated helpers change with nearby edits, so the `cli-profile` job also collects a layout on the release commit (`scripts/refresh-cli-layout.mjs`), and the CLI builds use it (`SCRIPTC_NATIVE_LAYOUT`). Instrumented builds use the same layout as optimized builds, because a function laid out in a different partition than in the instrumented build no longer matches its profile record. The job therefore collects the layout first and then builds the instrumented compiler for the profile with that layout. Refresh the committed layout the same way, with `node scripts/refresh-cli-layout.mjs`, before the profile, and commit each on its own.
 
 Publishing uses npm trusted publishing (OIDC) — there is no npm token secret.
 Each published package must have a GitHub Actions trusted publisher for

docs/content/docs/how-it-works.mdx

@@ -134,8 +134,8 @@ Program objects define `main` and leave selected `scr_*` runtime functions undef
 
 ## Native runtime
 
-- **Memory:** Values use reference counting. Acyclic values are freed when their last reference is released, and a cycle collector runs at defined collection points. Some cycles involving opaque native values can remain allocated. When the main thread's script ends, the process exits without freeing what the program still holds, and the operating system reclaims it; worker threads free their heaps when they exit. Builds with `--sanitize`, and processes run with `SCRIPTC_EXIT_FREE=1` (for external leak checkers), free everything at exit.
-- **Concurrency:** An `async` function that suspends only at its own `await` expressions compiles to a stackless coroutine whose heap frame holds the values live across those awaits; other suspending `async` functions and async generators use stackful fibers. The native event loop schedules microtasks, timers, and I/O, using kqueue on macOS and epoll on Linux.
+- **Memory:** Values use reference counting. Acyclic values are freed when their last reference is released, and a cycle collector runs at defined collection points. When the compiler proves that a group of objects is released together, such as a tree that a recursive function builds and its caller only reads, the group is allocated in an arena and released at once, without freeing each object or collecting its cycles. Some cycles involving opaque native values can remain allocated. When the main thread's script ends, the process exits without freeing what the program still holds, and the operating system reclaims it; worker threads free their heaps when they exit. Builds with `--sanitize`, and processes run with `SCRIPTC_EXIT_FREE=1` (for external leak checkers), free everything at exit.
+- **Concurrency:** An `async` function or async generator that suspends only at its own `await` and `yield` expressions compiles to a stackless coroutine whose heap frame holds the values live across them; other suspending `async` functions and async generators use stackful fibers, as do debug builds, libraries, worker programs and Windows executables. The native event loop schedules microtasks, timers, and I/O, using kqueue on macOS and epoll on Linux.
 - **Networking:** Supported `net`, `http`, `https`, `tls`, `dgram`, and `dns` APIs use native implementations. TLS uses vendored mbedTLS.
 - **Numbers:** Values use JavaScript's double-precision representation. Number-to-string formatting uses shortest-roundtrip output and is tested against Node.js.
 - **Regular expressions and Unicode:** The runtime uses QuickJS's regular-expression and Unicode libraries, linked into programs that use them.

docs/content/limitations/array-bounds-and-runtime-errors.mdx

@@ -11,6 +11,6 @@ Runtime traps cannot be caught.
 User-thrown values and supported exceptions, including JSON parse, checked-cast, filesystem, regex, and `String.prototype.repeat` count errors, can be caught; hard traps such as out-of-range reads of statically typed ordinary arrays terminate the process.
 
 Deep recursion in Linux and macOS executables throws Node's catchable `RangeError: Maximum call stack size exceeded`, on the main thread, in worker threads, and inside async functions and generators.
-The depth at which it is thrown differs from Node: the main thread uses the process stack limit (usually 8 MiB), worker threads get an 8 MiB stack, and async functions and generators run on 512 KiB stacks, so native code usually recurses deeper than Node on threads and somewhat less deeply inside async bodies.
+The depth at which it is thrown differs from Node: the main thread uses the process stack limit (usually 8 MiB), worker threads get an 8 MiB stack, async functions and generators that keep a fiber run on 512 KiB stacks, and stackless ones run on the stack that resumes them, so native code usually recurses deeper than Node on threads and somewhat less deeply inside fiber bodies.
 Recursion inside runtime library operations, such as serializing deeply nested data, is not checked.
 Windows executables, WASI builds and library builds do not check the stack, and exhausting it there terminates the process.

native/llvm-codegen/src/emit.cpp

@@ -212,8 +212,8 @@ struct UnnameStructTypes : PassInfoMixin<UnnameStructTypes> {
 // How the --profile-use profile matched the functions it annotated, summed
 // over partitions: functions that received its counts, functions whose
 // control flow changed since it was collected (hash mismatch), and functions
-// it has no record of (new, or never run in training: the merged profile is
-// sparse). A partition reused from the cache without its counts is counted
+// it has no record of (new since it was collected, or never run in training
+// when the profile was merged with --sparse). A partition reused from the cache without its counts is counted
 // in Unknown.
 struct ProfileMatch {
   std::atomic<uint64_t> Annotated{0};

packages/compiler/src/backend/llvm/alloc.ts

@@ -141,7 +141,7 @@ const CYC_GEN = 3;
 /** ScrCycHdr.buf, an i32 at this header offset. */
 export const CYC_BUF = 4;
 /** The emitted descriptor `{ trace, free_fn, kind, id }` (ScrCycType). */
-const CYC_TYPE = "{ ptr, ptr, i32, i32 }";
+export const CYC_TYPE = "{ ptr, ptr, i32, i32 }";
 
 function declareState(host: AllocHost): void {
   if (host.threadLocalAlloc !== true) host.declare(`@scr_sa = external global ${SA_TYPE}`);

packages/compiler/src/backend/llvm/arenas.ts

@@ -0,0 +1,437 @@
+/* Group arenas (runtime scr_arena.h): objects that region-groups.ts proves
+ * die together are bump-allocated in an arena and released at once.
+ *
+ * - A root (a fresh-result call or `new` whose value its caller keeps in
+ *   one scope) opens an arena before it is evaluated and closes it after.
+ *   The scope that holds the value drops the arena when it exits, on every
+ *   path. A statement-frame entry closes the arena too, so an exception
+ *   that skips the close never leaves it the allocation target.
+ * - A call region (a call of a leak-free function that returns no
+ *   reference) opens an arena and drops it as soon as the call returns,
+ *   or when its statement frame unwinds.
+ *
+ * region-sites.ts keeps only the roots and call regions whose groups grow,
+ * and picks the allocations that take the arena: those whose value the
+ * group keeps. Arena-aware functions are the ones reached from the kept
+ * roots and call regions. There, a kept `new`, record or array literal
+ * calls the arena-aware constructor (`<new>.r`, `scr_arr_new*_r`), which
+ * allocates in the current arena when one is open and on the heap
+ * otherwise, and a call whose value the group does not keep runs with the
+ * arena suspended. Every other allocation site stays as it is.
+ *
+ * Arenas are off in programs that construct weak collections, in programs
+ * of more than ARENA_FUNCTION_LIMIT functions, in libraries, and with
+ * lifetime regions. */
+import type { IrClassDef, IrFunction, IrModule, IrType } from "../../ir/ir.js";
+import {
+  analyzeClosedGroups,
+  analyzeRegionGroups,
+  source,
+  type RegionGroups,
+} from "./region-groups.js";
+import { CYC_BUF, CYC_HDR, CYC_TYPE } from "./alloc.js";
+import { ALLOCATIONS, children, forEachNode, isExpr, type Node } from "./region-ir.js";
+import { planRegionSites, reachableFrom, type RegionSites } from "./region-sites.js";
+
+/** The count an arena object starts with (scr_arena.h SCR_ARENA_RC). */
+export const ARENA_RC = 2 ** 29;
+
+/** Group arenas are on unless SCRIPTC_ARENAS=0 (for comparisons). */
+export function arenasRequested(): boolean {
+  return process.env["SCRIPTC_ARENAS"] !== "0";
+}
+
+export interface ArenaPlan {
+  groups: RegionGroups;
+  sites: RegionSites;
+  /** Record shapes and classes that get an arena-aware constructor. */
+  shapes: Set<string>;
+  classes: Set<string>;
+}
+
+export interface ArenaEligibility {
+  shape(shapeId: string): boolean;
+  cls(def: IrClassDef): boolean;
+  /** The reference arm of a union stored as a nullable pointer, or null. */
+  nullableArm(unionId: string): IrType | null;
+  /** Whether values of `t` can be on a reference cycle (the collector
+   * traces them). */
+  traced(t: IrType): boolean;
+}
+
+/** Whether `mod` can construct a WeakMap or WeakSet, directly or through
+ * a stored global constructor. A weak collection's entry for a key goes
+ * when the key is freed, and an arena object is never freed on its own, so
+ * such programs use no arenas. */
+function constructsWeakCollections(mod: IrModule): boolean {
+  let found = false;
+  const visit = (node: Node): void => {
+    if (found) return;
+    if (node.kind === "libCall") {
+      if (node.fn === "weakMap.new" || node.fn === "weakSet.new") found = true;
+      else if (node.fn === "dyn.globalConstructor") {
+        const name = node.args[0];
+        if (name?.kind !== "strLit" || name.value === "WeakMap" || name.value === "WeakSet")
+          found = true;
+      }
+    }
+    const kids: Node[] = [];
+    children(node, kids);
+    for (const k of kids) visit(k);
+  };
+  for (const fn of mod.functions) for (const s of fn.body) visit(s);
+  return found;
+}
+
+/** Programs with more functions than this use no arenas: the analysis
+ * visits every function, and on programs this large it costs more compile
+ * time than their arenas save at run time. */
+const ARENA_FUNCTION_LIMIT = 4000;
+
+/** The arena plan of `mod`, or null when nothing would use an arena. */
+export function planArenas(mod: IrModule, eligible: ArenaEligibility): ArenaPlan | null {
+  if (mod.functions.length > ARENA_FUNCTION_LIMIT || constructsWeakCollections(mod)) return null;
+  const groups = analyzeRegionGroups(mod);
+  const sites = planRegionSites(mod, groups);
+  if (groups.roots.size === 0 && groups.calls.size === 0) return null;
+  const shapes = new Set<string>();
+  const classes = new Set<string>();
+  const defs = new Map((mod.classes ?? []).map((c) => [c.name, c]));
+  const note = (node: Node): void => {
+    const kept = sites.arenaSites.has(node) || groups.roots.has(node);
+    if (
+      kept &&
+      node.kind === "recordLit" &&
+      node.type.kind === "record" &&
+      eligible.shape(node.type.shapeId)
+    )
+      shapes.add(node.type.shapeId);
+    if (kept && node.kind === "new") {
+      const def = defs.get(node.className);
+      if (def !== undefined && eligible.cls(def)) classes.add(node.className);
+    }
+    const kids: Node[] = [];
+    children(node, kids);
+    for (const k of kids) note(k);
+  };
+  for (const fn of mod.functions)
+    if (groups.reachable.has(fn.name)) for (const s of fn.body) note(s);
+  for (const r of groups.roots) if (r.kind === "new") note(r);
+  // A group's heap objects die when its arena drops, unless heap objects
+  // hold each other in a cycle: the collector frees those later, and by
+  // then their references into the arena point at recycled memory. So a
+  // group keeps its arena only if every cycle-capable object it can
+  // allocate takes the arena.
+  const takesArena = (node: Node): boolean =>
+    (sites.arenaSites.has(node) || groups.roots.has(node)) &&
+    ((node.kind === "recordLit" && node.type.kind === "record" && shapes.has(node.type.shapeId)) ||
+      (node.kind === "new" && classes.has(node.className)) ||
+      node.kind === "arrayLit");
+  const unsafe = cycleUnsafeFunctions(mod, groups.reachable, sites, takesArena, eligible.traced);
+  for (const r of [...groups.roots, ...groups.calls]) {
+    const runs = reachableFrom(mod, [r]);
+    if ([...runs].some((f) => unsafe.has(f)) || (r.kind === "new" && !takesArena(r))) {
+      groups.roots.delete(r);
+      groups.calls.delete(r);
+      groups.drops.delete(r);
+    }
+  }
+  if (groups.roots.size === 0 && groups.calls.size === 0) return null;
+  groups.reachable = reachableFrom(mod, [...groups.roots, ...groups.calls]);
+  const arenaType = (t: IrType): boolean => {
+    if (t.kind === "object") return classes.has(t.className);
+    if (t.kind === "record") return shapes.has(t.shapeId);
+    if (t.kind === "union") {
+      const arm = eligible.nullableArm(t.unionId);
+      return arm !== null && arenaType(arm);
+    }
+    // Arrays of arena objects: kept array literals of them take the arena.
+    return t.kind === "array" && t.elem.kind !== "union" && arenaType(t.elem);
+  };
+  const keptSite = (e: Node): boolean => sites.arenaSites.has(e) || groups.roots.has(e);
+  for (const r of analyzeClosedGroups(mod, groups, arenaType, keptSite)) groups.closed.add(r);
+  return { groups, sites, shapes, classes };
+}
+
+/** The functions in `reachable` that can allocate a cycle-capable object
+ * on the heap while an arena is open: one that does not take the arena
+ * (`takesArena`), or a call that runs with the arena suspended and reaches
+ * any cycle-capable allocation. */
+function cycleUnsafeFunctions(
+  mod: IrModule,
+  reachable: ReadonlySet<string>,
+  sites: RegionSites,
+  takesArena: (node: Node) => boolean,
+  traced: (t: IrType) => boolean,
+): Set<string> {
+  const fns = new Map(mod.functions.map((f) => [f.name, f]));
+  const allocatesTraced = (node: Node): boolean =>
+    isExpr(node) &&
+    traced(node.type) &&
+    (node.kind === "closure"
+      ? node.captures.length > 0
+      : (ALLOCATIONS.has(node.kind) || source(node) || node.kind === "libCall") &&
+        node.kind !== "call" &&
+        node.kind !== "callValue");
+  // Functions with a cycle-capable allocation, and what they call.
+  const direct = new Set<string>();
+  const calls = new Map<string, Set<string>>();
+  const heap = new Set<string>();
+  for (const name of reachable) {
+    const fn = fns.get(name);
+    if (fn === undefined) continue;
+    const out = new Set<string>();
+    calls.set(name, out);
+    forEachNode(fn.body, (node) => {
+      if (allocatesTraced(node)) {
+        direct.add(name);
+        if (!takesArena(node)) heap.add(name);
+      }
+      if (node.kind === "call") out.add(node.callee);
+      else if (node.kind === "new") out.add(`%${node.className}.constructor`);
+      else if (node.kind === "closure") out.add(node.fnName);
+    });
+  }
+  const tracedSomewhere = new Set(direct);
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const [name, out] of calls)
+      if (!tracedSomewhere.has(name) && [...out].some((c) => tracedSomewhere.has(c))) {
+        tracedSomewhere.add(name);
+        changed = true;
+      }
+  }
+  for (const name of reachable) {
+    const fn = fns.get(name);
+    if (fn === undefined || heap.has(name)) continue;
+    forEachNode(fn.body, (node) => {
+      if (!sites.heapCalls.has(node)) return;
+      const target =
+        node.kind === "call"
+          ? node.callee
+          : node.kind === "new"
+            ? `%${node.className}.constructor`
+            : null;
+      // A suspended call of an unknown function (a closure, a virtual call)
+      // may allocate anything.
+      if (target === null || tracedSomewhere.has(target)) heap.add(name);
+    });
+  }
+  return heap;
+}
+
+/** The arena-aware constructor of a record shape or class. */
+export function arenaNewSym(newSym: string): string {
+  return `${newSym}.r`;
+}
+
+/** The function that releases an arena object's fields at the drop. */
+export function arenaDisposeSym(newSym: string): string {
+  return `${newSym}.dispose`;
+}
+
+/** Whether `fn` allocates through arena-aware constructors. */
+export function arenaAware(plan: ArenaPlan | null, fn: IrFunction | undefined): boolean {
+  return plan !== null && fn !== undefined && plan.groups.reachable.has(fn.name);
+}
+
+/** What arenaNewLines needs from its host (a subset of ShapeHost). */
+export interface ArenaHost {
+  declare(decl: string): void;
+  threadLocalAlloc?: boolean;
+  inlineAlloc?: boolean;
+  /** The target C ABI's `size_t`: also the pointer width. */
+  readonly sizeType: "i32" | "i64";
+}
+
+/** Instructions that set `dest` to the address of the calling thread's
+ * open arena pointer (scr_arena.c's scr_arena_cur), or null on targets
+ * without the inline allocator, which call scr_arena_current,
+ * scr_arena_suspend and scr_arena_resume instead. In worker programs the
+ * pointer is thread-local. */
+export function arenaCurrentAddress(host: ArenaHost, dest: string): string[] | null {
+  if (host.inlineAlloc !== true) return null;
+  if (host.threadLocalAlloc !== true) {
+    host.declare(`@scr_arena_cur = external global ptr`);
+    return [`${dest} = getelementptr inbounds i8, ptr @scr_arena_cur, i64 0`];
+  }
+  host.declare(`@scr_arena_cur = external thread_local global ptr`);
+  host.declare(`declare nonnull ptr @llvm.threadlocal.address.p0(ptr nonnull)`);
+  return [`${dest} = call ptr @llvm.threadlocal.address.p0(ptr @scr_arena_cur)`];
+}
+
+/**
+ * The arena-aware constructor `<new>.r`: an object of `size` bytes (a
+ * `size_t` constant expression) in the current arena, behind the collector header
+ * `cyc` names (or none), which `init` sets up the way the heap constructor
+ * does (with the count ARENA_RC). When `dispose` names a function and the
+ * arena is not closed, the object goes on the arena's dispose list, which
+ * the drop runs. The heap constructor's object when no arena is open or
+ * the arena is full. The bump, the clear, the header and the dispose entry
+ * are inline (scr_arena.c's ScrArena ABI); scr_arena_obj takes a new chunk
+ * and scr_arena_disposal grows the list.
+ */
+export function arenaNewLines(
+  host: ArenaHost,
+  newSym: string,
+  size: string,
+  cyc: string | null,
+  dispose: string | null,
+  init: string[],
+  result: string,
+): string[] {
+  const S = host.sizeType;
+  // ScrArena's fields and dispose entries are pointer-sized (scr_arena.c).
+  const word = S === "i32" ? 4 : 8;
+  host.declare(`declare ptr @scr_arena_obj(ptr, ${S}, ptr)`);
+  host.declare(`declare void @llvm.memset.p0.${S}(ptr, i8, ${S}, i1)`);
+  const cur = arenaCurrentAddress(host, "%cur");
+  const current =
+    cur === null
+      ? (host.declare(`declare ptr @scr_arena_current()`), [`  %a = call ptr @scr_arena_current()`])
+      : [...cur.map((line) => `  ${line}`), `  %a = load ptr, ptr %cur`];
+  const lines: string[] = [
+    `define internal ptr @${arenaNewSym(newSym)}() nounwind alwaysinline { ; in the open arena`,
+    `entry:`,
+    ...current,
+    `  %on = icmp ne ptr %a, null`,
+    `  br i1 %on, label %arena, label %heap`,
+    `arena:`,
+  ];
+  // A traced type's first object registers its descriptor on the slow path.
+  if (cyc !== null)
+    lines.push(
+      `  %tidp = getelementptr inbounds ${CYC_TYPE}, ptr ${cyc}, i32 0, i32 3`,
+      `  %tid = load atomic i32, ptr %tidp acquire, align 4`,
+      `  %creg = icmp ne i32 %tid, 0`,
+    );
+  const hdr = cyc === null ? 0 : CYC_HDR;
+  lines.push(
+    `  %n0 = add ${S} ${size}, ${hdr + 7}`,
+    `  %n = and ${S} %n0, -8`,
+    `  %bp = load ptr, ptr %a`,
+    `  %limp = getelementptr inbounds i8, ptr %a, ${S} ${word}`,
+    `  %lim = load ptr, ptr %limp`,
+    `  %bpi = ptrtoint ptr %bp to ${S}`,
+    `  %limi = ptrtoint ptr %lim to ${S}`,
+    `  %room = sub ${S} %limi, %bpi`,
+    `  %fits0 = icmp ule ${S} %n, %room`,
+  );
+  if (cyc !== null) lines.push(`  %fits = and i1 %fits0, %creg`);
+  lines.push(
+    `  br i1 ${cyc === null ? "%fits0" : "%fits"}, label %carve, label %slow`,
+    `carve:`,
+    `  %end = getelementptr inbounds i8, ptr %bp, ${S} %n`,
+    `  store ptr %end, ptr %a`,
+    `  call void @llvm.memset.p0.${S}(ptr align 8 %bp, i8 0, ${S} %n, i1 false)`,
+  );
+  if (cyc !== null)
+    lines.push(
+      `  %id = trunc i32 %tid to i16`,
+      `  store i16 %id, ptr %bp ; ScrCycHdr.id`,
+      `  %bufp = getelementptr inbounds i8, ptr %bp, i64 ${CYC_BUF}`,
+      `  store i32 -1, ptr %bufp ; ScrCycHdr.buf = SCR_CYC_ACYCLIC`,
+    );
+  lines.push(
+    `  %of = getelementptr inbounds i8, ptr %bp, ${S} ${hdr}`,
+    `  br label %init`,
+    `slow:`,
+    `  %os = call ptr @scr_arena_obj(ptr %a, ${S} ${size}, ptr ${cyc ?? "null"})`,
+    `  %got = icmp ne ptr %os, null`,
+    `  br i1 %got, label %init, label %heap`,
+    `init:`,
+    `  %o = phi ptr [ %of, %carve ], [ %os, %slow ]`,
+    ...init,
+  );
+  if (dispose !== null) {
+    host.declare(`declare void @scr_arena_disposal(ptr, ptr, ptr)`);
+    lines.push(
+      `  %closedp = getelementptr inbounds i8, ptr %a, ${S} ${4 * word} ; ScrArena.closed`,
+      `  %closed = load i32, ptr %closedp`,
+      `  %skip = icmp ne i32 %closed, 0`,
+      `  br i1 %skip, label %done, label %list`,
+      `list:`,
+      `  %dpp = getelementptr inbounds i8, ptr %a, ${S} ${2 * word} ; ScrArena.disposals`,
+      `  %dp = load ptr, ptr %dpp`,
+      `  %dep = getelementptr inbounds i8, ptr %a, ${S} ${3 * word} ; ScrArena.disposals_end`,
+      `  %de = load ptr, ptr %dep`,
+      `  %full = icmp eq ptr %dp, %de`,
+      `  br i1 %full, label %grow, label %push`,
+      `push:`,
+      `  store ptr %o, ptr %dp ; ScrArenaDisposal.obj`,
+      `  %dfp = getelementptr inbounds i8, ptr %dp, ${S} ${word}`,
+      `  store ptr @${dispose}, ptr %dfp ; ScrArenaDisposal.dispose`,
+      `  %dn = getelementptr inbounds i8, ptr %dp, ${S} ${2 * word}`,
+      `  store ptr %dn, ptr %dpp`,
+      `  br label %done`,
+      `grow:`,
+      `  call void @scr_arena_disposal(ptr %a, ptr %o, ptr @${dispose})`,
+      `  br label %done`,
+      `done:`,
+    );
+  }
+  lines.push(
+    `  ret ptr ${result}`,
+    `heap:`,
+    `  %h = call ptr @${newSym}()`,
+    `  ret ptr %h`,
+    `}`,
+    ``,
+  );
+  return lines;
+}
+
+/** Dispose lines for field `i` of `%o` at `ptr` (a getelementptr into
+ * `%o`), released by `release`: a plain reference (no union encoding) is
+ * released only when it is a heap object, since an arena or immortal
+ * object's count (the rc word's low half) is at least 2^28 and its release
+ * would change nothing. */
+export function disposeFieldLines(
+  i: number,
+  gep: string,
+  plain: boolean,
+  release: string,
+  comment: string,
+): string[] {
+  const load = [`  %f${i} = ${gep}`, `  %v${i} = load ptr, ptr %f${i}`];
+  if (!plain) return [...load, `  call void ${release}(ptr %v${i}) ; ${comment}`];
+  return [
+    ...load,
+    `  %nn${i} = icmp ne ptr %v${i}, null`,
+    `  br i1 %nn${i}, label %chk${i}, label %next${i}`,
+    `chk${i}:`,
+    `  %rc${i} = load i32, ptr %v${i}`,
+    `  %heap${i} = icmp ult i32 %rc${i}, ${2 ** 28}`,
+    `  br i1 %heap${i}, label %rel${i}, label %next${i}`,
+    `rel${i}:`,
+    `  call void ${release}(ptr %v${i}) ; ${comment}`,
+    `  br label %next${i}`,
+    `next${i}:`,
+  ];
+}
+
+/** Whether values of `t` are plain pointers to counted objects. */
+export function plainRefType(t: IrType): boolean {
+  return (
+    t.kind === "object" ||
+    t.kind === "record" ||
+    t.kind === "array" ||
+    t.kind === "map" ||
+    t.kind === "set" ||
+    t.kind === "func" ||
+    t.kind === "string"
+  );
+}
+
+/** The dispose function: releases each reference field (`fields`, lines
+ * that load `%v<i>` and release it) of the object `%o`. */
+export function arenaDisposeLines(newSym: string, fields: string[]): string[] {
+  return [
+    `define internal void @${arenaDisposeSym(newSym)}(ptr %o) nounwind { ; arena drop`,
+    `entry:`,
+    ...fields,
+    `  ret void`,
+    `}`,
+    ``,
+  ];
+}

packages/compiler/src/backend/llvm/bytes-loop-versions.test.ts

@@ -222,6 +222,55 @@ test("negative factors, rebinding, captures and outer loops are not versioned",
   expect(match(fn([outer]), inner)).not.toBeNull();
 });
 
+test("loops with nested loops version only for accesses inside them", () => {
+  // for (let i = 0; i < 64; i++) {
+  //   let t = 0;
+  //   for (let j = 0; j < n; j++) t = t + src[j];
+  //   out[i] = t;
+  // }
+  const sum = (): IrStmt[] => [
+    { kind: "varDecl", localId: "t", init: num(0), loc },
+    counted(
+      [
+        {
+          kind: "assign",
+          localId: "t",
+          value: bin("+", ref("t"), get(ref("src", f64s), ref("j"))),
+          loc,
+        },
+      ],
+      ref("n"),
+      "j",
+    ),
+  ];
+  const extra = [local("t", F64, true)];
+  // The guard would prove only `out[i]`, which runs once per row.
+  const rows = counted([...sum(), set(ref("out", f64s), ref("i"), ref("t"))], num(64));
+  expect(match(fn([rows], extra), rows)).toBeNull();
+  expect(match(fn([rows], extra), rows.body[1] as IrStmt & { kind: "for" })).not.toBeNull();
+  // The guard proves `out[i]` inside a nested loop too.
+  const inside = counted(
+    [...sum(), counted([set(ref("out", f64s), ref("i"), ref("t"))], num(2), "j")],
+    num(64),
+  );
+  expect(match(fn([inside], extra), inside)?.bounds.size).toBe(1);
+  // A loop whose nested loops access no typed array versions for its own
+  // accesses.
+  const scalar = counted(
+    [
+      { kind: "varDecl", localId: "t", init: num(0), loc },
+      counted(
+        [{ kind: "assign", localId: "t", value: bin("+", ref("t"), ref("j")), loc }],
+        ref("n"),
+        "j",
+      ),
+      set(ref("out", f64s), ref("i"), ref("t")),
+    ],
+    num(64),
+  );
+  expect(match(fn([scalar], extra), scalar)?.bounds.size).toBe(1);
+});
+
 test("emitted loops version the body and tag typed-array memory", () => {
   const loop = counted([
     set(ref("out", f64s), ref("i"), bin("*", get(ref("src", f64s), ref("i")), num(2))),

packages/compiler/src/backend/llvm/bytes-loop-versions.ts

@@ -196,9 +196,10 @@ const INVARIANT_OPS = new Set(["+", "-", "*", "&", "|", "^", "<<", ">>", ">>>"])
  * and writes thread-owned views directly.
  *
  * Only small synchronous loops are versioned (nested loops included), and
- * the emitter bounds how deeply versions nest. The checked loop runs
- * whenever the guard fails, and keeps every out-of-bounds read, ignored
- * write and NaN-index behavior. */
+ * the emitter bounds how deeply versions nest. A loop whose nested loops
+ * access typed arrays versions only for an access inside them. The checked
+ * loop runs whenever the guard fails, and keeps every out-of-bounds read,
+ * ignored write and NaN-index behavior. */
 export function matchBytesLoopVersion(
   loop: IrStmt & { kind: "for" | "while" },
   counted: IntegerCountedForLoop | null,
@@ -492,7 +493,15 @@ export function matchBytesLoopVersion(
   const pairedCounters =
     paired !== null && counted === null ? new Set([paired.low.localId, paired.high.localId]) : null;
   const pairedNodes = new Map<number, Node[]>();
+  // Accesses inside the loop's nested loops, and inside its nested while
+  // loops.
+  const nested = new Set<Node>();
+  const nestedWhile = new Set<Node>();
+  let loops = 0,
+    whiles = 0;
   const access = (node: Node, array: IrExpr, index: IrExpr, width: number): void => {
+    if (loops > 0) nested.add(node);
+    if (whiles > 0) nestedWhile.add(node);
     const ref = root(array);
     if (!ref) return;
     if (facts.workers && ref.type.kind === "bytes" && !facts.owned.has(node)) {
@@ -603,7 +612,15 @@ export function matchBytesLoopVersion(
       access(s, s.arr, s.index, 1);
       scope(s, s.arr, true);
     }
-    return everyStmtChild(s, visitExpr, visitStmt);
+    const isLoop =
+      s.kind === "for" || s.kind === "forOf" || s.kind === "while" || s.kind === "doWhile";
+    const isWhile = s.kind === "while" || s.kind === "doWhile";
+    if (isLoop) loops++;
+    if (isWhile) whiles++;
+    const result = everyStmtChild(s, visitExpr, visitStmt);
+    if (isLoop) loops--;
+    if (isWhile) whiles--;
+    return result;
   };
   loop.body.every(visitStmt);
   if (loop.kind === "while") visitExpr(loop.cond);
@@ -714,6 +731,18 @@ export function matchBytesLoopVersion(
     used.add(receiver);
     for (const node of nodes) bounds.add(node);
   }
+  // A loop whose nested loops access typed arrays versions only when the
+  // guard proves the bounds of one of those accesses (or, in a worker
+  // program, the ownership of one inside a nested while loop, which never
+  // versions for ownership alone). Otherwise the guard covers accesses that
+  // run once per pass, while each copy of the body repeats every nested
+  // loop and each nested loop's own version.
+  if (
+    nested.size > 0 &&
+    ![...bounds].some((node) => nested.has(node)) &&
+    ![...ownedNodes].some((node) => nestedWhile.has(node))
+  )
+    return null;
   const counterChecks: CounterCheck[] = [];
   for (const [id, min] of counterMins) {
     const info = whileAccesses!.counters.get(id)!;

packages/compiler/src/backend/llvm/classes.ts

@@ -1,3 +1,11 @@
+import {
+  ARENA_RC,
+  arenaDisposeLines,
+  arenaDisposeSym,
+  arenaNewLines,
+  disposeFieldLines,
+  plainRefType,
+} from "./arenas.js";
 import { InternalCompilerError } from "../../errors.js";
 /** Class layouts, reference counting, hierarchy intervals, virtual tables and
  * constructor values. Opaque LLVM pointers allow virtual slots to store method
@@ -1415,6 +1423,8 @@ export function emitClassShapes(
           storedHeaderBytes(meta),
         ),
       );
+    // The header and field set-up, shared with the arena-aware constructor.
+    const initStart = nw.length;
     if (meta.compact && !meta.hierarchy)
       nw.push(`  store i32 ${compactHeaderWord(meta)}, ptr %o ; no count (compactHeaderWord)`);
     else if (meta.compact) {
@@ -1483,6 +1493,7 @@ export function emitClassShapes(
     // Young instances: program-owned traced classes. Classes rooted at a
     // runtime base (errors, emitters, events, streams) carry runtime state
     // and stay with trial deletion, like every runtime family.
+    const init = nw.slice(initStart);
     if (
       traced &&
       !lifetime &&
@@ -1492,6 +1503,52 @@ export function emitClassShapes(
       nw.push(...youngEntryLines(host));
     nw.push(`  ret ptr ${meta.hierarchy ? "%o.vt" : "%o"}`, `}`, ``);
     defs.push(...nw);
+    if (
+      host.arenaClasses?.has(cls.name) === true &&
+      cls.arrayElem === undefined &&
+      !lifetime &&
+      regions === null &&
+      !meta.compact &&
+      runtimePrefix === null &&
+      !isStreamRooted &&
+      !meta.threadSlot
+    ) {
+      // The arena count in place of 1, in the rc word or its low half.
+      const counted = meta.idInRc
+        ? `  store i64 ${classIdRcWord(meta, false)}, ptr %o.vt`
+        : `  store ${host.sizeType} 1, ptr %o`;
+      const arenaCount = meta.idInRc
+        ? `  store i64 ${(BigInt(meta.pre + 1) * 2n ** 32n + BigInt(ARENA_RC)).toString()}, ptr %o.vt`
+        : `  store ${host.sizeType} ${ARENA_RC}, ptr %o`;
+      const newSym = mangleClassNew(cls.name);
+      const dispose = refFields.length > 0 ? arenaDisposeSym(newSym) : null;
+      defs.push(
+        ...arenaNewLines(
+          host,
+          newSym,
+          sizeOf,
+          traced ? cycType : null,
+          dispose,
+          init.map((line) => (line.startsWith(counted) ? arenaCount : line)),
+          meta.hierarchy ? "%o.vt" : "%o",
+        ),
+      );
+      if (dispose !== null)
+        defs.push(
+          ...arenaDisposeLines(
+            newSym,
+            refFields.flatMap((f, t) =>
+              disposeFieldLines(
+                t,
+                `getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${f.index}`,
+                plainRefType(f.type),
+                releaseSym(host, f.type),
+                llvmCommentText(f.name),
+              ),
+            ),
+          ),
+        );
+    }
 
     if (traced) {
       // trace: visit exactly the cycle-capable fields; gcFree: release

packages/compiler/src/backend/llvm/dense-array-access.ts

@@ -19,6 +19,7 @@
  * length, so reads never reach the state check for it; a write past the
  * bound tests the flag and, without states, appends at the length. */
 
+import { InternalCompilerError } from "../../errors.js";
 import { isRefCounted, type IrExpr, type IrType } from "../../ir/ir.js";
 import {
   f64Lit,
@@ -371,7 +372,9 @@ export function emitDenseArrayGet(
 
 /** emitDenseArrayGet, with the int32 of an int32 array's element: the
  * slot itself on the dense path, the runtime getter's double converted
- * (exactly: the element is an int32) on the other. */
+ * (exactly: the element is an int32) on the other. With `inexact`, the
+ * getter's double may be something other than an int32 (NaN from
+ * `scr_arr_get_number`): the read branches there when it is. */
 export function emitDenseArrayRead(
   host: LlvmEmitterContext,
   array: string,
@@ -382,6 +385,7 @@ export function emitDenseArrayRead(
   getter: string,
   retain: boolean,
   proven = false,
+  inexact?: string,
 ): { value: string; int32: string | null } {
   const B = host.B;
   const ty = valueType(acc);
@@ -463,22 +467,68 @@ export function emitDenseArrayRead(
       : READ_FALLBACK;
   B.line(`${slowValue} = call ${ty} @${getter}(ptr ${array}, double ${index.name})${attrs}`);
   let slowInt: string | null = null;
-  if (fastInt !== null) {
+  let slowLabel = slow;
+  if (fastInt !== null && inexact !== undefined) {
+    // An int32 that is not -0, or the inexact branch.
+    host.declare("declare i32 @llvm.fptosi.sat.i32.f64(double)");
+    slowInt = B.tmp();
+    const back = B.tmp(),
+      exact = B.tmp(),
+      bits = B.tmp(),
+      notNegativeZero = B.tmp(),
+      ok = B.tmp();
+    B.line(`${slowInt} = call i32 @llvm.fptosi.sat.i32.f64(double ${slowValue})`);
+    B.line(`${back} = sitofp i32 ${slowInt} to double`);
+    B.line(`${exact} = fcmp oeq double ${back}, ${slowValue}`);
+    B.line(`${bits} = bitcast double ${slowValue} to i64`);
+    B.line(`${notNegativeZero} = icmp ne i64 ${bits}, -9223372036854775808`);
+    B.line(`${ok} = and i1 ${exact}, ${notNegativeZero}`);
+    slowLabel = B.newLabel("arr.get.int32");
+    B.condBr(ok, slowLabel, inexact);
+    B.startBlock(slowLabel);
+  } else if (fastInt !== null) {
     slowInt = B.tmp();
     B.line(`${slowInt} = fptosi double ${slowValue} to i32`);
   }
   B.br(join);
   B.startBlock(join);
   const result = B.tmp();
-  B.line(`${result} = phi ${ty} [ ${fast}, %${fastLabel} ], [ ${slowValue}, %${slow} ]`);
+  B.line(`${result} = phi ${ty} [ ${fast}, %${fastLabel} ], [ ${slowValue}, %${slowLabel} ]`);
   let int32: string | null = null;
   if (fastInt !== null && slowInt !== null) {
     int32 = B.tmp();
-    B.line(`${int32} = phi i32 [ ${fastInt}, %${fastLabel} ], [ ${slowInt}, %${slow} ]`);
+    B.line(`${int32} = phi i32 [ ${fastInt}, %${fastLabel} ], [ ${slowInt}, %${slowLabel} ]`);
   }
   return { value: result, int32 };
 }
 
+/** emitDenseArrayNumber of an int32 array, with the element's int32: a
+ * read that answers NaN (or another value that is not an int32) branches
+ * to `inexact`. */
+export function emitDenseArrayNumberInt32(
+  host: LlvmEmitterContext,
+  array: string,
+  index: LlValue,
+  indexExpr: IrExpr | undefined,
+  proven: boolean,
+  inexact: string,
+): { value: string; int32: string } {
+  const read = emitDenseArrayRead(
+    host,
+    array,
+    index,
+    indexExpr,
+    "i32",
+    { kind: "f64" },
+    "scr_arr_get_number",
+    false,
+    proven,
+    inexact,
+  );
+  if (read.int32 === null) throw new InternalCompilerError("llvm emitter bug: int32 read");
+  return { value: read.value, int32: read.int32 };
+}
+
 /** `scr_arr_get_number`: a numeric element, or NaN for every missing,
  * hole, or present-undefined slot (answered by the runtime). */
 export function emitDenseArrayNumber(

packages/compiler/src/backend/llvm/emit-function.ts

@@ -338,6 +338,7 @@ export function emitFunction(emitter: LlEmitter, fn: IrFunction): string {
     }
     emitter.currentCoro = {
       kind: fn.generator !== undefined ? "generator" : "async",
+      awaits: fn.async === true,
       id,
       handle,
       self,
@@ -525,6 +526,7 @@ export function emitFunction(emitter: LlEmitter, fn: IrFunction): string {
     }
   }
   emitter.scopes.push(fnScope);
+  emitter.beginArenaFunction(fn);
   // Stackful native fibers and native coroutine frames retain these frames
   // while suspended. The active exception context owns the chain, so
   // concurrent fibers isolate it.
@@ -862,10 +864,14 @@ export function emitGenScaffolding(emitter: LlEmitter): string[] {
     ];
     const genNew = coroBody && !emitter.wasi ? "scr_gen_new_stackless" : "scr_gen_new";
     if (genNew !== "scr_gen_new") emitter.declare(`declare ptr @${genNew}(ptr, ptr, ptr)`);
+    const asyncGenNew =
+      coroBody && !emitter.wasi ? "scr_async_gen_new_stackless" : "scr_async_gen_new";
+    if (settleAsync !== null && asyncGenNew !== "scr_async_gen_new")
+      emitter.declare(`declare ptr @${asyncGenNew}(ptr, ptr, ptr, ptr)`);
     sp.push(
       settleAsync === null
         ? `  %gg = call ptr @${genNew}(ptr @${mangleTrampoline(fn.name)}, ptr %ap, ptr @${mangleGenDrop(fn.name)})`
-        : `  %gg = call ptr @scr_async_gen_new(ptr @${mangleTrampoline(fn.name)}, ptr %ap, ptr @${mangleGenDrop(fn.name)}, ptr @${settleAsync})`,
+        : `  %gg = call ptr @${asyncGenNew}(ptr @${mangleTrampoline(fn.name)}, ptr %ap, ptr @${mangleGenDrop(fn.name)}, ptr @${settleAsync})`,
       ...(fn.generator.tag !== undefined
         ? [`  call void @scr_gen_set_tag(ptr %gg, ptr ${emitter.cstr(fn.generator.tag)})`]
         : []),

packages/compiler/src/backend/llvm/emit-statements.ts

@@ -105,8 +105,11 @@ const MAX_CALLBACK_VERSION_COST = 400;
 export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
   const B = emitter.B;
   emitter.frames.push([]);
+  if (emitter.arenas !== null)
+    emitter.statementFrames.add(emitter.frames[emitter.frames.length - 1]!);
   switch (s.kind) {
     case "varDecl": {
+      emitter.ownArenasOf(s.localId);
       if (s.init && emitter.int32Locals.has(s.localId)) {
         emitter.storeInt32Local(s.localId, emitter.emitExpr(s.init), s.init);
         break;
@@ -1670,7 +1673,7 @@ export function emitStmtBody(emitter: LlEmitter, s: IrStmt): void {
         B.line(`call void @scr_async_gen_return_awaits()`);
       }
       if (emitter.currentAsyncGenerator && s.awaited !== true && emitter.finallyStack.length > 0) {
-        if (emitter.wasi) emitter.emitWasiSuspend(null);
+        if (emitter.coroAwait) emitter.emitCoroAwait(null);
         else {
           emitter.declare(`declare void @scr_await_hop()`);
           B.line(`call void @scr_await_hop()`);

packages/compiler/src/backend/llvm/emitter.ts

@@ -343,6 +343,15 @@ import {
   type LlClassMeta,
 } from "./classes.js";
 import { LifetimeRegions, REGION_TYPES } from "./regions.js";
+import {
+  arenaAware,
+  arenaCurrentAddress,
+  arenaNewSym,
+  arenasRequested,
+  planArenas,
+  type ArenaPlan,
+} from "./arenas.js";
+import { children, type Node } from "./region-ir.js";
 import { LlDyn, recordDynKeepsIdentity, type DynHost } from "./dyn.js";
 import { VirtualBorrows } from "./virtual-borrows.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
@@ -375,6 +384,7 @@ import {
   retainSym,
   traceArg,
   vAdapters,
+  traceAdapter,
 } from "./shapes.js";
 import type { ExprOf, LibCallExpr, LlStreamTypedRefAdapter, LlValue } from "./expr-context.js";
 import { INLINE_LITERAL_BYTES } from "./string-literal-equality.js";
@@ -421,6 +431,7 @@ import {
   fieldAliasMetadata,
   isStackUnionSource,
 } from "./receivers.js";
+import { findLoopCallees } from "./loop-callees.js";
 
 export { LlvmUnsupportedError } from "./unsupported.js";
 
@@ -465,6 +476,9 @@ export interface LlScopeEntry {
   slot: string;
   type: IrType;
   boxed?: boolean;
+  /** A group arena list slot (arenas.ts), dropped after the scope's other
+   * entries. */
+  arena?: boolean;
   /** A lazily created box: the slot stays null on paths that build no
    * environment, which skip the release call. */
   lazy?: boolean;
@@ -845,16 +859,23 @@ function isIdentifierByte(code: number): boolean {
 }
 
 /** Runtime entry points (and await-call entries) that may park the running
- * execution context, as they appear in emitted function text. */
+ * execution context, as they appear in emitted function text. An async
+ * generator's next, return and throw only queue a request and run its body
+ * to its next suspension, which returns to the caller, and the body's own
+ * bookkeeping calls do not suspend it. */
 export const SUSPENDS =
-  /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_|fiber_)|sc_a[wd]_)/;
+  /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_(?!new\b|next_|return_|throw\b|hop_done\b)|fiber_)|sc_a[wd]_)/;
 /** The suspensions of a fiber body's own awaits, which its stackless
  * coroutine form suspends itself at instead. */
-const AWAIT_SUSPENSIONS = /@(?:scr_await_(?:void|f64|bool|str|ref|hop)\b|sc_a[wd]_[A-Za-z0-9_]+)/g;
+const AWAIT_SUSPENSIONS =
+  /@(?:scr_await_(?:void|f64|bool|str|ref|hop|dyn_value)\b|sc_a[wd]_[A-Za-z0-9_]+)/g;
+/** The suspensions of a fiber generator body's own yields, which its
+ * coroutine form also suspends itself at. */
+const YIELD_SUSPENSIONS = /@scr_(?:gen_yield_(?:f64|bool|ref))\b/g;
 /** SUSPENDS in a stackless coroutine body, whose frame bookkeeping reads its
  * own fiber and promise. */
 const COROUTINE_SUSPENDS =
-  /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_|fiber_(?!self\b|promise\b))|sc_a[wd]_)/;
+  /@(?:scr_(?:await_|module_await\b|promise_await_settled\b|test_sub\b|gen_yield_|async_gen_(?!new\b|next_|return_|throw\b|hop_done\b)|fiber_(?!self\b|promise\b))|sc_a[wd]_)/;
 /** Captured bindings (boxes a body declares or receives) from which a
  * function compiles without LLVM optimization (see boxSlotCount). */
 export const UNOPTIMIZED_BOX_SLOTS = 512;
@@ -1276,11 +1297,13 @@ export class LlEmitter {
    * generator stacks) and so do debug builds (the debugger reads locals
    * from the native frame). */
   private stacklessGenerators = false;
-  /** Async bodies that suspend only at their own awaits compile to the same
-   * switched coroutines on native targets (selectStacklessAsync), under the
-   * generators' conditions; library and Windows builds keep fibers. */
+  /** Async bodies that suspend only at their own awaits (and an async
+   * generator's yields) compile to the same switched coroutines on native
+   * targets (selectStacklessAsync), under the generators' conditions;
+   * library and Windows builds keep fibers. */
   private stacklessAsyncAllowed = false;
-  /** The async functions selectStacklessAsync lowered as coroutines. */
+  /** The async functions and async generators selectStacklessAsync lowered
+   * as coroutines. */
   readonly stacklessAsync = new Set<string>();
   /** Some function in the module is lowered as a coroutine. */
   usesCoroutines = false;
@@ -1489,6 +1512,9 @@ export class LlEmitter {
   /** Functions that check the native stack guard on entry
    * (stackCheckedFunctions); null where the runtime has no guard. */
   readonly stackChecks: ReadonlySet<string> | null;
+  /** Small leaf functions called only from loops, whose direct calls are
+   * `alwaysinline` (loop-callees.ts). */
+  readonly loopCallees: ReadonlySet<string>;
   /** Static types whose values can be published (@scriptc/threads): their
    * stores carry the frozen-object guard. Null without publish calls. */
   readonly publishedTypes: PublishedTypes | null;
@@ -1903,9 +1929,12 @@ export class LlEmitter {
   currentUnionResult = false;
   /** Active only while emitting a body lowered with LLVM's
    * switched-coroutine intrinsics (wasm32 async bodies and generators,
-   * native synchronous generators; see coroLowered). */
+   * native synchronous generators, and the native async bodies
+   * selectStacklessAsync chose; see coroLowered). */
   currentCoro: {
     kind: "async" | "generator";
+    /** The body awaits: an async function or an async generator. */
+    awaits: boolean;
     id: string;
     handle: string;
     self: string;
@@ -2076,6 +2105,7 @@ export class LlEmitter {
         : new Set();
     this.workerEntryPolls = mt.workerEntryPolls ?? null;
     this.stackChecks = mt.stackChecks ?? null;
+    this.loopCallees = findLoopCallees(mod);
     // A stackless call's eager prefix borrows its caller's stack; the
     // runtime moves deep prefix nests to a fresh stack using the guard,
     // which Windows lacks.
@@ -2412,6 +2442,40 @@ export class LlEmitter {
       mod.lib === undefined &&
       options.lowRegion === true &&
       [...this.classMeta.values()].some((m) => m.compact);
+    // Group arenas: off with lifetime regions, which own their classes'
+    // allocation, and in libraries, whose exports any host code calls.
+    if (arenasRequested() && mod.lifetimeRegions !== true && mod.lib === undefined) {
+      this.arenas = planArenas(mod, {
+        shape: (id) => {
+          const shape = this.recordsById.get(id);
+          return (
+            shape !== undefined &&
+            shape.freezable !== true &&
+            shape.indexValue === undefined &&
+            this.publishedTypes?.recordGuarded(id) !== true
+          );
+        },
+        cls: (def) => {
+          const meta = this.classMeta.get(def.name);
+          return (
+            meta !== undefined &&
+            !meta.compact &&
+            !meta.threadSlot &&
+            // An Array subclass's instance is an array (the runtime's header).
+            def.arrayElem === undefined &&
+            meta.root.def.arrayElem === undefined &&
+            !this.programLifetime.has(def.name) &&
+            this.publishedTypes?.classGuarded(def.name) !== true
+          );
+        },
+        nullableArm: (unionId) => this.nullableUnions.single(unionId)?.arm ?? null,
+        traced: (t) => traceAdapter(this.shapeHost, t) !== null,
+      });
+      if (this.arenas !== null) {
+        this.shapeHost.arenaShapes = this.arenas.shapes;
+        this.shapeHost.arenaClasses = this.arenas.classes;
+      }
+    }
     for (const [name, rec] of RUNTIME_ERROR_CLASSES) {
       const meta = this.classMeta.get(name);
       if (!meta) break; // hand-written IR without the builtin defs: no stamps
@@ -2713,19 +2777,21 @@ export class LlEmitter {
     }
   }
 
-  /** Chooses the native async functions whose bodies compile to switched
-   * coroutines instead of running on a fiber: a suspended call then keeps a
-   * heap frame of the values live across its awaits rather than a fiber and
-   * its stack. A body qualifies when its only suspension points are its own
-   * awaits, which the coroutine form suspends itself at (emitCoroAwait), so
-   * nothing it runs can park the stack it borrows. It is first emitted as
-   * usual: that text may suspend only through await runtime calls and
-   * await-call entries, which the coroutine form replaces, and may call no
-   * function that parks. The coroutine form is then emitted and must pass
-   * the same test with no exceptions (its frame bookkeeping excepted);
-   * otherwise the fiber form stays. Bodies that never suspend stay
-   * fiberless, and module evaluation bodies and `dyn` results keep fibers
-   * as they do there. The runtime traps if a stackless body ever parks. */
+  /** Chooses the native async functions and async generators whose bodies
+   * compile to switched coroutines instead of running on a fiber: a
+   * suspended call then keeps a heap frame of the values live across its
+   * awaits and yields rather than a fiber and its stack. A body qualifies
+   * when its only suspension points are its own awaits and yields, which
+   * the coroutine form suspends itself at (emitCoroAwait,
+   * emitCoroSuspendPrepared), so nothing it runs can park the stack it
+   * borrows. It is first emitted as usual: that text may suspend only
+   * through await and yield runtime calls and await-call entries, which the
+   * coroutine form replaces, and may call no function that parks. The
+   * coroutine form is then emitted and must pass the same test with no
+   * exceptions (its frame bookkeeping excepted); otherwise the fiber form
+   * stays. Bodies that never suspend stay fiberless, and module evaluation
+   * bodies and async functions with `dyn` results keep fibers as they do
+   * there. The runtime traps if a stackless body ever parks. */
   selectStacklessAsync(fnDefs: string[]): void {
     if (!this.stacklessAsyncAllowed) return;
     const parks = this.parkingFunctions();
@@ -2740,11 +2806,16 @@ export class LlEmitter {
       return true;
     };
     this.mod.functions.forEach((fn, index) => {
-      if (fn.async !== true || fn.generator !== undefined) return;
+      if (fn.async !== true) return;
       if (fn.asyncCacheGlobal !== undefined || fn.asyncCycleCacheGlobal !== undefined) return;
-      if (fn.returnType.kind === "dyn" || !parks.has(fn.name)) return;
-      const fiberText = fnDefs[index]!;
-      if (!qualifies(fn, fiberText.replace(AWAIT_SUSPENSIONS, ""), SUSPENDS)) return;
+      // A dyn result may adopt a thenable when it settles the promise; an
+      // async generator's completion value settles its request's record.
+      if (fn.generator === undefined && fn.returnType.kind === "dyn") return;
+      if (!parks.has(fn.name)) return;
+      // An async generator's body also suspends at its own yields.
+      let fiberText = fnDefs[index]!.replace(AWAIT_SUSPENSIONS, "");
+      if (fn.generator !== undefined) fiberText = fiberText.replace(YIELD_SUSPENSIONS, "");
+      if (!qualifies(fn, fiberText, SUSPENDS)) return;
       this.stacklessAsync.add(fn.name);
       const coroText = this.emitFunction(fn);
       if (!qualifies(fn, coroText, COROUTINE_SUSPENDS)) {
@@ -3157,7 +3228,7 @@ export class LlEmitter {
    * native async bodies selectStacklessAsync chose. */
   coroLowered(fn: IrFunction): boolean {
     if (this.wasi) return fn.async === true || fn.generator !== undefined;
-    if (fn.async === true) return fn.generator === undefined && this.stacklessAsync.has(fn.name);
+    if (fn.async === true) return this.stacklessAsync.has(fn.name);
     return this.stacklessGenerators && fn.generator !== undefined;
   }
   emitGenScaffolding(): string[] {
@@ -3527,6 +3598,7 @@ export class LlEmitter {
   /** Releases a statement frame's temps and owned slots. */
   releaseTemps(frame: LlValue[]): void {
     for (const v of frame) {
+      if (v.arena !== undefined) continue;
       if (v.slot) {
         const t = this.B.tmp();
         this.B.line(`${t} = load ptr, ptr ${v.name}`);
@@ -3539,10 +3611,19 @@ export class LlEmitter {
         this.releaseFrame(v.name, v.type);
       }
     }
+    // Arena lists last: the frame's temps may be arena objects.
+    for (const v of frame)
+      if (v.arena === "drop") this.B.line(`call void @scr_arena_drop(ptr ${v.name})`);
+      else if (v.arena === "close") {
+        const head = this.B.tmp();
+        this.B.line(`${head} = load ptr, ptr ${v.name}`);
+        this.B.line(`call void @scr_arena_close(ptr ${head})`);
+      }
   }
 
   releaseScope(scope: LlScopeEntry[]): void {
     for (const e of scope) {
+      if (e.arena === true) continue;
       const t = this.B.tmp();
       this.B.line(`${t} = load ptr, ptr ${e.slot}`);
       if (e.boxed && e.lazy) {
@@ -3564,6 +3645,9 @@ export class LlEmitter {
         this.releaseFrame(t, e.type); // runtime releases are NULL-tolerant
       }
     }
+    // Arena lists last: the scope's bindings may hold arena objects.
+    for (const e of scope)
+      if (e.arena === true) this.B.line(`call void @scr_arena_drop(ptr ${e.slot})`);
   }
 
   /** THE release-on-jump path (break/continue/return): pending statement
@@ -3888,6 +3972,15 @@ export class LlEmitter {
    * calls (unwindAbiFunctions excludes their callees). */
   emitDirectCall(line: string, callee: string): boolean {
     const B = this.B;
+    // A small leaf called only from loops inlines into each of them, past
+    // LLVM's cost threshold (loop-callees.ts). Debug builds keep the call.
+    if (this.debug === null && this.loopCallees.has(callee)) {
+      const comment = line.indexOf(" ; ");
+      line =
+        comment < 0
+          ? `${line} alwaysinline`
+          : `${line.slice(0, comment)} alwaysinline${line.slice(comment)}`;
+    }
     if (!this.unwindAbi.has(callee) || this.currentCoro !== null || B.isTerminated()) {
       B.line(line);
       return false;
@@ -5228,7 +5321,7 @@ export class LlEmitter {
   /** Awaits in the current body suspend its coroutine: every wasm32 async
    * body, and native stackless async bodies (selectStacklessAsync). */
   get coroAwait(): boolean {
-    return this.wasi || this.currentCoro?.kind === "async";
+    return this.wasi || this.currentCoro?.awaits === true;
   }
 
   /** Suspends the current coroutine body at an await of `promise` (null: a
@@ -5267,7 +5360,7 @@ export class LlEmitter {
    * coroutine has already suspended until the promise settled, so its
    * extraction takes no further turn. */
   awaitResultFn(kind: "void" | "f64" | "bool" | "str" | "ref"): string {
-    return !this.wasi && this.currentCoro?.kind === "async"
+    return !this.wasi && this.currentCoro?.awaits === true
       ? `scr_coro_await_${kind}`
       : `scr_await_${kind}`;
   }
@@ -6335,6 +6428,7 @@ export class LlEmitter {
         type: local.type,
         slot: true,
         ...(local.boxed ? { boxed: true } : {}),
+        ...(local.arena === true ? { arena: "drop" as const } : {}),
       });
     }
     return result;
@@ -7429,9 +7523,196 @@ export class LlEmitter {
   }
 
   emitExpr(e: IrExpr): LlValue {
+    return this.arenas === null ? emitExpr(this, e) : this.emitArenaExpr(e, this.arenas);
+  }
+
+  /** emitExpr when group arenas are planned. Kept out of emitExpr, whose
+   * frame each level of a nested expression holds while it is emitted. */
+  private emitArenaExpr(e: IrExpr, arenas: ArenaPlan): LlValue {
+    if (arenas.groups.calls.has(e)) {
+      // A call region: everything the call allocates dies when it returns.
+      // The statement drops the arena after its temps, which an
+      // arena-aware caller can have allocated in it while evaluating the
+      // arguments; any other caller drops it as soon as the call returns.
+      const slot = this.arenaSlot(e);
+      this.statementFrame().push({ name: slot, type: e.type, slot: true, arena: "drop" });
+      this.B.line(`call ptr @scr_arena_open(ptr ${slot}, i32 ${this.arenaClosed(e)})`);
+      const value = emitExpr(this, e);
+      if (!arenaAware(arenas, this.fnByName.get(this.currentFunctionName)))
+        this.B.line(`call void @scr_arena_drop(ptr ${slot})`);
+      return value;
+    }
+    if (arenas.sites.heapCalls.has(e) && this.arenaSite(null)) {
+      // A call whose value the group does not keep: everything it allocates
+      // takes the heap.
+      const saved = this.suspendArena();
+      const value = emitExpr(this, e);
+      this.resumeArena(saved);
+      return value;
+    }
+    if (this.opensArena(e)) {
+      // A root: its group lives until the scope holding its value exits
+      // (the statement frame for a value used in place).
+      const slot = this.arenaSlot(e);
+      const local = arenas.groups.drops.get(e) ?? null;
+      this.statementFrame().push({
+        name: slot,
+        type: e.type,
+        slot: true,
+        arena: local === null ? "drop" : "close",
+      });
+      const arena = this.B.tmp();
+      this.B.line(`${arena} = call ptr @scr_arena_open(ptr ${slot}, i32 ${this.arenaClosed(e)})`);
+      const value = emitExpr(this, e);
+      this.B.line(`call void @scr_arena_close(ptr ${arena})`);
+      return value;
+    }
     return emitExpr(this, e);
   }
 
+  /** Group arenas (arenas.ts): the plan, the list slot of each root and
+   * call region, and which locals' scopes drop which roots' arenas. */
+  arenas: ArenaPlan | null = null;
+  private arenaSlots = new Map<Node, string>();
+  /** The frames emitStmtBody opens for whole statements (arenas only). */
+  readonly statementFrames = new Set<LlValue[]>();
+
+  /** The frame of the statement being emitted: a nested frame (call
+   * arguments, branches) ends before the values built in it do. */
+  statementFrame(): LlValue[] {
+    for (let i = this.frames.length - 1; i >= 0; i--)
+      if (this.statementFrames.has(this.frames[i]!)) return this.frames[i]!;
+    return this.currentFrame();
+  }
+
+  /** The arena list slot of root or call region `e`: allocated, cleared and
+   * (for a root dropped with a local) owned by that local's scope when the
+   * function starts or the local is declared. */
+  arenaSlot(e: Node): string {
+    let slot = this.arenaSlots.get(e);
+    if (slot === undefined) {
+      slot = this.B.tmp();
+      this.B.entryAllocas.push(`${slot} = alloca ptr`, `store ptr null, ptr ${slot}`);
+      this.arenaSlots.set(e, slot);
+      this.declare(`declare ptr @scr_arena_open(ptr, i32)`);
+      this.declare(`declare void @scr_arena_close(ptr)`);
+      this.declare(`declare void @scr_arena_drop(ptr)`);
+    }
+    return slot;
+  }
+
+  /** Whether emitExpr opens an arena for `e`: a root call or `new` of a
+   * counted value. */
+  opensArena(e: Node): e is Extract<IrExpr, { kind: "call" | "new" }> {
+    return (
+      this.arenas !== null &&
+      this.arenas.groups.roots.has(e) &&
+      (e.kind === "call" || e.kind === "new") &&
+      isRefCounted(e.type)
+    );
+  }
+
+  /** 1 when the group of root or call region `e` is closed: its objects
+   * hold only each other and immortal values. */
+  arenaClosed(e: Node): number {
+    return this.arenas?.groups.closed.has(e) === true ? 1 : 0;
+  }
+
+  /** Registers on the innermost scope the arena lists of the roots whose
+   * arenas `localId`'s scope drops. */
+  ownArenasOf(localId: string): void {
+    const roots = this.arenaDropsByLocal.get(localId);
+    if (roots === undefined) return;
+    const scope = this.scopes[this.scopes.length - 1]!;
+    for (const { root, type } of roots)
+      scope.push({ slot: this.arenaSlot(root), type, arena: true });
+  }
+
+  /** The roots of the function being emitted, by the local that drops
+   * them; set when a function's emission starts. */
+  arenaDropsByLocal = new Map<string, { root: Node; type: IrType }[]>();
+
+  /** Starts a function's arena bookkeeping: its roots by dropping local,
+   * with the lists of locals the body never declares (parameters, loop
+   * and catch bindings) owned by the function's own scope. */
+  beginArenaFunction(fn: IrFunction): void {
+    this.arenaSlots.clear();
+    this.statementFrames.clear();
+    this.arenaDropsByLocal = new Map();
+    const arenas = this.arenas;
+    if (arenas === null) return;
+    const declared = new Set<string>();
+    const visit = (node: Node): void => {
+      if (node.kind === "varDecl") declared.add(node.localId);
+      if (this.opensArena(node)) {
+        const local = arenas.groups.drops.get(node);
+        if (local !== undefined && local !== null) {
+          const list = this.arenaDropsByLocal.get(local) ?? [];
+          list.push({ root: node, type: node.type });
+          this.arenaDropsByLocal.set(local, list);
+        }
+      }
+      const kids: Node[] = [];
+      children(node, kids);
+      for (const kid of kids) visit(kid);
+    };
+    for (const s of fn.body) visit(s);
+    for (const local of [...this.arenaDropsByLocal.keys()])
+      if (!declared.has(local)) this.ownArenasOf(local);
+  }
+
+  /** Whether allocation site `e` (null: any) in the function being
+   * emitted takes the open arena: the function is arena-aware and the group
+   * keeps the site's value (region-sites.ts). */
+  arenaSite(e: IrExpr | null): boolean {
+    const arenas = this.arenas;
+    if (!arenaAware(arenas, this.fnByName.get(this.currentFunctionName))) return false;
+    return e === null || arenas!.sites.arenaSites.has(e);
+  }
+
+  /** Stops any arena being the allocation target; returns what restores it. */
+  suspendArena(): string {
+    const saved = this.B.tmp();
+    const cur = this.B.tmp();
+    const lines = arenaCurrentAddress(this.shapeHost, cur);
+    if (lines === null) {
+      this.declare(`declare ptr @scr_arena_suspend()`);
+      this.B.line(`${saved} = call ptr @scr_arena_suspend()`);
+    } else {
+      for (const line of lines) this.B.line(line);
+      this.B.line(`${saved} = load ptr, ptr ${cur}`);
+      this.B.line(`store ptr null, ptr ${cur}`);
+    }
+    return saved;
+  }
+
+  /** Makes the arena suspendArena stopped (`saved`) the target again. */
+  resumeArena(saved: string): void {
+    const cur = this.B.tmp();
+    const lines = arenaCurrentAddress(this.shapeHost, cur);
+    if (lines === null) {
+      this.declare(`declare void @scr_arena_resume(ptr)`);
+      this.B.line(`call void @scr_arena_resume(ptr ${saved})`);
+    } else {
+      for (const line of lines) this.B.line(line);
+      this.B.line(`store ptr ${saved}, ptr ${cur}`);
+    }
+  }
+
+  /** The arena-aware constructor of `newSym` for an allocation of a
+   * record shape or class in the function being emitted, or `newSym`. */
+  allocSym(newSym: string, e: IrExpr): string {
+    const arenas = this.arenas;
+    if (arenas === null) return newSym;
+    const planned =
+      e.type.kind === "record"
+        ? arenas.shapes.has(e.type.shapeId)
+        : e.kind === "new" && arenas.classes.has(e.className);
+    if (!planned) return newSym;
+    const aware = this.arenaSite(e) || arenas.groups.roots.has(e);
+    return aware ? arenaNewSym(newSym) : newSym;
+  }
+
   /** The helper classification of this module's inline-cache sites. */
   get jsIcSites(): JsIcSites {
     return (this.jsIcSitesMemo ??= new JsIcSites(this.mod));

packages/compiler/src/backend/llvm/expr-calls.ts

@@ -1104,7 +1104,7 @@ export function emitCallExpr(
           `llvm emitter bug: new ${e.className} without a constructor`,
         );
       const o = B.tmp();
-      B.line(`${o} = call ptr @${mangleClassNew(e.className)}()`);
+      B.line(`${o} = call ptr @${host.allocSym(mangleClassNew(e.className), e)}()`);
       const out = host.own({ name: o, type: e.type });
       emitConstruction(host, e, o, ctor);
       return out;

packages/compiler/src/backend/llvm/expr-containers.ts

@@ -62,12 +62,14 @@ import {
 import { exactInteger, widenInteger } from "./integer-values.js";
 import {
   emitDenseArrayNumber,
+  emitDenseArrayNumberInt32,
   emitDenseArrayPop,
   emitDenseArrayPush,
   runtimeAccess,
   type ArrayAccess,
 } from "./dense-array-access.js";
 import { INT32_ARRAY_METHODS } from "../../ir/int32-arrays.js";
+import { INT32_RANGE } from "../../ir/integer-ranges.js";
 import { emitUnionWiden } from "./expr-records.js";
 import { registerReplay } from "./emit-journal.js";
 
@@ -694,6 +696,25 @@ export function emitArrIntrinsic(
         )!;
         return { name: value, type: e.type };
       }
+      // In a store statement of an int32 kind loop's fast copy, a read that
+      // is not an int32 (a missing element's NaN) leaves for the
+      // statement's resume point, so the element is at hand as an i32.
+      if (!table && elem.kind === "f64" && access === "i32" && host.int32KindResume !== null) {
+        const read = emitDenseArrayNumberInt32(
+          host,
+          r.name,
+          index,
+          e.args[0],
+          host.provenDenseIndex(e.receiver, e.args[0]!),
+          host.int32KindResume,
+        );
+        return {
+          name: read.value,
+          type: e.type,
+          uint32: read.int32,
+          integer: { name: read.int32, type: "i32", signed: true, range: INT32_RANGE },
+        };
+      }
       if (!table && elem.kind === "f64")
         return {
           name: emitDenseArrayNumber(

packages/compiler/src/backend/llvm/expr-context.ts

@@ -33,6 +33,9 @@ export interface LlValue {
   slot?: boolean;
   /** A sequence local held in a capture box; release the box itself. */
   boxed?: boolean;
+  /** A group arena list slot (arenas.ts): the frame closes the newest
+   * arena on it, or drops the whole list, after its other temps. */
+  arena?: "close" | "drop";
 }
 
 export interface WideInteger {

packages/compiler/src/backend/llvm/expr-control.ts

@@ -11,6 +11,10 @@ import { emitRecordKeyGetOr } from "./expr-records.js";
 import { NULLABLE_NULL, SHAPE_WORD_INDEX, shapeWordHeader } from "./nullable-unions.js";
 import { emitUnionTag } from "./union-repr.js";
 
+/** Each kind emits in a function of its own: emitting a nested chain of
+ * these expressions holds one emitControlExpr frame per level, and in an
+ * unoptimized build of the compiler a frame holds every local of the
+ * function. */
 export function emitControlExpr(
   host: LlvmEmitterContext,
   e: ExprOf<
@@ -25,446 +29,25 @@ export function emitControlExpr(
     | "nullish"
   >,
 ): LlValue {
-  const B = host.B;
   switch (e.kind) {
-    case "dynDestrCheck": {
-      // RequireObjectCoercible with V8's destructuring TypeError. dyn
-      // values check in the runtime helper and pass through unchanged.
-      const v = host.emitExpr(e.value);
-      const first = e.firstProp !== undefined ? host.cstr(e.firstProp) : "null";
-
-      const helper = host.dyn.dynDestrCheckHelper();
-      B.line(`call void @${helper}(ptr ${v.name}, ptr ${host.cstr(e.spelling)}, ptr ${first})`);
-      host.emitPendingCheck();
-      return v;
-    }
-    case "dynIterN": {
-      // GetIterator + first-N steps as a fresh array (V8's exact
-      // not-iterable TypeError on non-iterables) through the native dyn helper.
-      const v = emitBorrowedInput(host, e.value);
-
-      const helper = host.dyn.dynIterNHelper();
-      const t = B.tmp();
-      B.line(
-        `${t} = call ptr @${helper}(ptr ${v.name}, ${host.sizeType} ${e.count}, ptr ${e.notIterableMessage ? host.cstr(e.notIterableMessage) : "null"})`,
-      );
-      const out = host.own({ name: t, type: e.type });
-      host.emitPendingCheck();
-      return out;
-    }
+    case "dynDestrCheck":
+      return emitDynDestrCheck(host, e);
+    case "dynIterN":
+      return emitDynIterN(host, e);
     case "toBool":
       return { name: host.truthy(host.emitUnionProjection(e.operand)), type: e.type };
-    case "logical": {
-      const tagSet = e.op === "||" ? unionTagSet(e) : null;
-      if (tagSet) return { name: emitUnionTagSet(host, tagSet), type: e.type };
-      // JS value semantics: the result is the deciding operand itself.
-      // Left evaluates once, ownership moves into the result slot; when
-      // the branch takes the right operand the stale left releases first
-      // and the right runs in its own frame.
-      const ty = host.llType(e.type);
-      const l = host.emitExpr(e.left);
-      host.toFrame(l);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ${ty}`);
-      B.line(`store ${ty} ${l.name}, ptr ${slot}`);
-      const integerSlot = e.type.kind === "f64" && l.uint32 !== undefined ? B.slot() : undefined;
-      if (integerSlot !== undefined) {
-        B.entryAllocas.push(`${integerSlot} = alloca i32`);
-        B.line(`store i32 ${l.uint32!}, ptr ${integerSlot}`);
-      }
-      const truthy = host.truthy(l);
-      const rightLabel = B.newLabel("log.r");
-      const joinLabel = B.newLabel("log.j");
-      if (e.op === "&&") B.condBr(truthy, rightLabel, joinLabel);
-      else B.condBr(truthy, joinLabel, rightLabel);
-      B.startBlock(rightLabel);
-      if (isRefCounted(e.type)) host.releaseFrame(l.name, e.type);
-      const rightInteger = host.emitBranchInto(slot, e.right, integerSlot);
-      B.br(joinLabel);
-      B.startBlock(joinLabel);
-      const t = B.tmp();
-      B.line(`${t} = load ${ty}, ptr ${slot}`);
-      if (integerSlot !== undefined && rightInteger) {
-        const uint32 = B.tmp();
-        B.line(`${uint32} = load i32, ptr ${integerSlot}`);
-        return { name: t, type: e.type, uint32 };
-      }
-      return host.own({ name: t, type: e.type });
-    }
-    case "ternary": {
-      // Exactly one arm evaluates; each arm runs in its own frame and
-      // moves the chosen value into the result slot.
-      const ty = host.llType(e.type);
-      const c = host.emitExpr(e.cond);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ${ty}`);
-      const integerSlot = e.type.kind === "f64" ? B.slot() : undefined;
-      if (integerSlot !== undefined) B.entryAllocas.push(`${integerSlot} = alloca i32`);
-      const lt = B.newLabel("tern.t");
-      const lf = B.newLabel("tern.f");
-      const lj = B.newLabel("tern.j");
-      B.condBr(c.name, lt, lf);
-      B.startBlock(lt);
-      const thenInteger = host.emitBranchInto(slot, e.then, integerSlot);
-      B.br(lj);
-      B.startBlock(lf);
-      const elseInteger = host.emitBranchInto(slot, e.else_, integerSlot);
-      B.br(lj);
-      B.startBlock(lj);
-      const t = B.tmp();
-      B.line(`${t} = load ${ty}, ptr ${slot}`);
-      // A view is available only when every incoming branch wrote it.
-      // Incomplete views are unused and disappear during promotion.
-      if (integerSlot !== undefined && thenInteger && elseInteger) {
-        const uint32 = B.tmp();
-        B.line(`${uint32} = load i32, ptr ${integerSlot}`);
-        return { name: t, type: e.type, uint32 };
-      }
-      // A choice between interned literals is an interned literal: like a
-      // strLit operand, nothing owns it (retain and release are no-ops).
-      if (literalChoice(e)) return host.markImmortal({ name: t, type: e.type });
-      return host.own({ name: t, type: e.type });
-    }
-    case "optChain": {
-      // `a?.b` / `f?.()`: the nullish test inverted. The receiver
-      // evaluates once into an ordinary frame temp (borrowed); on a unit
-      // tag the result is the interned undefined arm and the body never
-      // runs; otherwise the narrowed payload fills the bind slot (+1,
-      // frame-owned through a SLOT entry — NULL on the unit path, where
-      // the frame's release is a no-op) and the body reads it through
-      // chainRecv.
-      if (e.receiver.type.kind === "dyn") {
-        // A dyn (dyn) receiver — the `rawName?.match(re)` step: the
-        // nullish test reads the node's kind tag; the unit path is the
-        // undefined dyn singleton (dyn results) or nothing (void
-        // bodies), the body runs over the bound receiver otherwise.
-        const r = host.emitExpr(e.receiver);
-        const kd = host.dynKind(r.name);
-        const isU = B.tmp();
-        const isN = B.tmp();
-        const isUnit = B.tmp();
-        B.line(`${isU} = icmp eq i32 ${kd}, ${DYN_KIND.UNDEF}`);
-        B.line(`${isN} = icmp eq i32 ${kd}, ${DYN_KIND.NULL}`);
-        B.line(`${isUnit} = or i1 ${isU}, ${isN}`);
-        const bind = B.slot();
-        B.entryAllocas.push(`${bind} = alloca ptr`);
-        B.line(`store ptr null, ptr ${bind}`);
-        host.ownSlot(bind, e.receiver.type);
-        host.declare(`declare ptr @scr_dyn_retain_v(ptr)`);
-        if (e.type.kind === "void") {
-          const lb = B.newLabel("ocd.b");
-          const lj = B.newLabel("ocd.j");
-          B.condBr(isUnit, lj, lb);
-          B.startBlock(lb);
-          const rr = B.tmp();
-          B.line(`${rr} = call ptr @scr_dyn_retain_v(ptr ${r.name})`);
-          B.line(`store ptr ${rr}, ptr ${bind}`);
-          host.chainSlots.set(e.id, { name: bind, type: e.receiver.type, slot: true });
-          host.frames.push([]);
-          host.emitExpr(e.body);
-          host.releaseTemps(host.frames.pop()!);
-          host.chainSlots.delete(e.id);
-          B.br(lj);
-          B.startBlock(lj);
-          return { name: "", type: e.type };
-        }
-        if (e.type.kind !== "dyn")
-          throw new InternalCompilerError("llvm emitter bug: dyn optChain result kind");
-        const slot = B.slot();
-        B.entryAllocas.push(`${slot} = alloca ptr`);
-        const lu = B.newLabel("ocd.u");
-        const lb = B.newLabel("ocd.b");
-        const lj = B.newLabel("ocd.j");
-        B.condBr(isUnit, lu, lb);
-        B.startBlock(lu);
-        host.declare(`declare ptr @scr_dyn_undefined()`);
-        const un = B.tmp();
-        const ur = B.tmp();
-        B.line(`${un} = call ptr @scr_dyn_undefined()`);
-        B.line(`${ur} = call ptr @scr_dyn_retain_v(ptr ${un})`);
-        B.line(`store ptr ${ur}, ptr ${slot}`);
-        B.br(lj);
-        B.startBlock(lb);
-        const rr = B.tmp();
-        B.line(`${rr} = call ptr @scr_dyn_retain_v(ptr ${r.name})`);
-        B.line(`store ptr ${rr}, ptr ${bind}`);
-        host.chainSlots.set(e.id, { name: bind, type: e.receiver.type, slot: true });
-        host.emitBranchInto(slot, e.body);
-        host.chainSlots.delete(e.id);
-        B.br(lj);
-        B.startBlock(lj);
-        const t = B.tmp();
-        B.line(`${t} = load ptr, ptr ${slot}`);
-        return host.own({ name: t, type: e.type });
-      }
-
-      const { isUnit, bindPresent } = emitOptionalChainReceiver(host, e);
-      if (e.type.kind === "void") {
-        // Statement form (cb?.()): no result value at all.
-        const lb = B.newLabel("oc.b");
-        const lj = B.newLabel("oc.j");
-        B.condBr(isUnit, lj, lb);
-        B.startBlock(lb);
-        bindPresent();
-        host.frames.push([]);
-        host.emitExpr(e.body);
-        host.releaseTemps(host.frames.pop()!);
-        host.chainSlots.delete(e.id);
-        B.br(lj);
-        B.startBlock(lj);
-        return { name: "", type: e.type };
-      }
-      if (e.type.kind === "dyn") {
-        // A dyn-typed chain (`pricing?.[key]` over an unknown-valued
-        // index signature): the unit path is the undefined dyn value —
-        // dyn represents undefined directly, no union wrapper exists.
-        const slotD = B.slot();
-        B.entryAllocas.push(`${slotD} = alloca ptr`);
-        const lu = B.newLabel("ocu.u");
-        const lb = B.newLabel("ocu.b");
-        const lj = B.newLabel("ocu.j");
-        B.condBr(isUnit, lu, lb);
-        B.startBlock(lu);
-        host.declare(`declare ptr @scr_dyn_undefined()`);
-        host.declare(`declare ptr @scr_dyn_retain_v(ptr)`);
-        const un = B.tmp();
-        const ur = B.tmp();
-        B.line(`${un} = call ptr @scr_dyn_undefined()`);
-        B.line(`${ur} = call ptr @scr_dyn_retain_v(ptr ${un})`);
-        B.line(`store ptr ${ur}, ptr ${slotD}`);
-        B.br(lj);
-        B.startBlock(lb);
-        bindPresent();
-        host.emitBranchInto(slotD, e.body);
-        host.chainSlots.delete(e.id);
-        B.br(lj);
-        B.startBlock(lj);
-        const t = B.tmp();
-        B.line(`${t} = load ptr, ptr ${slotD}`);
-        return host.own({ name: t, type: e.type });
-      }
-      if (e.type.kind !== "union")
-        throw new LlvmUnsupportedError(`optChainResult:${e.type.kind}`, e.loc);
-      const undefTag = undefinedArmTag(e.type, host.unionsById);
-      if (undefTag < 0)
-        throw new InternalCompilerError(
-          "llvm emitter bug: optChain result lacks its undefined arm",
-        );
-      const ty = host.llType(e.type);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ${ty}`);
-      const lu = B.newLabel("oc.u");
-      const lb = B.newLabel("oc.b");
-      const lj = B.newLabel("oc.j");
-      B.condBr(isUnit, lu, lb);
-      B.startBlock(lu);
-      B.line(`store ptr ${host.unitInstanceRef(e.type.unionId, undefTag)}, ptr ${slot}`);
-      B.br(lj);
-      B.startBlock(lb);
-      bindPresent();
-      host.emitBranchInto(slot, e.body);
-      host.chainSlots.delete(e.id);
-      B.br(lj);
-      B.startBlock(lj);
-      const t = B.tmp();
-      B.line(`${t} = load ${ty}, ptr ${slot}`);
-      return host.own({ name: t, type: e.type });
-    }
-    case "chainRecv": {
-      const bound = host.chainSlots.get(e.id);
-      if (!bound)
-        throw new InternalCompilerError(`llvm emitter bug: chainRecv "${e.id}" outside its chain`);
-      const v = B.tmp();
-      B.line(`${v} = load ${host.llType(bound.type)}, ptr ${bound.name}`);
-      if (!isRefCounted(e.type)) return { name: v, type: e.type };
-      return host.own({ name: host.retainFrame(v, e.type), type: e.type });
-    }
-    case "orDefault": {
-      // `u || d` narrowed to the single non-unit arm: nullish's dance
-      // with the union TRUTHY switch as the test — truthy extracts the
-      // arm (+1 for ref kinds), falsy releases and runs the default.
-      if (e.left.type.kind !== "union")
-        throw new InternalCompilerError("llvm emitter bug: orDefault left is not a union");
-      if (
-        e.retag === undefined &&
-        !host.nullableUnions.has(e.left.type.unionId) &&
-        host.isStackUnionSource(e.left)
-      ) {
-        // A stack box (`arr[i] || d`): test truthiness and extract the
-        // payload (+1). The box is never retained or released.
-        const l = host.emitUnionProjection(e.left);
-        const ty = host.llType(e.type);
-        const slot = B.slot();
-        B.entryAllocas.push(`${slot} = alloca ${ty}`);
-        const lt = B.newLabel("ord.t"),
-          lf = B.newLabel("ord.f"),
-          lj = B.newLabel("ord.j");
-        B.condBr(host.truthy(l), lt, lf);
-        B.startBlock(lt);
-        B.line(
-          `store ${ty} ${host.unionExtract(l.name, e.left.type.unionId, e.type)}, ptr ${slot}`,
-        );
-        B.br(lj);
-        B.startBlock(lf);
-        host.emitBranchInto(slot, e.right);
-        B.br(lj);
-        B.startBlock(lj);
-        const t = B.tmp();
-        B.line(`${t} = load ${ty}, ptr ${slot}`);
-        return host.own({ name: t, type: e.type });
-      }
-      const l = host.emitExpr(e.left);
-      host.toFrame(l);
-      const ty = host.llType(e.type);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ${ty}`);
-      const truthy = host.truthy(l);
-      const lt = B.newLabel("ord.t");
-      const lf = B.newLabel("ord.f");
-      const lj = B.newLabel("ord.j");
-      B.condBr(truthy, lt, lf);
-      B.startBlock(lt);
-      if (e.retag !== undefined) {
-        // Retagged shape: the whole box goes to the union→union helper,
-        // which CONSUMES it (callees own their params) — no release on
-        // this side. The store precedes the pending check so an unwind
-        // leaves only the NULL dummy behind, in a slot nothing reads.
-        const t = B.tmp();
-        B.line(
-          `${t} = call ${ty} @${host.callTarget(e.retag)}(${host.llType(e.left.type)} ${l.name})`,
-        );
-        B.line(`store ${ty} ${t}, ptr ${slot}`);
-        if (host.mayThrow.has(e.retag)) host.emitPendingCheck();
-      } else if (host.nullableUnions.single(e.left.type.unionId)) {
-        // The owned nullable pointer IS the owned arm value.
-        B.line(`store ${ty} ${l.name}, ptr ${slot}`);
-      } else {
-        B.line(
-          `store ${ty} ${host.unionExtract(l.name, e.left.type.unionId, e.type)}, ptr ${slot}`,
-        );
-        host.releaseFrame(l.name, e.left.type);
-      }
-      B.br(lj);
-      B.startBlock(lf);
-      host.releaseFrame(l.name, e.left.type);
-      host.emitBranchInto(slot, e.right);
-      B.br(lj);
-      B.startBlock(lj);
-      const t = B.tmp();
-      B.line(`${t} = load ${ty}, ptr ${slot}`);
-      return host.own({ name: t, type: e.type });
-    }
-    case "nullish": {
-      // `a ?? b`: logical's move/release dance with the left's runtime
-      // TAG against its unit arms as the test. Pass-through shape: the
-      // result IS the left box. Narrowed shape: the single non-unit
-      // arm's payload extracts (+1 for ref kinds) and the box releases.
-
-      if (e.left.type.kind === "dyn") {
-        // The native checked-value kind decides whether the left is
-        // nullish; the right runs lazily in its branch.
-        const l = host.emitExpr(e.left);
-        host.toFrame(l);
-        host.declare(`declare zeroext i1 @scr_dyn_is_nullish(ptr)`);
-        const slot = B.slot();
-        B.entryAllocas.push(`${slot} = alloca ptr`);
-        const isN = B.tmp();
-        B.line(`${isN} = call zeroext i1 @scr_dyn_is_nullish(ptr ${l.name})`);
-        const lu = B.newLabel("nuld.u");
-        const lv = B.newLabel("nuld.v");
-        const lj = B.newLabel("nuld.j");
-        B.condBr(isN, lu, lv);
-        B.startBlock(lu);
-        host.releaseFrame(l.name, e.left.type);
-        host.emitBranchInto(slot, e.right);
-        B.br(lj);
-        B.startBlock(lv);
-        B.line(`store ptr ${l.name}, ptr ${slot}`);
-        B.br(lj);
-        B.startBlock(lj);
-        const t = B.tmp();
-        B.line(`${t} = load ptr, ptr ${slot}`);
-        return host.own({ name: t, type: e.type });
-      }
-      if (e.left.type.kind !== "union")
-        throw new InternalCompilerError("llvm emitter bug: nullish left is not a union");
-      const def = host.unionsById.get(e.left.type.unionId);
-      if (!def)
-        throw new InternalCompilerError(
-          `llvm emitter bug: nullish of unknown union ${e.left.type.unionId}`,
-        );
-      const unitTags = def.arms.flatMap((a, i) => (isUnitType(a) ? [i] : []));
-      if (unitTags.length === 0)
-        throw new InternalCompilerError("llvm emitter bug: nullish union lacks unit arms");
-      const fused = emitNullishOptionalChain(host, e);
-      if (fused) return fused;
-      if (
-        e.left.kind === "recordKeyGet" &&
-        e.left.missNaN !== true &&
-        typeEquals(e.type, e.left.type) &&
-        storesNoUnit(host, e.left)
-      )
-        return emitRecordKeyGetOr(host, e.left, e.right);
-      if (
-        !typeEquals(e.type, e.left.type) &&
-        (e.left.kind === "varRef" ||
-          host.isStackUnionSource(e.left) ||
-          host.nullableFieldGet(e.left) !== null)
-      ) {
-        // Narrowed shape over a binding or a stack box (`arr[i] ?? d`,
-        // `map.get(k) ?? d`): test the tag and extract the payload (+1).
-        // The box is never retained or released. A binding is borrowed:
-        // no code runs between its read and the extraction, and the
-        // default never touches it. Bindings proven projection-only may
-        // hold stack boxes, which must never reach RC entry points.
-        const l = host.emitUnionProjection(e.left);
-        const ty = host.llType(e.type);
-        const slot = B.slot();
-        B.entryAllocas.push(`${slot} = alloca ${ty}`);
-        const isUnit = host.tagInSet(l.name, def.id, unitTags);
-        const lu = B.newLabel("nul.u");
-        const lv = B.newLabel("nul.v");
-        const lj = B.newLabel("nul.j");
-        B.condBr(isUnit, lu, lv);
-        B.startBlock(lu);
-        host.emitBranchInto(slot, e.right);
-        B.br(lj);
-        B.startBlock(lv);
-        B.line(`store ${ty} ${host.unionExtract(l.name, def.id, e.type)}, ptr ${slot}`);
-        B.br(lj);
-        B.startBlock(lj);
-        const t = B.tmp();
-        B.line(`${t} = load ${ty}, ptr ${slot}`);
-        return host.own({ name: t, type: e.type });
-      }
-      const l = host.emitExpr(e.left);
-      host.toFrame(l);
-      const ty = host.llType(e.type);
-      const slot = B.slot();
-      B.entryAllocas.push(`${slot} = alloca ${ty}`);
-      const isUnit = host.tagInSet(l.name, def.id, unitTags);
-      const lu = B.newLabel("nul.u");
-      const lv = B.newLabel("nul.v");
-      const lj = B.newLabel("nul.j");
-      B.condBr(isUnit, lu, lv);
-      B.startBlock(lu);
-      host.releaseFrame(l.name, e.left.type);
-      host.emitBranchInto(slot, e.right);
-      B.br(lj);
-      B.startBlock(lv);
-      if (typeEquals(e.type, e.left.type) || host.nullableUnions.single(def.id)) {
-        // Pass-through, or a nullable pointer that IS its owned arm value.
-        B.line(`store ${ty} ${l.name}, ptr ${slot}`);
-      } else {
-        B.line(`store ${ty} ${host.unionExtract(l.name, def.id, e.type)}, ptr ${slot}`);
-        host.releaseFrame(l.name, e.left.type);
-      }
-      B.br(lj);
-      B.startBlock(lj);
-      const t = B.tmp();
-      B.line(`${t} = load ${ty}, ptr ${slot}`);
-      return host.own({ name: t, type: e.type });
-    }
+    case "logical":
+      return emitLogical(host, e);
+    case "ternary":
+      return emitTernary(host, e);
+    case "optChain":
+      return emitOptChain(host, e);
+    case "chainRecv":
+      return emitChainRecv(host, e);
+    case "orDefault":
+      return emitOrDefault(host, e);
+    case "nullish":
+      return emitNullish(host, e);
     default: {
       const _exhaustive: never = e;
       void _exhaustive;
@@ -473,6 +56,450 @@ export function emitControlExpr(
   }
 }
 
+function emitDynDestrCheck(host: LlvmEmitterContext, e: ExprOf<"dynDestrCheck">): LlValue {
+  const B = host.B;
+  // RequireObjectCoercible with V8's destructuring TypeError. dyn
+  // values check in the runtime helper and pass through unchanged.
+  const v = host.emitExpr(e.value);
+  const first = e.firstProp !== undefined ? host.cstr(e.firstProp) : "null";
+
+  const helper = host.dyn.dynDestrCheckHelper();
+  B.line(`call void @${helper}(ptr ${v.name}, ptr ${host.cstr(e.spelling)}, ptr ${first})`);
+  host.emitPendingCheck();
+  return v;
+}
+
+function emitDynIterN(host: LlvmEmitterContext, e: ExprOf<"dynIterN">): LlValue {
+  const B = host.B;
+  // GetIterator + first-N steps as a fresh array (V8's exact
+  // not-iterable TypeError on non-iterables) through the native dyn helper.
+  const v = emitBorrowedInput(host, e.value);
+
+  const helper = host.dyn.dynIterNHelper();
+  const t = B.tmp();
+  B.line(
+    `${t} = call ptr @${helper}(ptr ${v.name}, ${host.sizeType} ${e.count}, ptr ${e.notIterableMessage ? host.cstr(e.notIterableMessage) : "null"})`,
+  );
+  const out = host.own({ name: t, type: e.type });
+  host.emitPendingCheck();
+  return out;
+}
+
+function emitLogical(host: LlvmEmitterContext, e: ExprOf<"logical">): LlValue {
+  const B = host.B;
+  const tagSet = e.op === "||" ? unionTagSet(e) : null;
+  if (tagSet) return { name: emitUnionTagSet(host, tagSet), type: e.type };
+  // JS value semantics: the result is the deciding operand itself.
+  // Left evaluates once, ownership moves into the result slot; when
+  // the branch takes the right operand the stale left releases first
+  // and the right runs in its own frame.
+  const ty = host.llType(e.type);
+  const l = host.emitExpr(e.left);
+  host.toFrame(l);
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  B.line(`store ${ty} ${l.name}, ptr ${slot}`);
+  const integerSlot = e.type.kind === "f64" && l.uint32 !== undefined ? B.slot() : undefined;
+  if (integerSlot !== undefined) {
+    B.entryAllocas.push(`${integerSlot} = alloca i32`);
+    B.line(`store i32 ${l.uint32!}, ptr ${integerSlot}`);
+  }
+  const truthy = host.truthy(l);
+  const rightLabel = B.newLabel("log.r");
+  const joinLabel = B.newLabel("log.j");
+  if (e.op === "&&") B.condBr(truthy, rightLabel, joinLabel);
+  else B.condBr(truthy, joinLabel, rightLabel);
+  B.startBlock(rightLabel);
+  if (isRefCounted(e.type)) host.releaseFrame(l.name, e.type);
+  const rightInteger = host.emitBranchInto(slot, e.right, integerSlot);
+  B.br(joinLabel);
+  B.startBlock(joinLabel);
+  const t = B.tmp();
+  B.line(`${t} = load ${ty}, ptr ${slot}`);
+  if (integerSlot !== undefined && rightInteger) {
+    const uint32 = B.tmp();
+    B.line(`${uint32} = load i32, ptr ${integerSlot}`);
+    return { name: t, type: e.type, uint32 };
+  }
+  return host.own({ name: t, type: e.type });
+}
+
+function emitTernary(host: LlvmEmitterContext, e: ExprOf<"ternary">): LlValue {
+  const B = host.B;
+  // Exactly one arm evaluates; each arm runs in its own frame and
+  // moves the chosen value into the result slot.
+  const ty = host.llType(e.type);
+  const c = host.emitExpr(e.cond);
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  const integerSlot = e.type.kind === "f64" ? B.slot() : undefined;
+  if (integerSlot !== undefined) B.entryAllocas.push(`${integerSlot} = alloca i32`);
+  const lt = B.newLabel("tern.t");
+  const lf = B.newLabel("tern.f");
+  const lj = B.newLabel("tern.j");
+  B.condBr(c.name, lt, lf);
+  B.startBlock(lt);
+  const thenInteger = host.emitBranchInto(slot, e.then, integerSlot);
+  B.br(lj);
+  B.startBlock(lf);
+  const elseInteger = host.emitBranchInto(slot, e.else_, integerSlot);
+  B.br(lj);
+  B.startBlock(lj);
+  const t = B.tmp();
+  B.line(`${t} = load ${ty}, ptr ${slot}`);
+  // A view is available only when every incoming branch wrote it.
+  // Incomplete views are unused and disappear during promotion.
+  if (integerSlot !== undefined && thenInteger && elseInteger) {
+    const uint32 = B.tmp();
+    B.line(`${uint32} = load i32, ptr ${integerSlot}`);
+    return { name: t, type: e.type, uint32 };
+  }
+  // A choice between interned literals is an interned literal: like a
+  // strLit operand, nothing owns it (retain and release are no-ops).
+  if (literalChoice(e)) return host.markImmortal({ name: t, type: e.type });
+  return host.own({ name: t, type: e.type });
+}
+
+function emitOptChain(host: LlvmEmitterContext, e: ExprOf<"optChain">): LlValue {
+  const B = host.B;
+  // `a?.b` / `f?.()`: the nullish test inverted. The receiver
+  // evaluates once into an ordinary frame temp (borrowed); on a unit
+  // tag the result is the interned undefined arm and the body never
+  // runs; otherwise the narrowed payload fills the bind slot (+1,
+  // frame-owned through a SLOT entry — NULL on the unit path, where
+  // the frame's release is a no-op) and the body reads it through
+  // chainRecv.
+  if (e.receiver.type.kind === "dyn") {
+    // A dyn (dyn) receiver — the `rawName?.match(re)` step: the
+    // nullish test reads the node's kind tag; the unit path is the
+    // undefined dyn singleton (dyn results) or nothing (void
+    // bodies), the body runs over the bound receiver otherwise.
+    const r = host.emitExpr(e.receiver);
+    const kd = host.dynKind(r.name);
+    const isU = B.tmp();
+    const isN = B.tmp();
+    const isUnit = B.tmp();
+    B.line(`${isU} = icmp eq i32 ${kd}, ${DYN_KIND.UNDEF}`);
+    B.line(`${isN} = icmp eq i32 ${kd}, ${DYN_KIND.NULL}`);
+    B.line(`${isUnit} = or i1 ${isU}, ${isN}`);
+    const bind = B.slot();
+    B.entryAllocas.push(`${bind} = alloca ptr`);
+    B.line(`store ptr null, ptr ${bind}`);
+    host.ownSlot(bind, e.receiver.type);
+    host.declare(`declare ptr @scr_dyn_retain_v(ptr)`);
+    if (e.type.kind === "void") {
+      const lb = B.newLabel("ocd.b");
+      const lj = B.newLabel("ocd.j");
+      B.condBr(isUnit, lj, lb);
+      B.startBlock(lb);
+      const rr = B.tmp();
+      B.line(`${rr} = call ptr @scr_dyn_retain_v(ptr ${r.name})`);
+      B.line(`store ptr ${rr}, ptr ${bind}`);
+      host.chainSlots.set(e.id, { name: bind, type: e.receiver.type, slot: true });
+      host.frames.push([]);
+      host.emitExpr(e.body);
+      host.releaseTemps(host.frames.pop()!);
+      host.chainSlots.delete(e.id);
+      B.br(lj);
+      B.startBlock(lj);
+      return { name: "", type: e.type };
+    }
+    if (e.type.kind !== "dyn")
+      throw new InternalCompilerError("llvm emitter bug: dyn optChain result kind");
+    const slot = B.slot();
+    B.entryAllocas.push(`${slot} = alloca ptr`);
+    const lu = B.newLabel("ocd.u");
+    const lb = B.newLabel("ocd.b");
+    const lj = B.newLabel("ocd.j");
+    B.condBr(isUnit, lu, lb);
+    B.startBlock(lu);
+    host.declare(`declare ptr @scr_dyn_undefined()`);
+    const un = B.tmp();
+    const ur = B.tmp();
+    B.line(`${un} = call ptr @scr_dyn_undefined()`);
+    B.line(`${ur} = call ptr @scr_dyn_retain_v(ptr ${un})`);
+    B.line(`store ptr ${ur}, ptr ${slot}`);
+    B.br(lj);
+    B.startBlock(lb);
+    const rr = B.tmp();
+    B.line(`${rr} = call ptr @scr_dyn_retain_v(ptr ${r.name})`);
+    B.line(`store ptr ${rr}, ptr ${bind}`);
+    host.chainSlots.set(e.id, { name: bind, type: e.receiver.type, slot: true });
+    host.emitBranchInto(slot, e.body);
+    host.chainSlots.delete(e.id);
+    B.br(lj);
+    B.startBlock(lj);
+    const t = B.tmp();
+    B.line(`${t} = load ptr, ptr ${slot}`);
+    return host.own({ name: t, type: e.type });
+  }
+
+  const { isUnit, bindPresent } = emitOptionalChainReceiver(host, e);
+  if (e.type.kind === "void") {
+    // Statement form (cb?.()): no result value at all.
+    const lb = B.newLabel("oc.b");
+    const lj = B.newLabel("oc.j");
+    B.condBr(isUnit, lj, lb);
+    B.startBlock(lb);
+    bindPresent();
+    host.frames.push([]);
+    host.emitExpr(e.body);
+    host.releaseTemps(host.frames.pop()!);
+    host.chainSlots.delete(e.id);
+    B.br(lj);
+    B.startBlock(lj);
+    return { name: "", type: e.type };
+  }
+  if (e.type.kind === "dyn") {
+    // A dyn-typed chain (`pricing?.[key]` over an unknown-valued
+    // index signature): the unit path is the undefined dyn value —
+    // dyn represents undefined directly, no union wrapper exists.
+    const slotD = B.slot();
+    B.entryAllocas.push(`${slotD} = alloca ptr`);
+    const lu = B.newLabel("ocu.u");
+    const lb = B.newLabel("ocu.b");
+    const lj = B.newLabel("ocu.j");
+    B.condBr(isUnit, lu, lb);
+    B.startBlock(lu);
+    host.declare(`declare ptr @scr_dyn_undefined()`);
+    host.declare(`declare ptr @scr_dyn_retain_v(ptr)`);
+    const un = B.tmp();
+    const ur = B.tmp();
+    B.line(`${un} = call ptr @scr_dyn_undefined()`);
+    B.line(`${ur} = call ptr @scr_dyn_retain_v(ptr ${un})`);
+    B.line(`store ptr ${ur}, ptr ${slotD}`);
+    B.br(lj);
+    B.startBlock(lb);
+    bindPresent();
+    host.emitBranchInto(slotD, e.body);
+    host.chainSlots.delete(e.id);
+    B.br(lj);
+    B.startBlock(lj);
+    const t = B.tmp();
+    B.line(`${t} = load ptr, ptr ${slotD}`);
+    return host.own({ name: t, type: e.type });
+  }
+  if (e.type.kind !== "union")
+    throw new LlvmUnsupportedError(`optChainResult:${e.type.kind}`, e.loc);
+  const undefTag = undefinedArmTag(e.type, host.unionsById);
+  if (undefTag < 0)
+    throw new InternalCompilerError("llvm emitter bug: optChain result lacks its undefined arm");
+  const ty = host.llType(e.type);
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  const lu = B.newLabel("oc.u");
+  const lb = B.newLabel("oc.b");
+  const lj = B.newLabel("oc.j");
+  B.condBr(isUnit, lu, lb);
+  B.startBlock(lu);
+  B.line(`store ptr ${host.unitInstanceRef(e.type.unionId, undefTag)}, ptr ${slot}`);
+  B.br(lj);
+  B.startBlock(lb);
+  bindPresent();
+  host.emitBranchInto(slot, e.body);
+  host.chainSlots.delete(e.id);
+  B.br(lj);
+  B.startBlock(lj);
+  const t = B.tmp();
+  B.line(`${t} = load ${ty}, ptr ${slot}`);
+  return host.own({ name: t, type: e.type });
+}
+
+function emitChainRecv(host: LlvmEmitterContext, e: ExprOf<"chainRecv">): LlValue {
+  const B = host.B;
+  const bound = host.chainSlots.get(e.id);
+  if (!bound)
+    throw new InternalCompilerError(`llvm emitter bug: chainRecv "${e.id}" outside its chain`);
+  const v = B.tmp();
+  B.line(`${v} = load ${host.llType(bound.type)}, ptr ${bound.name}`);
+  if (!isRefCounted(e.type)) return { name: v, type: e.type };
+  return host.own({ name: host.retainFrame(v, e.type), type: e.type });
+}
+
+function emitOrDefault(host: LlvmEmitterContext, e: ExprOf<"orDefault">): LlValue {
+  const B = host.B;
+  // `u || d` narrowed to the single non-unit arm: nullish's dance
+  // with the union TRUTHY switch as the test — truthy extracts the
+  // arm (+1 for ref kinds), falsy releases and runs the default.
+  if (e.left.type.kind !== "union")
+    throw new InternalCompilerError("llvm emitter bug: orDefault left is not a union");
+  if (
+    e.retag === undefined &&
+    !host.nullableUnions.has(e.left.type.unionId) &&
+    host.isStackUnionSource(e.left)
+  ) {
+    // A stack box (`arr[i] || d`): test truthiness and extract the
+    // payload (+1). The box is never retained or released.
+    const l = host.emitUnionProjection(e.left);
+    const ty = host.llType(e.type);
+    const slot = B.slot();
+    B.entryAllocas.push(`${slot} = alloca ${ty}`);
+    const lt = B.newLabel("ord.t"),
+      lf = B.newLabel("ord.f"),
+      lj = B.newLabel("ord.j");
+    B.condBr(host.truthy(l), lt, lf);
+    B.startBlock(lt);
+    B.line(`store ${ty} ${host.unionExtract(l.name, e.left.type.unionId, e.type)}, ptr ${slot}`);
+    B.br(lj);
+    B.startBlock(lf);
+    host.emitBranchInto(slot, e.right);
+    B.br(lj);
+    B.startBlock(lj);
+    const t = B.tmp();
+    B.line(`${t} = load ${ty}, ptr ${slot}`);
+    return host.own({ name: t, type: e.type });
+  }
+  const l = host.emitExpr(e.left);
+  host.toFrame(l);
+  const ty = host.llType(e.type);
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  const truthy = host.truthy(l);
+  const lt = B.newLabel("ord.t");
+  const lf = B.newLabel("ord.f");
+  const lj = B.newLabel("ord.j");
+  B.condBr(truthy, lt, lf);
+  B.startBlock(lt);
+  if (e.retag !== undefined) {
+    // Retagged shape: the whole box goes to the union→union helper,
+    // which CONSUMES it (callees own their params) — no release on
+    // this side. The store precedes the pending check so an unwind
+    // leaves only the NULL dummy behind, in a slot nothing reads.
+    const t = B.tmp();
+    B.line(`${t} = call ${ty} @${host.callTarget(e.retag)}(${host.llType(e.left.type)} ${l.name})`);
+    B.line(`store ${ty} ${t}, ptr ${slot}`);
+    if (host.mayThrow.has(e.retag)) host.emitPendingCheck();
+  } else if (host.nullableUnions.single(e.left.type.unionId)) {
+    // The owned nullable pointer IS the owned arm value.
+    B.line(`store ${ty} ${l.name}, ptr ${slot}`);
+  } else {
+    B.line(`store ${ty} ${host.unionExtract(l.name, e.left.type.unionId, e.type)}, ptr ${slot}`);
+    host.releaseFrame(l.name, e.left.type);
+  }
+  B.br(lj);
+  B.startBlock(lf);
+  host.releaseFrame(l.name, e.left.type);
+  host.emitBranchInto(slot, e.right);
+  B.br(lj);
+  B.startBlock(lj);
+  const t = B.tmp();
+  B.line(`${t} = load ${ty}, ptr ${slot}`);
+  return host.own({ name: t, type: e.type });
+}
+
+function emitNullish(host: LlvmEmitterContext, e: ExprOf<"nullish">): LlValue {
+  const B = host.B;
+  // `a ?? b`: logical's move/release dance with the left's runtime
+  // TAG against its unit arms as the test. Pass-through shape: the
+  // result IS the left box. Narrowed shape: the single non-unit
+  // arm's payload extracts (+1 for ref kinds) and the box releases.
+
+  if (e.left.type.kind === "dyn") {
+    // The native checked-value kind decides whether the left is
+    // nullish; the right runs lazily in its branch.
+    const l = host.emitExpr(e.left);
+    host.toFrame(l);
+    host.declare(`declare zeroext i1 @scr_dyn_is_nullish(ptr)`);
+    const slot = B.slot();
+    B.entryAllocas.push(`${slot} = alloca ptr`);
+    const isN = B.tmp();
+    B.line(`${isN} = call zeroext i1 @scr_dyn_is_nullish(ptr ${l.name})`);
+    const lu = B.newLabel("nuld.u");
+    const lv = B.newLabel("nuld.v");
+    const lj = B.newLabel("nuld.j");
+    B.condBr(isN, lu, lv);
+    B.startBlock(lu);
+    host.releaseFrame(l.name, e.left.type);
+    host.emitBranchInto(slot, e.right);
+    B.br(lj);
+    B.startBlock(lv);
+    B.line(`store ptr ${l.name}, ptr ${slot}`);
+    B.br(lj);
+    B.startBlock(lj);
+    const t = B.tmp();
+    B.line(`${t} = load ptr, ptr ${slot}`);
+    return host.own({ name: t, type: e.type });
+  }
+  if (e.left.type.kind !== "union")
+    throw new InternalCompilerError("llvm emitter bug: nullish left is not a union");
+  const def = host.unionsById.get(e.left.type.unionId);
+  if (!def)
+    throw new InternalCompilerError(
+      `llvm emitter bug: nullish of unknown union ${e.left.type.unionId}`,
+    );
+  const unitTags = def.arms.flatMap((a, i) => (isUnitType(a) ? [i] : []));
+  if (unitTags.length === 0)
+    throw new InternalCompilerError("llvm emitter bug: nullish union lacks unit arms");
+  const fused = emitNullishOptionalChain(host, e);
+  if (fused) return fused;
+  if (
+    e.left.kind === "recordKeyGet" &&
+    e.left.missNaN !== true &&
+    typeEquals(e.type, e.left.type) &&
+    storesNoUnit(host, e.left)
+  )
+    return emitRecordKeyGetOr(host, e.left, e.right);
+  if (
+    !typeEquals(e.type, e.left.type) &&
+    (e.left.kind === "varRef" ||
+      host.isStackUnionSource(e.left) ||
+      host.nullableFieldGet(e.left) !== null)
+  ) {
+    // Narrowed shape over a binding or a stack box (`arr[i] ?? d`,
+    // `map.get(k) ?? d`): test the tag and extract the payload (+1).
+    // The box is never retained or released. A binding is borrowed:
+    // no code runs between its read and the extraction, and the
+    // default never touches it. Bindings proven projection-only may
+    // hold stack boxes, which must never reach RC entry points.
+    const l = host.emitUnionProjection(e.left);
+    const ty = host.llType(e.type);
+    const slot = B.slot();
+    B.entryAllocas.push(`${slot} = alloca ${ty}`);
+    const isUnit = host.tagInSet(l.name, def.id, unitTags);
+    const lu = B.newLabel("nul.u");
+    const lv = B.newLabel("nul.v");
+    const lj = B.newLabel("nul.j");
+    B.condBr(isUnit, lu, lv);
+    B.startBlock(lu);
+    host.emitBranchInto(slot, e.right);
+    B.br(lj);
+    B.startBlock(lv);
+    B.line(`store ${ty} ${host.unionExtract(l.name, def.id, e.type)}, ptr ${slot}`);
+    B.br(lj);
+    B.startBlock(lj);
+    const t = B.tmp();
+    B.line(`${t} = load ${ty}, ptr ${slot}`);
+    return host.own({ name: t, type: e.type });
+  }
+  const l = host.emitExpr(e.left);
+  host.toFrame(l);
+  const ty = host.llType(e.type);
+  const slot = B.slot();
+  B.entryAllocas.push(`${slot} = alloca ${ty}`);
+  const isUnit = host.tagInSet(l.name, def.id, unitTags);
+  const lu = B.newLabel("nul.u");
+  const lv = B.newLabel("nul.v");
+  const lj = B.newLabel("nul.j");
+  B.condBr(isUnit, lu, lv);
+  B.startBlock(lu);
+  host.releaseFrame(l.name, e.left.type);
+  host.emitBranchInto(slot, e.right);
+  B.br(lj);
+  B.startBlock(lv);
+  if (typeEquals(e.type, e.left.type) || host.nullableUnions.single(def.id)) {
+    // Pass-through, or a nullable pointer that IS its owned arm value.
+    B.line(`store ${ty} ${l.name}, ptr ${slot}`);
+  } else {
+    B.line(`store ${ty} ${host.unionExtract(l.name, def.id, e.type)}, ptr ${slot}`);
+    host.releaseFrame(l.name, e.left.type);
+  }
+  B.br(lj);
+  B.startBlock(lj);
+  const t = B.tmp();
+  B.line(`${t} = load ${ty}, ptr ${slot}`);
+  return host.own({ name: t, type: e.type });
+}
+
 /** The receiver half of a union-receiver `a?.b`. The receiver evaluates
  * once; `isUnit` tests its unit arms, and `bindPresent` fills the chain's
  * bind slot with the narrowed payload for the body to read through

packages/compiler/src/backend/llvm/expr-primitives.ts

@@ -1080,16 +1080,21 @@ export function emitContainerExpr(
           B.line(`${fits} = icmp ule ${host.sizeType} ${capacity}, ${SMALL_ARRAY_SLOTS}`);
           B.condBr(fits, smallLabel, sizedLabel);
           B.startBlock(smallLabel);
-          B.line(`${smallArr} = ${arrNewCall(host.shapeHost, elem, "0", true)}`);
+          B.line(`${smallArr} = ${arrNewCall(host.shapeHost, elem, "0", true, host.arenaSite(e))}`);
           B.br(joined);
           B.startBlock(sizedLabel);
-          B.line(`${sizedArr} = ${arrNewCall(host.shapeHost, elem, capacity)}`);
+          B.line(
+            `${sizedArr} = ${arrNewCall(host.shapeHost, elem, capacity, false, host.arenaSite(e))}`,
+          );
           B.br(joined);
           B.startBlock(joined);
           B.line(
             `${arr} = phi ptr [ ${smallArr}, %${smallLabel} ], [ ${sizedArr}, %${sizedLabel} ]`,
           );
-        } else B.line(`${arr} = ${arrNewCall(host.shapeHost, elem, String(capacity), small)}`);
+        } else
+          B.line(
+            `${arr} = ${arrNewCall(host.shapeHost, elem, String(capacity), small, host.arenaSite(e))}`,
+          );
       }
       const out = host.own({ name: arr, type: e.type });
       const acc: ArrayAccess = int32 ? "i32" : elemAccess(elem);
@@ -1362,7 +1367,7 @@ export function emitRecordExpr(
         throw new InternalCompilerError("llvm emitter bug: recordLit of non-record type");
       const shapeId = e.type.shapeId;
       const rec = B.tmp();
-      B.line(`${rec} = call ptr @${mangleRecordNew(shapeId)}()`);
+      B.line(`${rec} = call ptr @${host.allocSym(mangleRecordNew(shapeId), e)}()`);
       const out = host.own({ name: rec, type: e.type });
       // A null-prototype record: SCR_MAP_NULL_PROTO on the fresh map.
       if (e.nullProto) B.line(`store i8 1, ptr ${host.recordMapFlagsPtr(rec, shapeId)}`);

packages/compiler/src/backend/llvm/int32-kind-loops.ts

@@ -57,6 +57,8 @@ function isPure(e: IrExpr): boolean {
     case "arrayGet":
     case "arrayHas":
       return e.arr.kind === "varRef" && isPure(e.index);
+    case "arrIntrinsic":
+      return e.method === "getNumber" && e.receiver.kind === "varRef" && isPure(e.args[0]!);
     default:
       return false;
   }

packages/compiler/src/backend/llvm/integer-clones.ts

@@ -192,6 +192,8 @@ function cloneShape(fn: IrFunction, borrowed?: BorrowedParameter): Set<string> |
       case "ternary":
         return expr(e.cond, "bool") && expr(e.then, want) && expr(e.else_, want);
       case "arrIntrinsic":
+        if (e.method === "getNumber")
+          return want === "num" && arrayRef(e.receiver) && expr(e.args[0]!, "num");
         return (
           want === "num" && e.method === "length" && e.args.length === 0 && arrayRef(e.receiver)
         );
@@ -269,6 +271,9 @@ function callsMatch(fn: IrFunction, byName: ReadonlyMap<string, IrFunction>): bo
       case "arrayGet":
         visit(e.index);
         return;
+      case "arrIntrinsic":
+        if (e.method === "getNumber") visit(e.args[0]!);
+        return;
       default:
         return;
     }
@@ -433,6 +438,8 @@ function callsAnything(e: IrExpr): boolean {
       return callsAnything(e.cond) || callsAnything(e.then) || callsAnything(e.else_);
     case "arrayGet":
       return callsAnything(e.index);
+    case "arrIntrinsic":
+      return e.method === "getNumber" && callsAnything(e.args[0]!);
     default:
       return false;
   }
@@ -1021,10 +1028,10 @@ class CloneEmitter {
    * keeps every slot below `filled` a present value) whose element is
    * exactly an int32. Everything else (holes, indices outside the prefix,
    * other numbers) bails: the ordinary body reads it. */
-  private emitElement(e: Extract<IrExpr, { kind: "arrayGet" }>): string {
+  private emitElement(arr: IrExpr, indexExpr: IrExpr): string {
     const { B } = this;
-    const array = this.emitArray(e.arr);
-    const index = this.narrow(this.emitNum(e.index));
+    const array = this.emitArray(arr);
+    const index = this.narrow(this.emitNum(indexExpr));
     const filledField = B.tmp();
     const filled = B.tmp();
     const inside = B.tmp();
@@ -1188,9 +1195,13 @@ class CloneEmitter {
         if (this.inlines(e)) return { name: this.emitInlineCall(e), wide: false };
         return { name: this.emitCall(e), wide: true };
       case "arrIntrinsic":
+        // `getNumber` reads an element like `arrayGet`: a missing one bails,
+        // and the ordinary body reads it as NaN.
+        if (e.method === "getNumber")
+          return { name: this.emitElement(e.receiver, e.args[0]!), wide: false };
         return { name: this.emitLength(this.emitArray(e.receiver)), wide: false };
       case "arrayGet":
-        return { name: this.emitElement(e), wide: false };
+        return { name: this.emitElement(e.arr, e.index), wide: false };
       case "unary": {
         const operand = this.narrow(this.emitNum(e.operand));
         const value = B.tmp();

packages/compiler/src/backend/llvm/js-ic.ts

@@ -84,10 +84,13 @@ function kindIs(host: Host, d: string, kind: number, yes: string, no: string): v
  * inline made polymorphic reads 7-10% faster (the design prototype's W2/W3)
  * and monomorphic method code no faster, for 65-225 more bytes per site;
  * the prototype hit made method-heavy code 3-6% faster for 15-90 bytes.
- * So a site tests entry 0, own or prototype, and its probe does the rest.
- * (0 makes every access probe: with a runtime built with SCR_JS_VERIFY,
- * that probes every access.) */
-const INLINE_WAYS: number = 1;
+ * Two entries cover the common two-layout site (object literals of one
+ * record built in two key orders): on bench:runtime's dynamic-properties
+ * they made the run 13% faster than one entry, and 26% faster without its
+ * class instances; four were no faster than two. So a site tests entries
+ * 0 and 1, own or prototype, and its probe does the rest. (0 makes every access probe: with a runtime
+ * built with SCR_JS_VERIFY, that probes every access.) */
+const INLINE_WAYS: number = 2;
 const INLINE_PROTO = true;
 
 /** The address of slot `slot` of layout-mode object `d`. */

packages/compiler/src/backend/llvm/lib-dispatch.ts

@@ -218,7 +218,7 @@ export function emitGenericLibCall(host: LlvmEmitterContext, e: LibCallExpr): Ll
     host.emitCoroAwait(null);
     return { name: "", type: e.type };
   }
-  if (host.wasi && e.fn === "async.awaitDyn") {
+  if (host.coroAwait && e.fn === "async.awaitDyn") {
     const value = host.emitExpr(e.args[0]!);
     host.declare(`declare ptr @scr_dyn_promise_of(ptr)`);
     const promise = B.tmp();
@@ -230,15 +230,16 @@ export function emitGenericLibCall(host: LlvmEmitterContext, e: LibCallExpr): Ll
     B.line(`${isPromise} = icmp ne ptr ${promise}, null`);
     B.condBr(isPromise, wait, hop);
     B.startBlock(wait);
-    host.emitWasiSuspend(promise);
+    host.emitCoroAwait(promise);
     B.br(ready);
     B.startBlock(hop);
-    host.emitWasiSuspend(null);
+    host.emitCoroAwait(null);
     B.br(ready);
     B.startBlock(ready);
-    host.declare(`declare ptr @scr_await_dyn_value_settled(ptr)`);
+    const extract = host.wasi ? "scr_await_dyn_value_settled" : "scr_coro_await_dyn_value";
+    host.declare(`declare ptr @${extract}(ptr)`);
     const result = B.tmp();
-    B.line(`${result} = call ptr @scr_await_dyn_value_settled(ptr ${value.name})`);
+    B.line(`${result} = call ptr @${extract}(ptr ${value.name})`);
     const output = host.own({ name: result, type: e.type });
     host.emitPendingCheck();
     return output;

packages/compiler/src/backend/llvm/loop-callees.test.ts

@@ -0,0 +1,83 @@
+import { expect, test } from "vitest";
+import {
+  BOOL,
+  F64,
+  VOID,
+  type IrExpr,
+  type IrFunction,
+  type IrModule,
+  type IrStmt,
+} from "../../ir/ir.js";
+import { findLoopCallees } from "./loop-callees.js";
+
+const loc = { file: "callees.ts", start: 0, end: 0 };
+const num = (value: number): IrExpr => ({ kind: "numLit", value, type: F64, loc });
+const ref = (localId: string): IrExpr => ({ kind: "varRef", localId, type: F64, loc });
+const call = (callee: string): IrExpr => ({ kind: "call", callee, args: [num(1)], type: F64, loc });
+const run = (e: IrExpr): IrStmt => ({ kind: "exprStmt", expr: e, loc });
+const ret = (e: IrExpr): IrStmt => ({ kind: "return", value: e, loc });
+const loop = (body: IrStmt[]): IrStmt => ({
+  kind: "while",
+  cond: { kind: "bin", op: "<", left: ref("i"), right: num(10), type: BOOL, loc },
+  body,
+  loc,
+});
+const fn = (name: string, body: IrStmt[], extra: Partial<IrFunction> = {}): IrFunction => ({
+  name,
+  params: [{ localId: "x", name: "x", type: F64 }],
+  returnType: F64,
+  locals: [{ id: "x", name: "x", type: F64, mutable: false }],
+  body,
+  loc,
+  ...extra,
+});
+const module = (functions: IrFunction[]): IrModule => ({
+  irVersion: 17,
+  sourceFile: loc.file,
+  entry: "__main",
+  functions: [
+    { name: "__main", params: [], returnType: VOID, locals: [], body: [], loc },
+    ...functions,
+  ],
+});
+
+test("a small leaf called only from loops is a loop callee", () => {
+  const callees = findLoopCallees(
+    module([
+      fn("leaf", [loop([run(ref("x"))]), ret(ref("x"))]),
+      fn("caller", [loop([run(call("leaf"))]), loop([run(call("leaf"))]), ret(num(0))]),
+    ]),
+  );
+  expect([...callees]).toEqual(["leaf"]);
+});
+
+test("a call outside a loop, a third call site, an own call or a large body keeps the call", () => {
+  const leaf = fn("leaf", [ret(ref("x"))]);
+  // A call site outside any loop.
+  expect(
+    findLoopCallees(module([leaf, fn("caller", [run(call("leaf")), loop([run(call("leaf"))])])]))
+      .size,
+  ).toBe(0);
+  // Three call sites.
+  const three = fn("caller", [loop([run(call("leaf")), run(call("leaf")), run(call("leaf"))])]);
+  expect(findLoopCallees(module([leaf, three])).size).toBe(0);
+  // A callee that calls another function.
+  const calling = fn("calling", [ret(call("leaf"))]);
+  const caller = fn("caller", [loop([run(call("calling"))])]);
+  // (leaf is then called outside a loop, from calling.)
+  expect(findLoopCallees(module([leaf, calling, caller])).size).toBe(0);
+  // Two loops, or more than 12 statements.
+  const twoLoops = fn("leaf", [loop([]), loop([]), ret(ref("x"))]);
+  expect(findLoopCallees(module([twoLoops, fn("caller", [loop([run(call("leaf"))])])])).size).toBe(
+    0,
+  );
+  const long = fn("leaf", [...Array.from({ length: 12 }, () => run(ref("x"))), ret(ref("x"))]);
+  expect(findLoopCallees(module([long, fn("caller", [loop([run(call("leaf"))])])])).size).toBe(0);
+  // Async functions and library modules.
+  const asyncLeaf = fn("leaf", [ret(ref("x"))], { async: true });
+  expect(findLoopCallees(module([asyncLeaf, fn("caller", [loop([run(call("leaf"))])])])).size).toBe(
+    0,
+  );
+  const lib = { ...module([leaf, fn("caller", [loop([run(call("leaf"))])])]), lib: {} } as IrModule;
+  expect(findLoopCallees(lib).size).toBe(0);
+});

packages/compiler/src/backend/llvm/loop-callees.ts

@@ -0,0 +1,110 @@
+import type { IrExpr, IrFunction, IrModule, IrStmt } from "../../ir/ir.js";
+import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
+
+/** Statements a callee may have, counting nested ones. */
+const MAX_STATEMENTS = 12;
+/** Direct call sites a callee may have. */
+const MAX_CALL_SITES = 2;
+
+/** Expressions that run other code: a callee that has none calls nothing,
+ * so inlining it never inlines a call chain or a recursion. */
+const CALLS = new Set<string>([
+  "call",
+  "callValue",
+  "virtualCall",
+  "dynCall",
+  "dynInvoke",
+  "new",
+  "newValue",
+  "newPromise",
+  "ffiCall",
+  "awaitExpr",
+  "awaitUnionExpr",
+]);
+
+function isLoop(s: IrStmt): boolean {
+  return s.kind === "for" || s.kind === "while" || s.kind === "doWhile" || s.kind === "forOf";
+}
+
+/** Small functions that are called only from inside loops: a per-element
+ * helper such as
+ *
+ *     function pick(list: Gene[], rand: number): number {
+ *       for (const gene of list) if (rand < gene.c) return gene.sc;
+ *       return list[list.length - 1]!.sc;
+ *     }
+ *
+ * called from a loop over the elements. After its loop versions and
+ * checks, such a function is often past LLVM's inline cost threshold, so
+ * every element pays a call, the spills around it, and checks that the
+ * caller's loop could hoist once inlined.
+ *
+ * A function qualifies when it is a synchronous, non-generator function
+ * with no captures and no own call (CALLS), has at most MAX_STATEMENTS
+ * statements and one loop, and has one to MAX_CALL_SITES direct call sites
+ * in the module, each inside a loop body of its caller. The emitter marks
+ * those calls `alwaysinline`. Functions the module exports as a library
+ * keep the cost model's decision. */
+export function findLoopCallees(mod: IrModule): Set<string> {
+  const result = new Set<string>();
+  if (mod.lib !== undefined) return result;
+  const candidates = new Map<string, IrFunction>();
+  for (const fn of mod.functions) {
+    if (fn.async || fn.generator || fn.captures !== undefined || fn.classCaptures !== undefined)
+      continue;
+    let statements = 0;
+    let loops = 0;
+    let calls = false;
+    const expr = (e: IrExpr): boolean => {
+      if (CALLS.has(e.kind)) calls = true;
+      return !calls && everyExprChild(e, expr, stmt);
+    };
+    const stmt = (s: IrStmt): boolean => {
+      statements++;
+      if (isLoop(s)) loops++;
+      return statements <= MAX_STATEMENTS && loops <= 1 && everyStmtChild(s, expr, stmt);
+    };
+    if (!fn.body.every(stmt) || calls) continue;
+    candidates.set(fn.name, fn);
+  }
+  if (candidates.size === 0) return result;
+  // Call sites of each candidate, and whether every one is inside a loop.
+  const sites = new Map<string, { count: number; inLoops: boolean }>();
+  for (const fn of mod.functions) {
+    let depth = 0;
+    const expr = (e: IrExpr): boolean => {
+      if (e.kind === "call" && candidates.has(e.callee)) {
+        const site = sites.get(e.callee) ?? { count: 0, inLoops: true };
+        site.count++;
+        if (depth === 0 || e.callee === fn.name) site.inLoops = false;
+        sites.set(e.callee, site);
+      }
+      return everyExprChild(e, expr, stmt);
+    };
+    const stmt = (s: IrStmt): boolean => {
+      if (!isLoop(s)) return everyStmtChild(s, expr, stmt);
+      // A loop's header runs per iteration too, except a for's init.
+      if (s.kind === "for" && s.init) stmt(s.init);
+      depth++;
+      if (s.kind === "for") {
+        if (s.cond) expr(s.cond);
+        if (s.update) stmt(s.update);
+        s.body.every(stmt);
+      } else if (s.kind === "forOf") {
+        depth--;
+        expr(s.iterable);
+        depth++;
+        s.body.every(stmt);
+      } else if (s.kind === "while" || s.kind === "doWhile") {
+        expr(s.cond);
+        s.body.every(stmt);
+      }
+      depth--;
+      return true;
+    };
+    fn.body.every(stmt);
+  }
+  for (const [name, site] of sites)
+    if (site.inLoops && site.count >= 1 && site.count <= MAX_CALL_SITES) result.add(name);
+  return result;
+}

packages/compiler/src/backend/llvm/region-groups.test.ts

@@ -0,0 +1,205 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile, deserializeModule } from "../../index.js";
+import type { IrExpr, IrModule, IrType } from "../../ir/ir.js";
+import { analyzeClosedGroups, analyzeRegionGroups } from "./region-groups.js";
+import { children, type Node } from "./region-ir.js";
+
+async function moduleFor(source: string): Promise<IrModule> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-region-groups-"));
+  try {
+    const entry = join(dir, "main.ts"),
+      output = join(dir, "main.ir.json");
+    await writeFile(entry, source);
+    const result = await compile(entry, { outDir: dir, outPath: output, outputKind: "ir" });
+    if (!result.ok)
+      throw new Error(result.diagnostics.map((item) => `${item.code}: ${item.message}`).join("\n"));
+    return deserializeModule(await readFile(output, "utf8"));
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+/** The calls of `callee` in the module, in order. */
+function callsOf(mod: IrModule, callee: string): IrExpr[] {
+  const out: IrExpr[] = [];
+  const visit = (node: Node): void => {
+    if (node.kind === "call" && node.callee === callee) out.push(node);
+    const kids: Node[] = [];
+    children(node, kids);
+    for (const k of kids) visit(k);
+  };
+  for (const fn of mod.functions) for (const s of fn.body) visit(s);
+  return out;
+}
+
+// Every object and record is an arena type here, and every union a nullable
+// pointer to one (the emitter decides both from layouts).
+const everyObject = (t: IrType): boolean =>
+  t.kind === "object" || t.kind === "record" || t.kind === "union";
+
+const TREE = `
+class Node {
+  left: Node | null;
+  right: Node | null;
+  constructor(left: Node | null, right: Node | null) {
+    this.left = left;
+    this.right = right;
+  }
+  count(): number {
+    return 1 + (this.left === null ? 0 : this.left.count()) + (this.right === null ? 0 : this.right.count());
+  }
+}
+function tree(depth: number): Node {
+  return depth === 0 ? new Node(null, null) : new Node(tree(depth - 1), tree(depth - 1));
+}
+`;
+
+test("a builder whose result its caller only reads is a closed root", async () => {
+  const mod = await moduleFor(`${TREE}
+let total = 0;
+for (let d = 0; d < 4; d++) total += tree(d).count();
+console.log(total);
+`);
+  const groups = analyzeRegionGroups(mod);
+  expect(groups.fresh.has("tree")).toBe(true);
+  const [root] = callsOf(mod, "tree").filter((c) => groups.roots.has(c));
+  expect(root).toBeDefined();
+  expect(groups.drops.get(root!)).toBeNull();
+  expect(groups.reachable.has("tree")).toBe(true);
+  expect(analyzeClosedGroups(mod, groups, everyObject).has(root!)).toBe(true);
+});
+
+test("a result kept past its caller's frame is no root", async () => {
+  const mod = await moduleFor(`${TREE}
+const kept: Node[] = [];
+for (let d = 0; d < 4; d++) kept.push(tree(d));
+console.log(kept.length);
+`);
+  const groups = analyzeRegionGroups(mod);
+  expect(callsOf(mod, "tree").some((c) => groups.roots.has(c))).toBe(false);
+});
+
+test("a function that stores what it allocates in a global is not leak-free", async () => {
+  const mod = await moduleFor(`
+interface P { x: number }
+const seen: P[] = [];
+function note(x: number): void {
+  seen.push({ x });
+}
+function sum(n: number): number {
+  let s = 0;
+  for (let i = 0; i < n; i++) {
+    const p = { x: i };
+    s += p.x;
+  }
+  return s;
+}
+note(1);
+console.log(sum(3), seen.length);
+`);
+  const groups = analyzeRegionGroups(mod);
+  expect(groups.leakFree.has("note")).toBe(false);
+  expect(callsOf(mod, "note").some((c) => groups.calls.has(c))).toBe(false);
+  expect(groups.leakFree.has("sum")).toBe(true);
+});
+
+test("a leak-free call that returns no reference is a call region", async () => {
+  const mod = await moduleFor(`
+interface V { x: number; y: number }
+function add(a: V, b: V): V {
+  return { x: a.x + b.x, y: a.y + b.y };
+}
+function walk(n: number): number {
+  let at: V = { x: 0, y: 0 };
+  for (let i = 0; i < n; i++) at = add(at, { x: i, y: 1 });
+  return at.x + at.y;
+}
+console.log(walk(10));
+`);
+  const groups = analyzeRegionGroups(mod);
+  const [region] = callsOf(mod, "walk");
+  expect(groups.calls.has(region!)).toBe(true);
+});
+
+test("a graph that holds strings or outside objects is not closed", async () => {
+  const mod = await moduleFor(`
+class Tag {
+  name: string;
+  constructor(name: string) {
+    this.name = name;
+  }
+}
+class Box {
+  tag: Tag;
+  owner: Tag | null;
+  constructor(tag: Tag, owner: Tag | null) {
+    this.tag = tag;
+    this.owner = owner;
+  }
+}
+const shared = new Tag("shared");
+function labelled(n: number): Box {
+  let box = new Box(new Tag("t" + n), null);
+  for (let i = 0; i < n; i++) box = new Box(new Tag("t" + i), null);
+  return box;
+}
+function owned(n: number): Box {
+  let box = new Box(new Tag("x"), shared);
+  for (let i = 0; i < n; i++) box = new Box(new Tag("x"), shared);
+  return box;
+}
+let n = 0;
+for (let i = 0; i < 3; i++) n += labelled(i).tag.name.length + owned(i).tag.name.length;
+console.log(n);
+`);
+  const groups = analyzeRegionGroups(mod);
+  const closed = analyzeClosedGroups(mod, groups, everyObject);
+  const labelled = callsOf(mod, "labelled").filter((c) => groups.roots.has(c));
+  const owned = callsOf(mod, "owned").filter((c) => groups.roots.has(c));
+  expect(labelled.length).toBe(1);
+  expect(owned.length).toBe(1);
+  expect(closed.has(labelled[0]!)).toBe(false);
+  expect(closed.has(owned[0]!)).toBe(false);
+});
+
+test("a root bound in a loop body is dropped with that body's local", async () => {
+  const mod = await moduleFor(`${TREE}
+function run(n: number): number {
+  let total = 0;
+  for (let i = 0; i < n; i++) {
+    const t = tree(i % 4);
+    total += t.count();
+  }
+  return total;
+}
+console.log(run(10));
+`);
+  const groups = analyzeRegionGroups(mod);
+  const [root] = callsOf(mod, "tree").filter((c) => groups.roots.has(c));
+  const run = mod.functions.find((f) => f.name === "run")!;
+  const local = groups.drops.get(root!);
+  expect(run.locals.find((l) => l.id === local)?.name).toBe("t");
+});
+
+test("a root whose value a callee writes into is not closed", async () => {
+  const mod = await moduleFor(`${TREE}
+function graft(n: Node, extra: Node): void {
+  n.left = extra;
+}
+const spare = new Node(null, null);
+let total = 0;
+for (let d = 0; d < 3; d++) {
+  const t = tree(d);
+  graft(t, spare);
+  total += t.count();
+}
+console.log(total);
+`);
+  const groups = analyzeRegionGroups(mod);
+  const closed = analyzeClosedGroups(mod, groups, everyObject);
+  for (const root of callsOf(mod, "tree").filter((c) => groups.roots.has(c)))
+    expect(closed.has(root)).toBe(false);
+});

packages/compiler/src/backend/llvm/region-ir.ts

@@ -0,0 +1,271 @@
+/* IR helpers shared by the region analyses (region-groups.ts): node
+ * traversal, allocation kinds, and how a use of a value passes it on or
+ * keeps it in the frame. */
+import type { IrExpr, IrStmt, IrType } from "../../ir/ir.js";
+import { everyExprChild, everyStmtChild } from "../../ir/traverse.js";
+
+export type Node = IrExpr | IrStmt;
+
+/** The kinds of heap allocation sites counted. */
+export const ALLOCATIONS = new Set([
+  "arrayLit",
+  "arrayNewLen",
+  "mapNew",
+  "setNew",
+  "new",
+  "recordLit",
+  "recordClone",
+  "closure",
+]);
+
+/** Array methods that return a fresh array without keeping the receiver. */
+export const FRESH_ARRAY_METHODS = new Set([
+  "slice",
+  "concatSpread",
+  "toReversed",
+  "toSpliced",
+  "with",
+  "withUndefined",
+  "flatCopy",
+  "flatOne",
+  "toSortedPrimitive",
+  "splice",
+]);
+/** Array methods that return the receiver itself. */
+export const RECEIVER_RESULT = new Set([
+  "reverse",
+  "fill",
+  "fillUndefined",
+  "copyWithin",
+  "sortPrimitive",
+]);
+/** Array methods whose arguments are only read (compared, copied from). */
+export const READ_ARGS = new Set([
+  "includes",
+  "indexOf",
+  "indexEq",
+  "getNumber",
+  "join",
+  "slice",
+  "concatSpread",
+  "pushSpread",
+  "unshiftSpread",
+  "nextPresent",
+  "length",
+]);
+
+export function refType(t: IrType): boolean {
+  return (
+    t.kind === "array" ||
+    t.kind === "map" ||
+    t.kind === "set" ||
+    t.kind === "object" ||
+    t.kind === "record" ||
+    t.kind === "func" ||
+    t.kind === "union"
+  );
+}
+
+export function children(node: Node, out: Node[]): void {
+  const push = (child: Node): boolean => {
+    out.push(child);
+    return true;
+  };
+  if ("type" in node && (node as IrExpr).type !== undefined && isExpr(node))
+    everyExprChild(node as IrExpr, push, push);
+  else everyStmtChild(node as IrStmt, push, push);
+}
+
+const STMT_KINDS = new Set([
+  "varDecl",
+  "assign",
+  "exprStmt",
+  "if",
+  "while",
+  "doWhile",
+  "switch",
+  "for",
+  "arraySet",
+  "arraySetLength",
+  "arraySetUndefined",
+  "arrayDelete",
+  "bytesSet",
+  "forOf",
+  "return",
+  "fieldSet",
+  "recordSet",
+  "recordKeySet",
+  "recordKeyDelete",
+  "break",
+  "continue",
+  "block",
+  "throw",
+  "runtimeFence",
+  "rethrow",
+  "tryCatch",
+]);
+export function isExpr(node: Node): node is IrExpr {
+  return !STMT_KINDS.has(node.kind);
+}
+
+/** Whether `a` and `b` are the same node. */
+export function same(a: Node | undefined, b: Node): boolean {
+  return a !== undefined && a === b;
+}
+
+/** Whether `parent` passes `child`'s value on as its own value (a branch of
+ * a conditional, a union wrap or narrow, a class up- or downcast, the
+ * result of a sequence), so the value's fate is the parent's. */
+export function transparent(child: Node, parent: Node | undefined): boolean {
+  if (parent === undefined) return false;
+  switch (parent.kind) {
+    case "ternary":
+      return same(parent.then, child) || same(parent.else_, child);
+    case "nullish":
+    case "logical":
+      return true;
+    case "seqExpr":
+      return same(parent.result, child);
+    case "unionWrap":
+    case "unionRetype":
+    case "unionNarrow":
+    case "upcast":
+    case "downcast":
+      return same(parent.value, child);
+    default:
+      return false;
+  }
+}
+
+/** Whether a use of a local's value as `child` of `parent` keeps it in the
+ * frame (given the current parameter summaries). */
+export function keepsInFrame(
+  child: Node,
+  parent: Node | undefined,
+  summaries: ReadonlyMap<string, Set<number>>,
+): boolean {
+  if (parent === undefined) return false;
+  switch (parent.kind) {
+    case "exprStmt":
+      return true;
+    case "arrayGet":
+    case "arrayHas":
+    case "arrayState":
+    case "arraySetUndefined":
+    case "arrayDelete":
+    case "arraySetLength":
+    case "arraySet":
+      return same(parent.arr, child);
+    case "fieldGet":
+    case "recordGet":
+    case "recordKeyGet":
+    case "recordHas":
+    case "recordOvfHas":
+    case "recordOvfKeys":
+    case "fieldSet":
+    case "recordSet":
+    case "recordKeySet":
+    case "recordKeyDelete":
+      return same(parent.obj, child);
+    case "forOf":
+      return same(parent.iterable, child);
+    case "arrIntrinsic":
+      if (same(parent.receiver, child)) return !RECEIVER_RESULT.has(parent.method);
+      return READ_ARGS.has(parent.method);
+    case "mapIntrinsic":
+      if (same(parent.receiver, child)) return true;
+      return parent.method === "get" || parent.method === "has" || parent.method === "delete";
+    case "setIntrinsic":
+      if (same(parent.receiver, child)) return true;
+      return parent.method === "has" || parent.method === "delete";
+    case "bin":
+      return parent.op === "===" || parent.op === "!==";
+    case "toBool":
+    case "unary":
+    case "unionIsTag":
+    case "unionEq":
+      return true;
+    case "unionDisc":
+    case "unionKeyGet":
+      return same(parent.value, child);
+    case "callValue":
+      return same(parent.callee, child);
+    case "call": {
+      const index = indexOfNode(parent.args, child);
+      return index >= 0 && summaries.get(parent.callee)?.has(index) === true;
+    }
+    default:
+      return false;
+  }
+}
+
+/** The index of `node` in `list`, or -1. */
+export function indexOfNode(list: readonly IrExpr[], node: Node): number {
+  for (let i = 0; i < list.length; i++) if (same(list[i], node)) return i;
+  return -1;
+}
+
+/** The arguments of a node that takes them (calls, constructions,
+ * intrinsics), or null. */
+export function argsOf(node: Node): readonly IrExpr[] | null {
+  switch (node.kind) {
+    case "call":
+    case "callValue":
+    case "virtualCall":
+    case "new":
+    case "newValue":
+    case "ffiCall":
+    case "dynCall":
+    case "dynInvoke":
+    case "intrinsic":
+    case "libCall":
+    case "arrIntrinsic":
+    case "bytesIntrinsic":
+    case "mapIntrinsic":
+    case "setIntrinsic":
+    case "strIntrinsic":
+    case "regexIntrinsic":
+      return node.args;
+    default:
+      return null;
+  }
+}
+
+const LOOP_STMTS = new Set(["while", "doWhile", "for", "forOf"]);
+
+/** Calls `visit(node, parent, loops)` for every node of `body`, parents
+ * before their children (siblings in no set order), where `loops` counts
+ * the loops around `node`. Allocates nothing per node. */
+export function forEachNode(
+  body: readonly IrStmt[],
+  visit: (node: Node, parent: Node | undefined, loops: number) => void,
+): void {
+  const nodes: Node[] = [];
+  const parents: (Node | undefined)[] = [];
+  const depths: number[] = [];
+  let parent: Node | undefined = undefined;
+  let depth = 0;
+  const pushExpr = (child: IrExpr): boolean => {
+    nodes.push(child);
+    parents.push(parent);
+    depths.push(depth);
+    return true;
+  };
+  const pushStmt = (child: IrStmt): boolean => {
+    nodes.push(child);
+    parents.push(parent);
+    depths.push(depth);
+    return true;
+  };
+  for (const st of body) pushStmt(st);
+  while (nodes.length > 0) {
+    const node = nodes.pop()!;
+    const above = parents.pop();
+    const loops = depths.pop()!;
+    visit(node, above, loops);
+    parent = node;
+    depth = loops + (LOOP_STMTS.has(node.kind) ? 1 : 0);
+    if (isExpr(node)) everyExprChild(node, pushExpr, pushStmt);
+    else everyStmtChild(node, pushExpr, pushStmt);
+  }
+}

packages/compiler/src/backend/llvm/region-sites.test.ts

@@ -0,0 +1,223 @@
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile, deserializeModule } from "../../index.js";
+import type { IrExpr, IrModule } from "../../ir/ir.js";
+import { analyzeRegionGroups } from "./region-groups.js";
+import { children, type Node } from "./region-ir.js";
+import { planRegionSites } from "./region-sites.js";
+
+async function moduleFor(source: string): Promise<IrModule> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-region-sites-"));
+  try {
+    const entry = join(dir, "main.ts"),
+      output = join(dir, "main.ir.json");
+    await writeFile(entry, source);
+    const result = await compile(entry, { outDir: dir, outPath: output, outputKind: "ir" });
+    if (!result.ok)
+      throw new Error(result.diagnostics.map((item) => `${item.code}: ${item.message}`).join("\n"));
+    return deserializeModule(await readFile(output, "utf8"));
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+/** The nodes in function `fn` matching `pick`, in order. */
+function nodesIn(mod: IrModule, fn: string, pick: (e: IrExpr) => boolean): IrExpr[] {
+  const out: IrExpr[] = [];
+  const visit = (node: Node): void => {
+    if (pick(node as IrExpr)) out.push(node as IrExpr);
+    const kids: Node[] = [];
+    children(node, kids);
+    for (const k of kids) visit(k);
+  };
+  for (const s of mod.functions.find((f) => f.name === fn)!.body) visit(s);
+  return out;
+}
+
+const calls = (callee: string) => (e: IrExpr) => e.kind === "call" && e.callee === callee;
+const records = (e: IrExpr) => e.kind === "recordLit";
+
+function plan(mod: IrModule) {
+  const groups = analyzeRegionGroups(mod);
+  const sites = planRegionSites(mod, groups);
+  return { groups, sites };
+}
+
+const TREE = `
+class Node {
+  left: Node | null;
+  right: Node | null;
+  constructor(left: Node | null, right: Node | null) {
+    this.left = left;
+    this.right = right;
+  }
+  count(): number {
+    return 1 + (this.left === null ? 0 : this.left.count()) + (this.right === null ? 0 : this.right.count());
+  }
+}
+function tree(depth: number): Node {
+  return depth === 0 ? new Node(null, null) : new Node(tree(depth - 1), tree(depth - 1));
+}
+`;
+
+test("a recursive builder's root takes an arena for every node", async () => {
+  const mod = await moduleFor(`${TREE}
+let total = 0;
+for (let d = 0; d < 4; d++) total += tree(d).count();
+console.log(total);
+`);
+  const { groups, sites } = plan(mod);
+  const roots = nodesIn(mod, "%init.0", calls("tree")).filter((c) => groups.roots.has(c));
+  expect(roots.length).toBe(1);
+  for (const n of nodesIn(mod, "tree", (e) => e.kind === "new"))
+    expect(sites.arenaSites.has(n)).toBe(true);
+  for (const c of nodesIn(mod, "tree", calls("tree"))) expect(sites.arenaSites.has(c)).toBe(true);
+});
+
+test("a builder of a bounded number of objects is no root", async () => {
+  const mod = await moduleFor(`
+interface V { x: number; y: number }
+function add(a: V, b: V): V {
+  return { x: a.x + b.x, y: a.y + b.y };
+}
+let at: V = { x: 0, y: 0 };
+let sum = 0;
+for (let i = 0; i < 10; i++) {
+  const step = add(at, { x: i, y: 1 });
+  sum += step.x;
+}
+console.log(sum, at.y);
+`);
+  const { groups } = plan(mod);
+  expect(groups.roots.size).toBe(0);
+  expect(groups.calls.size).toBe(0);
+  expect(groups.reachable.size).toBe(0);
+});
+
+test("a list a builder appends to in a loop takes the arena", async () => {
+  const mod = await moduleFor(`
+interface Row { id: number; score: number }
+function rows(n: number): Row[] {
+  const out: Row[] = [];
+  for (let i = 0; i < n; i++) {
+    const row: Row = { id: i, score: i * 2 };
+    out.push(row);
+  }
+  return out;
+}
+let total = 0;
+for (let k = 0; k < 3; k++) total += rows(10 + k).length;
+console.log(total);
+`);
+  const { groups, sites } = plan(mod);
+  expect(nodesIn(mod, "%init.0", calls("rows")).some((c) => groups.roots.has(c))).toBe(true);
+  const [row] = nodesIn(mod, "rows", records);
+  expect(sites.arenaSites.has(row!)).toBe(true);
+  const [out] = nodesIn(mod, "rows", (e) => e.kind === "arrayLit");
+  expect(sites.arenaSites.has(out!)).toBe(true);
+});
+
+test("values that replace elements or die in the loop take the heap", async () => {
+  const mod = await moduleFor(`
+interface V { x: number; y: number }
+function vec(x: number, y: number): V {
+  return { x, y };
+}
+function add(a: V, b: V): V {
+  return { x: a.x + b.x, y: a.y + b.y };
+}
+function simulate(n: number, steps: number): number {
+  const points: V[] = [];
+  for (let i = 0; i < n; i++) points.push(vec(i, i));
+  for (let s = 0; s < steps; s++)
+    for (let i = 0; i < n; i++) points[i] = add(points[i]!, vec(0, 1));
+  let sum = 0;
+  for (const p of points) sum += p.x + p.y;
+  return sum;
+}
+console.log(simulate(100, 10));
+`);
+  const { groups, sites } = plan(mod);
+  // The list's elements are replaced, so it keeps nothing: no group grows.
+  expect(groups.calls.size).toBe(0);
+  expect(groups.roots.size).toBe(0);
+  expect(sites.arenaSites.size).toBe(0);
+});
+
+test("a value reassigned in a loop and returned takes the heap", async () => {
+  const mod = await moduleFor(`
+class C {
+  re: number;
+  im: number;
+  constructor(re: number, im: number) {
+    this.re = re;
+    this.im = im;
+  }
+  times(o: C): C {
+    return new C(this.re * o.re - this.im * o.im, this.re * o.im + this.im * o.re);
+  }
+}
+function power(c: C, n: number): C {
+  let z = new C(1, 0);
+  for (let i = 0; i < n; i++) z = z.times(c);
+  return z;
+}
+let s = 0;
+for (let k = 0; k < 5; k++) s += power(new C(0.5, 0.5), k).re;
+console.log(s);
+`);
+  const { groups } = plan(mod);
+  expect(nodesIn(mod, "%init.0", calls("power")).some((c) => groups.roots.has(c))).toBe(false);
+});
+
+test("calls in an arena-aware function whose values die take the heap", async () => {
+  const mod = await moduleFor(`
+interface P { x: number; next: P | null }
+function weight(p: P): number {
+  return p.x * 2;
+}
+function probe(x: number): P {
+  return { x, next: null };
+}
+function chain(n: number): P {
+  let head: P = { x: 0, next: null };
+  const first = head;
+  for (let i = 1; i < n; i++) {
+    const node: P = { x: weight(probe(i)), next: null };
+    head.next = node;
+    head = node;
+  }
+  return first;
+}
+let total = 0;
+for (let k = 0; k < 3; k++) total += chain(5).x;
+console.log(total);
+`);
+  const { groups, sites } = plan(mod);
+  expect(nodesIn(mod, "%init.0", calls("chain")).some((c) => groups.roots.has(c))).toBe(true);
+  const [probe] = nodesIn(mod, "chain", calls("probe"));
+  expect(sites.arenaSites.has(probe!)).toBe(false);
+  expect(sites.heapCalls.has(probe!)).toBe(true);
+  for (const node of nodesIn(mod, "chain", records)) expect(sites.arenaSites.has(node)).toBe(true);
+});
+
+test("a root assigned in a loop to a local declared outside it is no root", async () => {
+  const mod = await moduleFor(`${TREE}
+function run(n: number): number {
+  let t = tree(1);
+  let total = t.count();
+  for (let d = 0; d < n; d++) {
+    t = tree(d);
+    total += t.count();
+  }
+  return total;
+}
+console.log(run(6));
+`);
+  const { groups } = plan(mod);
+  const [first, inLoop] = nodesIn(mod, "run", calls("tree"));
+  expect(groups.roots.has(first!)).toBe(true);
+  expect(groups.roots.has(inLoop!)).toBe(false);
+});

packages/compiler/src/backend/llvm/region-sites.ts

@@ -0,0 +1,349 @@
+/* Which allocations of a region group take its arena (arenas.ts), and
+ * which roots and call regions are worth one.
+ *
+ * An arena pays off for objects that live until the group is dropped: it
+ * saves their frees and teardown, but holds their memory until the drop.
+ * A temporary that dies early is cheaper on the heap, which reuses its
+ * memory at once. So in an arena-aware function an allocation takes the
+ * arena only when its value is kept by the group (its fate is the arena):
+ * - it is returned;
+ * - it is content of a new value that is kept;
+ * - it is stored, other than by an element write, into the graph of a
+ *   local that is kept (`out.push(row)`, `last.next = member`);
+ * - it is bound to a local that is kept.
+ * A local is kept when its value is returned or stored or put into
+ * something kept; a constructor's `this` is kept (its object follows its
+ * `new`); and in the callee of a call region, a local declared at the top
+ * of the body lives until the region drops. An element write (`a[i] = v`)
+ * usually replaces a value, so its value takes the heap.
+ *
+ * Every other allocation takes the heap, and so does everything a call
+ * allocates when the call's value is not kept: the emitter suspends the
+ * arena around such a call (heapCalls). Heap objects are always safe in a
+ * group; only arena objects need the group's proof.
+ *
+ * A root or call region is worth an arena when its group grows: a kept
+ * allocation runs in a loop, or a kept value comes from a recursive call
+ * or from a call of a function whose group grows. Other groups are small,
+ * and opening and dropping their arenas costs more than their frees. */
+import type { IrFunction, IrModule } from "../../ir/ir.js";
+import { contentOf, source, storeOf, storeTarget, type RegionGroups } from "./region-groups.js";
+import {
+  argsOf,
+  children,
+  indexOfNode,
+  isExpr,
+  refType,
+  same,
+  transparent,
+  type Node,
+} from "./region-ir.js";
+import { VirtualTargets } from "./reference-effects.js";
+
+export interface RegionSites {
+  /** Allocation sites (and calls) whose value the group keeps. */
+  arenaSites: Set<Node>;
+  /** Calls, constructions and closure calls in arena-aware functions whose
+   * value the group does not keep and whose callee may allocate: the
+   * arena is suspended while they run. */
+  heapCalls: Set<Node>;
+}
+
+const LOOPS = new Set(["while", "doWhile", "for", "forOf"]);
+
+/** Collection methods that remove what their receiver holds. */
+const REMOVALS = new Set(["pop", "shift", "splice", "delete", "clear"]);
+
+/** The local whose graph `node` drops values from (an element write, a
+ * length write, a delete, a removing method), or null. */
+function removalTarget(node: Node): string | null {
+  switch (node.kind) {
+    case "arraySet":
+    case "arraySetLength":
+    case "arraySetUndefined":
+    case "arrayDelete":
+      return storeTarget(node.arr);
+    case "recordKeyDelete":
+      return storeTarget(node.obj);
+    case "arrIntrinsic":
+    case "mapIntrinsic":
+    case "setIntrinsic":
+      return REMOVALS.has(node.method) ? storeTarget(node.receiver) : null;
+    default:
+      return null;
+  }
+}
+
+/** The functions a call-like node may run, or null when unknown. */
+function targetsOf(vt: VirtualTargets, node: Node): readonly string[] | null {
+  if (node.kind === "call") return [node.callee];
+  if (node.kind === "new") return [`%${node.className}.constructor`];
+  if (node.kind === "virtualCall") {
+    const t = vt.targets(node.className, node.method);
+    return t !== null && t.length > 0 ? t : null;
+  }
+  return null;
+}
+
+const callLike = (node: Node): boolean =>
+  node.kind === "call" ||
+  node.kind === "new" ||
+  node.kind === "virtualCall" ||
+  node.kind === "callValue" ||
+  node.kind === "newValue";
+
+/** The functions that run inside the arenas of `roots`: what they call,
+ * transitively, with the closures they pass. */
+export function reachableFrom(mod: IrModule, roots: Iterable<Node>): Set<string> {
+  const fns = new Map(mod.functions.map((f) => [f.name, f]));
+  const vt = new VirtualTargets(mod.classes ?? []);
+  const reachable = new Set<string>();
+  const queue: string[] = [];
+  const visit = (node: Node): void => {
+    const reach = (name: string): void => {
+      if (fns.has(name) && !reachable.has(name)) {
+        reachable.add(name);
+        queue.push(name);
+      }
+    };
+    if (node.kind === "closure") reach(node.fnName);
+    else for (const t of targetsOf(vt, node) ?? []) reach(t);
+    const kids: Node[] = [];
+    children(node, kids);
+    for (const k of kids) visit(k);
+  };
+  for (const r of roots) visit(r);
+  while (queue.length > 0) for (const st of fns.get(queue.pop()!)!.body) visit(st);
+  return reachable;
+}
+
+interface FnSites {
+  /** Kept call-like nodes and allocations, with whether each is in a loop. */
+  kept: Map<Node, boolean>;
+  /** Call-like nodes whose value is not kept. */
+  dropped: Node[];
+}
+
+/** Classifies the allocations and calls of `fn`. */
+function classify(fn: IrFunction, topLocalsKept: boolean): FnSites {
+  const locals = new Set(fn.locals.map((l) => l.id));
+  // Alias classes: a local bound to another local shares its fate.
+  const parent = new Map<string, string>();
+  const find = (id: string): string => {
+    let r = id;
+    while (parent.has(r)) r = parent.get(r)!;
+    return r;
+  };
+  const unite = (a: string, b: string): void => {
+    const ra = find(a),
+      rb = find(b);
+    if (ra !== rb) parent.set(ra, rb);
+  };
+  const kept = new Set<string>();
+  const keep = (id: string): boolean => {
+    const r = find(id);
+    if (kept.has(r)) return false;
+    kept.add(r);
+    return true;
+  };
+  const isKept = (id: string): boolean => kept.has(find(id));
+  // Kept from the start (applied once the alias classes are known).
+  const seeds: string[] = [];
+  if (fn.name.endsWith(".constructor") && fn.params.length > 0) seeds.push(fn.params[0]!.localId);
+  if (topLocalsKept) {
+    const types = new Map(fn.locals.map((l) => [l.id, l.type]));
+    for (const st of fn.body)
+      if (st.kind === "varDecl" && refType(types.get(st.localId) ?? { kind: "void" }))
+        seeds.push(st.localId);
+  }
+
+  // Uses of locals and of value-producing nodes, recorded once.
+  type Fate =
+    | { kind: "kept" }
+    | { kind: "local"; id: string }
+    | { kind: "target"; id: string }
+    | { kind: "node"; node: Node }
+    | { kind: "heap" };
+  const fateOf = (node: Node, parents: readonly Node[]): Fate => {
+    let value: Node = node;
+    let at = parents.length - 1;
+    while (at >= 0 && transparent(value, parents[at])) value = parents[at--]!;
+    const p = at >= 0 ? parents[at] : undefined;
+    if (p === undefined) return { kind: "heap" };
+    if (p.kind === "return") return { kind: "kept" };
+    if (
+      (p.kind === "varDecl" && p.init !== null && same(p.init, value)) ||
+      (p.kind === "assign" && same(p.value, value))
+    ) {
+      const id = p.localId;
+      // A local assigned in a loop usually drops its old value.
+      if (!locals.has(id) || (p.kind === "assign" && depth > 0)) return { kind: "heap" };
+      return { kind: "local", id };
+    }
+    const target = storeOf(value, p);
+    if (target !== undefined) {
+      if (p.kind === "arraySet") return { kind: "heap" };
+      const id = storeTarget(target);
+      return id !== null && locals.has(id) ? { kind: "target", id } : { kind: "heap" };
+    }
+    if (isExpr(p) && contentOf(value, p)) return { kind: "node", node: p };
+    // An argument of a call that returns a reference follows the call's
+    // value: the callee may put it into its result.
+    const args = argsOf(p);
+    if (
+      callLike(p) &&
+      isExpr(p) &&
+      refType(p.type) &&
+      args !== null &&
+      indexOfNode(args, value) >= 0
+    )
+      return { kind: "node", node: p };
+    return { kind: "heap" };
+  };
+
+  // Lossy locals: their graphs drop values (element writes, removals), so
+  // what is stored into them is not kept.
+  const lossy = new Set<string>();
+  const fates = new Map<Node, Fate>();
+  const loops = new Map<Node, boolean>();
+  const localUses: [string, Fate][] = [];
+  const parents: Node[] = [];
+  let depth = 0;
+  const walk = (node: Node): void => {
+    const removal = removalTarget(node);
+    if (removal !== null) lossy.add(removal);
+    if (source(node) || callLike(node)) {
+      fates.set(node, fateOf(node, parents));
+      loops.set(node, depth > 0);
+    } else if (node.kind === "varRef" && locals.has(node.localId) && refType(node.type)) {
+      const f = fateOf(node, parents);
+      if (f.kind !== "heap") localUses.push([node.localId, f]);
+    }
+    const loop = LOOPS.has(node.kind);
+    if (loop) depth++;
+    const kids: Node[] = [];
+    children(node, kids);
+    parents.push(node);
+    for (const k of kids) walk(k);
+    parents.pop();
+    if (loop) depth--;
+  };
+  for (const st of fn.body) walk(st);
+
+  // A local bound to another local joins its class.
+  for (const [id, f] of localUses) if (f.kind === "local") unite(id, f.id);
+  for (const id of [...lossy]) lossy.add(find(id));
+  for (const id of seeds) keep(id);
+  const keptFate = (f: Fate, seen = 0): boolean => {
+    if (seen > 64) return false;
+    switch (f.kind) {
+      case "kept":
+        return true;
+      case "local":
+        return isKept(f.id);
+      case "target":
+        return isKept(f.id) && !lossy.has(find(f.id));
+      case "node": {
+        const g = fates.get(f.node);
+        return g !== undefined && keptFate(g, seen + 1);
+      }
+      case "heap":
+        return false;
+    }
+  };
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const [id, f] of localUses)
+      if (f.kind !== "local" && keptFate(f) && keep(id)) changed = true;
+  }
+  const out: FnSites = { kept: new Map(), dropped: [] };
+  for (const [e, f] of fates)
+    if (keptFate(f)) out.kept.set(e, loops.get(e)!);
+    else if (callLike(e)) out.dropped.push(e);
+  return out;
+}
+
+/**
+ * Narrows `groups` to the roots and call regions worth an arena (with
+ * `reachable` recomputed for them) and classifies the allocations of the
+ * functions that run in their arenas.
+ */
+export function planRegionSites(mod: IrModule, groups: RegionGroups): RegionSites {
+  const fns = new Map(mod.functions.map((f) => [f.name, f]));
+  const vt = new VirtualTargets(mod.classes ?? []);
+  const regionCallees = new Set<string>();
+  for (const c of groups.calls) if (c.kind === "call") regionCallees.add(c.callee);
+  const sites = new Map<string, FnSites>();
+  for (const name of groups.reachable) {
+    const fn = fns.get(name);
+    if (fn !== undefined) sites.set(name, classify(fn, regionCallees.has(name)));
+  }
+  // Which functions reach which (for recursion), over the reachable ones.
+  const calleesOf = (name: string): Set<string> => {
+    const out = new Set<string>();
+    const s = sites.get(name);
+    if (s === undefined) return out;
+    for (const e of [...s.kept.keys(), ...s.dropped])
+      for (const t of targetsOf(vt, e) ?? []) if (sites.has(t)) out.add(t);
+    return out;
+  };
+  const edges = new Map([...sites.keys()].map((n) => [n, calleesOf(n)]));
+  const reaches = (from: string, to: string): boolean => {
+    const seen = new Set<string>();
+    const stack = [from];
+    while (stack.length > 0) {
+      const n = stack.pop()!;
+      if (n === to) return true;
+      if (seen.has(n)) continue;
+      seen.add(n);
+      for (const m of edges.get(n) ?? new Set<string>()) stack.push(m);
+    }
+    return false;
+  };
+  const grows = new Set<string>();
+  for (let changed = true; changed;) {
+    changed = false;
+    for (const [name, s] of sites) {
+      if (grows.has(name)) continue;
+      let g = false;
+      for (const [e, inLoop] of s.kept) {
+        if (inLoop) g = true;
+        for (const t of targetsOf(vt, e) ?? []) if (grows.has(t) || reaches(t, name)) g = true;
+        if (g) break;
+      }
+      if (g) {
+        grows.add(name);
+        changed = true;
+      }
+    }
+  }
+  const worth = (r: Node): boolean => {
+    // Module code runs once, and its groups hold the program's own state.
+    if (r.kind === "call") return grows.has(r.callee) && !r.callee.startsWith("%init.");
+    if (r.kind !== "new") return false;
+    if (grows.has(`%${r.className}.constructor`)) return true;
+    return r.args.some((a) => a.kind === "call" && grows.has(a.callee));
+  };
+  for (const r of [...groups.roots])
+    if (!worth(r)) {
+      groups.roots.delete(r);
+      groups.drops.delete(r);
+    }
+  for (const c of [...groups.calls]) if (!worth(c)) groups.calls.delete(c);
+  groups.reachable = reachableFrom(mod, [...groups.roots, ...groups.calls]);
+
+  const arenaSites = new Set<Node>();
+  const heapCalls = new Set<Node>();
+  const mayAllocate = (e: Node): boolean => {
+    const t = targetsOf(vt, e);
+    return t === null || t.some((n) => groups.allocates.has(n) || !fns.has(n));
+  };
+  for (const name of groups.reachable) {
+    const s = sites.get(name);
+    if (s === undefined) continue;
+    for (const e of s.kept.keys()) arenaSites.add(e);
+    for (const e of s.dropped)
+      if (!groups.roots.has(e) && !groups.calls.has(e) && mayAllocate(e)) heapCalls.add(e);
+  }
+  return { arenaSites, heapCalls };
+}

packages/compiler/src/backend/llvm/shapes.ts

@@ -60,6 +60,14 @@ import {
   type InlineUnionFields,
 } from "./inline-unions.js";
 import { JS_BITS, JS_TAGS } from "./jsval-encoding.js";
+import {
+  ARENA_RC,
+  arenaDisposeLines,
+  arenaDisposeSym,
+  arenaNewLines,
+  disposeFieldLines,
+  plainRefType,
+} from "./arenas.js";
 import { recordMayKeepSource } from "./record-sources.js";
 import { LlvmUnsupportedError } from "./unsupported.js";
 
@@ -137,6 +145,10 @@ export interface ShapeHost {
    * allocate in regions and count references in their region chunk instead
    * of being empty (llvm/regions.ts). */
   regions?: RegionHooks | null;
+  /** Record shapes and classes with an arena-aware constructor
+   * (arenas.ts). */
+  arenaShapes?: ReadonlySet<string>;
+  arenaClasses?: ReadonlySet<string>;
   /** The target C ABI's `size_t` / refcount integer type. */
   readonly sizeType: "i32" | "i64";
   /** Worker executables: the inline allocator state is thread-local. */
@@ -1198,22 +1210,25 @@ export function arrNewCall(
   /** An empty array expected to receive a few elements (its first slots
    * live in its own block): capText must be "0". */
   small = false,
+  /** In the current group arena when one is open (arenas.ts). */
+  arena = false,
 ): string {
+  const r = arena ? "_r" : "";
   const useRef = arrUsesRef(host, elem);
   if (!useRef) {
     if (small) {
-      host.declare(`declare ptr @scr_arr_new_small(i32)`);
-      return `call ptr @scr_arr_new_small(i32 ${elemKindNum(elem)})`;
+      host.declare(`declare ptr @scr_arr_new_small${r}(i32)`);
+      return `call ptr @scr_arr_new_small${r}(i32 ${elemKindNum(elem)})`;
     }
-    host.declare(`declare ptr @scr_arr_new(i32, ${host.sizeType})`);
-    return `call ptr @scr_arr_new(i32 ${elemKindNum(elem)}, ${host.sizeType} ${capText})`;
+    host.declare(`declare ptr @scr_arr_new${r}(i32, ${host.sizeType})`);
+    return `call ptr @scr_arr_new${r}(i32 ${elemKindNum(elem)}, ${host.sizeType} ${capText})`;
   }
   if (small) {
-    host.declare(`declare ptr @scr_arr_new_ops_small(ptr)`);
-    return `call ptr @scr_arr_new_ops_small(ptr ${arrOps(host, elem)})`;
+    host.declare(`declare ptr @scr_arr_new_ops_small${r}(ptr)`);
+    return `call ptr @scr_arr_new_ops_small${r}(ptr ${arrOps(host, elem)})`;
   }
-  host.declare(`declare ptr @scr_arr_new_ops(ptr, ${host.sizeType})`);
-  return `call ptr @scr_arr_new_ops(ptr ${arrOps(host, elem)}, ${host.sizeType} ${capText})`;
+  host.declare(`declare ptr @scr_arr_new_ops${r}(ptr, ${host.sizeType})`);
+  return `call ptr @scr_arr_new_ops${r}(ptr ${arrOps(host, elem)}, ${host.sizeType} ${capText})`;
 }
 
 /** The ScrElemKind and ops descriptor (or `null`) an array of `elem`
@@ -2327,6 +2342,34 @@ export function emitRecordShapes(
     if (traced) nw.push(...youngEntryLines(host));
     nw.push(`  ret ptr %o`, `}`, ``);
     defs.push(...nw);
+    if (host.arenaShapes?.has(shape.id) === true && !shape.indexValue) {
+      const newSym = mangleRecordNew(shape.id);
+      const dispose = refMembers.length > 0 ? arenaDisposeSym(newSym) : null;
+      const init = [`  store ${host.sizeType} ${ARENA_RC}, ptr %o`];
+      if (shapeNumber !== 0)
+        init.push(
+          `  %shp = getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${SHAPE_WORD_INDEX}`,
+          `  store i32 ${shapeNumber}, ptr %shp ; shape number`,
+        );
+      defs.push(
+        ...arenaNewLines(host, newSym, sizeOf, traced ? cycType : null, dispose, init, "%o"),
+      );
+      if (dispose !== null)
+        defs.push(
+          ...arenaDisposeLines(
+            newSym,
+            refMembers.flatMap((m, i) =>
+              disposeFieldLines(
+                i,
+                `getelementptr inbounds %${struct}, ptr %o, i64 0, i32 ${m.index}`,
+                plainRefType(m.type),
+                releaseSym(host, m.type),
+                llvmCommentText(m.name),
+              ),
+            ),
+          ),
+        );
+    }
 
     if (host.recordCloneShapes.has(shape.id)) {
       const attrs = shape.fields.length >= 16 ? "#2" : FN_ATTRS;

packages/compiler/src/backend/llvm/stack-objects.ts

@@ -57,8 +57,9 @@ export function canStackObject(host: LlvmEmitterContext, e: IrExpr): e is StackO
   if (e.type.kind === "record" && host.recordsById.get(e.type.shapeId)?.freezable === true)
     return false;
   // A producer with a result-slot entry builds its fresh result in the
-  // caller's storage.
-  if (e.kind === "call") return host.fnByName.has(resultEntryName(e.callee));
+  // caller's storage, unless the call roots a group: then the result goes
+  // in the group's arena with the objects it holds (arenas.ts).
+  if (e.kind === "call") return host.fnByName.has(resultEntryName(e.callee)) && !host.opensArena(e);
   if (e.kind === "recordLit") {
     if (e.type.kind !== "record") return false;
     const shape = host.recordsById.get(e.type.shapeId);

packages/compiler/src/backend/may-throw.test.ts

@@ -406,7 +406,7 @@ test("worker programs poll for termination only where execution can be unbounded
   expect(computeMayThrow({ ...mod, workers: false }).workerEntryPolls).toBeUndefined();
 });
 
-test("stack checks cover recursive components and recursion through reentrant operations", () => {
+test("stack checks cover every recursive cycle, including recursion through reentrant operations", () => {
   const mod = moduleWith(
     fn("caller", [call("self"), call("left"), call("leaf"), call("walker")], []),
     fn("self", [call("self"), call("leaf")], []),
@@ -420,7 +420,12 @@ test("stack checks cover recursive components and recursion through reentrant op
     fn("visitor", [callClosure("leaf")], []),
   );
   const answer = computeMayThrow(mod, { stackChecks: true });
-  expect([...answer.stackChecks!].sort()).toEqual(["left", "right", "self", "step", "walker"]);
+  // One check per cycle: self, one of left and right, and one of walker and
+  // step (the earlier function on ties).
+  expect([...answer.stackChecks!].sort()).toEqual(["left", "self", "walker"]);
+  expect(
+    [...computeMayThrow(mod, { stackChecks: "everyCycleMember" }).stackChecks!].sort(),
+  ).toEqual(["left", "right", "self", "step", "walker"]);
   // Checked functions throw the overflow RangeError, so their callers poll;
   // a throwing closure target makes every indirect call poll as well.
   expect(answer.indirect).toBe(true);
@@ -437,7 +442,7 @@ test("stack checks cover recursive components and recursion through reentrant op
   expect(computeMayThrow(mod).fns.size).toBe(0);
 });
 
-test("stack-checked synchronous functions skip the worker entry poll", () => {
+test("synchronous functions on a checked cycle skip the worker entry poll", () => {
   const asyncSelf: IrFunction = { ...fn("asyncSelf", [call("asyncSelf")], []), async: true };
   const mod: IrModule = {
     ...moduleWith(
@@ -452,10 +457,11 @@ test("stack-checked synchronous functions skip the worker entry poll", () => {
     workers: true,
   };
   const answer = computeMayThrow(mod, { stackChecks: true });
-  expect([...answer.stackChecks!].sort()).toEqual(["asyncSelf", "caller", "left", "right", "self"]);
-  // Callers test after every call of a stack-checked function, and its
-  // overflow unwinds through those tests, so only the module entry, async
-  // bodies and unbounded functions without a stack check poll on entry.
+  expect([...answer.stackChecks!].sort()).toEqual(["asyncSelf", "caller", "left", "self"]);
+  // Callers test after every call of a function on a checked cycle (it may
+  // throw), and an overflow unwinds through those tests, so only the module
+  // entry, async bodies and unbounded functions off any cycle poll on entry;
+  // right needs no poll although left holds the cycle's check.
   expect([...answer.workerEntryPolls!].sort()).toEqual(["asyncSelf", "caller", "walker"]);
   expect(answer.fns.has("self") && answer.fns.has("left") && answer.fns.has("right")).toBe(true);
   // Without stack checks (WASI, Windows, libraries) every cycle keeps its poll.
@@ -469,6 +475,48 @@ test("stack-checked synchronous functions skip the worker entry poll", () => {
   ]);
 });
 
+test("stack checks meet every cycle once and bound the runs between checks", () => {
+  // A ring of 80 functions, with a chord from fn10 back to fn0, and a
+  // separate ring of three whose functions also call each other backwards.
+  const ring = Array.from({ length: 80 }, (_, i) =>
+    fn(`fn${i}`, i === 10 ? [call("fn11"), call("fn0")] : [call(`fn${(i + 1) % 80}`)], []),
+  );
+  const mod = moduleWith(
+    ...ring,
+    fn("a", [call("b"), call("c")], []),
+    fn("b", [call("c"), call("a")], []),
+    fn("c", [call("a"), call("b")], []),
+  );
+  const checks = computeMayThrow(mod, { stackChecks: true }).stackChecks!;
+  // Removing the checked functions leaves no cycle, and no run of more than
+  // 32 unchecked calls.
+  const callees = new Map(
+    mod.functions.map((f) => [
+      f.name,
+      f.body.flatMap((s) =>
+        s.kind === "exprStmt" && s.expr.kind === "call" ? [s.expr.callee] : [],
+      ),
+    ]),
+  );
+  const longest = new Map<string, number>();
+  const visiting = new Set<string>();
+  const run = (name: string): number => {
+    if (checks.has(name)) return 0;
+    expect(visiting.has(name)).toBe(false);
+    const known = longest.get(name);
+    if (known !== undefined) return known;
+    visiting.add(name);
+    const depth = 1 + Math.max(0, ...callees.get(name)!.map(run));
+    visiting.delete(name);
+    longest.set(name, depth);
+    return depth;
+  };
+  for (const f of mod.functions) expect(run(f.name)).toBeLessThanOrEqual(32);
+  // fn0 breaks both ring cycles, fn33 and fn66 bound the run along the
+  // ring, and two of a, b and c break their four cycles.
+  expect([...checks].sort()).toEqual(["a", "b", "fn0", "fn33", "fn66"]);
+});
+
 test("class members are reachable from reentrant operations", () => {
   const mod: IrModule = {
     ...moduleWith(

packages/compiler/src/backend/may-throw.ts

@@ -37,7 +37,11 @@ export type MayThrowReason =
 export function computeMayThrow(
   mod: IrModule,
   options: {
-    stackChecks?: boolean;
+    /** Native stack checks: true for the functions that check on entry (one
+     * per call cycle, see stackCheckedFunctions); "everyCycleMember" for a
+     * model in which every function on a cycle checks, which answers a
+     * superset that does not depend on that choice. */
+    stackChecks?: boolean | "everyCycleMember";
     explain?: boolean;
     /** computePublishedTypes(mod), when the caller already has it. */
     published?: ReturnType<typeof computePublishedTypes>;
@@ -56,8 +60,16 @@ export function computeMayThrow(
   stackChecks?: Set<string>;
 } {
   const terminations = mod.workers === true ? workerTerminationPolls(mod, options.nodes) : null;
+  const stackGraph =
+    options.stackChecks === undefined || options.stackChecks === false
+      ? null
+      : stackCheckGraph(mod, options.nodes);
   const stackChecks =
-    options.stackChecks === true ? stackCheckedFunctions(mod, options.nodes) : null;
+    stackGraph === null
+      ? null
+      : options.stackChecks === "everyCycleMember"
+        ? stackGraph.cyclic
+        : cycleGuards(stackGraph);
   // Stores that can reach a published object throw the frozen TypeError.
   const published =
     options.published !== undefined ? options.published : computePublishedTypes(mod);
@@ -488,7 +500,9 @@ export function computeMayThrow(
     fns: may,
     ...(why !== null ? { why } : {}),
     indirect,
-    ...(terminations ? { workerEntryPolls: entryPolls(mod, terminations.entry, stackChecks) } : {}),
+    ...(terminations
+      ? { workerEntryPolls: entryPolls(mod, terminations.entry, stackGraph?.cyclic ?? null, may) }
+      : {}),
     ...(stackChecks ? { stackChecks } : {}),
   };
 }
@@ -720,28 +734,32 @@ function describeThrowingNode(rec: IrExpr | IrStmt): string {
 }
 
 /** The termination polls a worker program places on function entry. A
- * stack-checked synchronous function needs none: it may throw (the stack
- * guard seeds the fixpoint), so every caller tests the pending state after
- * the call, and a descent that never returns ends at the stack guard, whose
- * RangeError unwinds through those tests. An outstanding terminate request
- * keeps the alert word nonzero, so the first test that runs afterwards (a
- * post-call test, a loop poll or the unwinding) stops the thread; dropping
- * the entry poll only delays the stop by bounded work, which Node's
- * asynchronous terminate allows. The entry poll's slow path rejoins the
- * body, so every polled function kept its arguments live across a call. */
+ * synchronous function on a call cycle that may throw needs none: every
+ * caller tests the pending state after the call, and a descent that never
+ * returns passes a stack-checked function of each cycle again and again
+ * (stackCheckedFunctions) and ends at its guard, whose RangeError unwinds
+ * through those tests. An outstanding terminate request keeps the alert word
+ * nonzero, so the first test that runs afterwards (a post-call test, a loop
+ * poll or the unwinding) stops the thread; dropping the entry poll only
+ * delays the stop by bounded work, which Node's asynchronous terminate
+ * allows. The entry poll's slow path rejoins the body, so every polled
+ * function kept its arguments live across a call. */
 function entryPolls(
   mod: IrModule,
   entry: Set<string>,
-  stackChecks: Set<string> | null,
+  cyclic: Set<string> | null,
+  may: Set<string>,
 ): Set<string> {
-  if (stackChecks === null) return entry;
+  if (cyclic === null) return entry;
   // Calling an async or generator function never tests the caller's pending
   // state, and the module entry has no caller: those keep their polls.
   const keep = new Set(
     mod.functions.filter((fn) => fn.async || fn.generator !== undefined).map((fn) => fn.name),
   );
   keep.add(mod.entry);
-  return new Set([...entry].filter((name) => keep.has(name) || !stackChecks.has(name)));
+  return new Set(
+    [...entry].filter((name) => keep.has(name) || !cyclic.has(name) || !may.has(name)),
+  );
 }
 
 /** Statement and expression kinds that cannot reenter scriptc code except
@@ -971,16 +989,31 @@ export function workerTerminationPolls(
   return { entry, polls };
 }
 
-/** The functions that can take part in unbounded recursion, which check the
- * native stack guard on entry: every function on a cycle of the call graph.
- * Direct edges are calls, constructions and virtual dispatch. A function
- * containing any operation that can reenter scriptc code other than through
- * those edges (an indirect call, a callback-taking or dynamic operation, a
- * library call; see boundedNode) also reaches every function that such an
- * operation can invoke: closure targets and class members. Non-recursive
- * functions, including leaf callbacks, stay check-free. */
+/** The call graph that bounds recursion, and the functions on its cycles:
+ * the ones that can take part in unbounded recursion. Direct edges are
+ * calls, constructions and virtual dispatch. A function containing any
+ * operation that can reenter scriptc code other than through those edges
+ * (an indirect call, a callback-taking or dynamic operation, a library call;
+ * see boundedNode) also reaches every function that such an operation can
+ * invoke: closure targets and class members, behind one shared `reentry`
+ * node. */
+interface StackCheckGraph {
+  edges: Map<string, string[]>;
+  cyclic: Set<string>;
+}
+
+const REENTRY = "\0reentry";
+
+/** The functions that check the native stack guard on entry: one function
+ * of every cycle of the call graph (stackCheckGraph), which bounds every
+ * unbounded recursion, since its frames repeat the cycle's guarded function
+ * again and again. Non-recursive functions, including leaf callbacks, stay
+ * check-free. See cycleGuards for the choice. */
 export function stackCheckedFunctions(mod: IrModule, nodes?: IrNodeIndex): Set<string> {
-  const reentry = "\0reentry";
+  return cycleGuards(stackCheckGraph(mod, nodes));
+}
+
+function stackCheckGraph(mod: IrModule, nodes?: IrNodeIndex): StackCheckGraph {
   const methodImpls = new Map<string, string[]>();
   const memberPrefixes = new Set<string>();
   for (const cls of mod.classes ?? []) {
@@ -1019,16 +1052,157 @@ export function stackCheckedFunctions(mod: IrModule, nodes?: IrNodeIndex): Set<s
     };
     eachNodeOfKinds(fn, scan, visit);
     const callees = out.filter((callee) => names.has(callee));
-    if (reenters) callees.push(reentry);
+    if (reenters) callees.push(REENTRY);
     edges.set(fn.name, callees);
   }
   edges.set(
-    reentry,
+    REENTRY,
     [...targets].filter((name) => names.has(name)),
   );
   const cyclic = cyclicFunctions(edges);
-  cyclic.delete(reentry);
-  return cyclic;
+  cyclic.delete(REENTRY);
+  return { edges, cyclic };
+}
+
+/** The longest run of calls between unchecked functions of a cycle that
+ * cycleGuards allows; deeper runs get a check. Acyclic call chains below a
+ * check are as deep as the program makes them already, so this keeps the
+ * stack used between two checks of the same order. */
+const MAX_UNCHECKED_CYCLE_RUN = 32;
+
+/** A small set of functions that meets every cycle of the stack-check graph
+ * (a feedback vertex set), chosen greedily: functions that cannot lie on a
+ * remaining cycle (no caller or no callee left among the candidates) drop
+ * out, a function that calls itself is chosen, and otherwise the function
+ * with the most caller-callee pairs, the one that breaks the most cycles,
+ * is chosen and removed; ties go to the earlier function. The reentry node
+ * is not a function and is never chosen. A last pass in topological order
+ * of the unchosen cycle functions adds a check where a run of them would
+ * exceed MAX_UNCHECKED_CYCLE_RUN calls. */
+function cycleGuards(graph: StackCheckGraph): Set<string> {
+  const { edges, cyclic } = graph;
+  const chosen = new Set<string>();
+  if (cyclic.size === 0) return chosen;
+  const order = new Map<string, number>();
+  const callees = new Map<string, Set<string>>();
+  const callers = new Map<string, Set<string>>();
+  const candidates = [...[...edges.keys()].filter((name) => cyclic.has(name)), REENTRY];
+  for (const name of candidates) {
+    order.set(name, order.size);
+    callees.set(name, new Set());
+    callers.set(name, new Set());
+  }
+  for (const name of candidates)
+    for (const callee of edges.get(name) ?? [])
+      if (callees.has(callee)) {
+        callees.get(name)!.add(callee);
+        callers.get(callee)!.add(name);
+      }
+  // Max-heap of [score, order, name]; an entry is stale once its function
+  // is gone or its score changed, and is skipped when popped.
+  const heap: [number, number, string][] = [];
+  const score = (name: string): number =>
+    name === REENTRY ? -1 : callers.get(name)!.size * callees.get(name)!.size;
+  const above = (x: [number, number, string], y: [number, number, string]): boolean =>
+    x[0] > y[0] || (x[0] === y[0] && x[1] < y[1]);
+  const push = (name: string): void => {
+    heap.push([score(name), order.get(name)!, name]);
+    for (let i = heap.length - 1; i > 0;) {
+      const parent = (i - 1) >> 1;
+      if (!above(heap[i]!, heap[parent]!)) break;
+      [heap[i], heap[parent]] = [heap[parent]!, heap[i]!];
+      i = parent;
+    }
+  };
+  const pop = (): [number, number, string] => {
+    const top = heap[0]!;
+    const last = heap.pop()!;
+    if (heap.length > 0) {
+      heap[0] = last;
+      for (let i = 0; ;) {
+        let best = i;
+        for (const child of [2 * i + 1, 2 * i + 2])
+          if (child < heap.length && above(heap[child]!, heap[best]!)) best = child;
+        if (best === i) break;
+        [heap[i], heap[best]] = [heap[best]!, heap[i]!];
+        i = best;
+      }
+    }
+    return top;
+  };
+  const doomed: string[] = [];
+  const remove = (name: string): void => {
+    const out = callees.get(name)!;
+    const into = callers.get(name)!;
+    callees.delete(name);
+    callers.delete(name);
+    for (const callee of out)
+      if (callee !== name) {
+        const set = callers.get(callee)!;
+        set.delete(name);
+        if (set.size === 0) doomed.push(callee);
+        else push(callee);
+      }
+    for (const caller of into)
+      if (caller !== name) {
+        const set = callees.get(caller)!;
+        set.delete(name);
+        if (set.size === 0) doomed.push(caller);
+        else push(caller);
+      }
+  };
+  // Removes the functions that can no longer lie on a cycle, transitively.
+  const settle = (): void => {
+    while (doomed.length > 0) {
+      const name = doomed.pop()!;
+      if (callees.has(name)) remove(name);
+    }
+  };
+  for (const name of candidates) {
+    if (callees.get(name)!.size === 0 || callers.get(name)!.size === 0) doomed.push(name);
+    else push(name);
+  }
+  settle();
+  for (const name of candidates)
+    if (callees.get(name)?.has(name) === true) {
+      chosen.add(name);
+      remove(name);
+      settle();
+    }
+  while (heap.length > 0) {
+    const [entryScore, , name] = pop();
+    if (!callees.has(name) || entryScore !== score(name) || name === REENTRY) continue;
+    chosen.add(name);
+    remove(name);
+    settle();
+  }
+  // Bound the runs of unchecked cycle functions (acyclic once the chosen
+  // ones are removed; the reentry node takes no frame): the longest run
+  // ending at each function, in topological order, and a check where it
+  // would grow too long.
+  const unchecked = candidates.filter((name) => !chosen.has(name));
+  const pending = new Map<string, number>(unchecked.map((name) => [name, 0]));
+  for (const name of unchecked)
+    for (const callee of new Set(edges.get(name)))
+      if (pending.has(callee)) pending.set(callee, pending.get(callee)! + 1);
+  const run = new Map<string, number>();
+  const ready = unchecked.filter((name) => pending.get(name) === 0);
+  for (let i = 0; i < ready.length; i++) {
+    const name = ready[i]!;
+    let depth = (run.get(name) ?? 0) + (name === REENTRY ? 0 : 1);
+    if (depth > MAX_UNCHECKED_CYCLE_RUN && name !== REENTRY) {
+      chosen.add(name);
+      depth = 0;
+    }
+    for (const callee of new Set(edges.get(name))) {
+      if (!pending.has(callee)) continue;
+      run.set(callee, Math.max(run.get(callee) ?? 0, depth));
+      const left = pending.get(callee)! - 1;
+      pending.set(callee, left);
+      if (left === 0) ready.push(callee);
+    }
+  }
+  return chosen;
 }
 
 /** Functions on a cycle of the call graph (Tarjan's strongly connected

packages/compiler/src/backend/native-toolchain.test.ts

@@ -630,20 +630,27 @@ test.skipIf(clangExecutable === undefined)(
   async () => {
     // clang ships its x86 intrinsic headers (<emmintrin.h>, ...) for every
     // target, so __has_include finds them on arm64, where including them is
-    // an #error, and the same holds for the ARM headers on x86. The probe
-    // must guard them by target. Only the compiler's own freestanding
-    // headers are visible here, so the result does not depend on the host's
-    // C library.
+    // an #error, and the same holds for the ARM headers on x86 and for
+    // <riscv_vector.h> (zlib's RVV code) outside RISC-V with the vector
+    // extension. The probe must guard them by target. Only the compiler's own
+    // freestanding headers are visible here, so the result does not depend on
+    // the host's C library.
     const includes = (await implicitDependencyProbeIncludes(runtimeSrcDir())).filter(
       (include) =>
-        include !== "<intrin.h>" && /intrin\.h>$|^<cpuid\.h>$|^<arm_(neon|acle)\.h>$/.test(include),
+        include !== "<intrin.h>" &&
+        /intrin\.h>$|^<cpuid\.h>$|^<arm_(neon|acle)\.h>$|^<riscv_vector\.h>$/.test(include),
     );
     expect(includes).toContain("<emmintrin.h>");
+    expect(includes).toContain("<riscv_vector.h>");
     const resourceDir = execFileSync(clangExecutable!, ["-print-resource-dir"], {
       encoding: "utf8",
     }).trim();
     const source = includes.map(implicitDependencyIncludeDirective).join("");
-    for (const target of ["aarch64-unknown-linux-gnu", "x86_64-unknown-linux-gnu"]) {
+    for (const target of [
+      "aarch64-unknown-linux-gnu",
+      "riscv64-unknown-linux-gnu",
+      "x86_64-unknown-linux-gnu",
+    ]) {
       const result = spawnSync(
         clangExecutable!,
         [

packages/compiler/src/backend/native/compiler-fingerprint.ts

@@ -207,7 +207,8 @@ function x86OnlyHeader(include: string): boolean {
 
 /** One guarded line of the implicit-toolchain probe source: the header is
  * included only when the compiler can find it and it belongs to the target
- * being probed. */
+ * being probed. clang ships <riscv_vector.h> for every target, and through
+ * clang 18 including it without the RISC-V vector extension is an #error. */
 export function implicitDependencyIncludeDirective(include: string): string {
   const targetCondition = x86OnlyHeader(include)
     ? " && (defined(__i386__) || defined(__x86_64__) || defined(_M_IX86) || defined(_M_X64))"
@@ -215,7 +216,9 @@ export function implicitDependencyIncludeDirective(include: string): string {
       ? " && defined(_WIN32)"
       : include === "<arm64_neon.h>" || include === "<arm_acle.h>" || include === "<arm_neon.h>"
         ? " && (defined(__arm__) || defined(__aarch64__) || defined(_M_ARM) || defined(_M_ARM64))"
-        : "";
+        : include === "<riscv_vector.h>"
+          ? " && defined(__riscv_vector)"
+          : "";
   return `#if __has_include(${include})${targetCondition}\n#include ${include}\n#endif\n`;
 }
 

packages/compiler/src/backend/native/runtime-inputs.ts

@@ -70,6 +70,7 @@ export const EXECUTABLE_RUNTIME_SOURCES = [
   "scr_cycle.c",
   "scr_publish.c",
   "scr_region.c",
+  "scr_arena.c",
   "scr_itable.c",
   "scr_slots.c",
   "scr_alloc.c",

packages/compiler/src/contracts/check.ts

@@ -519,8 +519,10 @@ class ContractChecker {
           for (const fn of this.fnByLoc.get(key) ?? []) targets.push({ fn, note });
     if (targets.length === 0) return;
     // Target-independent: the native stack guard (Linux, macOS) counts, so a
-    // contract holds on every platform.
-    const mt = computeMayThrow(this.mod, { stackChecks: true, explain: true });
+    // contract holds on every platform. Every function on a call cycle counts
+    // as checking it, a superset of the functions the backend picks, so the
+    // answer does not depend on that choice.
+    const mt = computeMayThrow(this.mod, { stackChecks: "everyCycleMember", explain: true });
     const proven: string[] = [];
     for (const { fn, note } of targets) {
       if (fn.async === true || fn.generator !== undefined) {
@@ -1582,6 +1584,15 @@ class ImmutableContracts {
     for (let steps = 0; steps < 16; steps++) {
       if (root.kind === "fieldGet" || root.kind === "recordGet") root = root.obj;
       else if (root.kind === "arrayGet") root = root.arr;
+      else if (root.kind === "seqExpr") root = root.result;
+      // A receiver that is the element when it is present and otherwise
+      // throws (`xs[i]!.push(v)`) is that element read.
+      else if (
+        root.kind === "ternary" &&
+        root.else_.kind === "libCall" &&
+        root.else_.fn === "error.nodeThrow"
+      )
+        root = root.then;
       else if (
         root.kind === "upcast" ||
         root.kind === "downcast" ||

packages/compiler/src/frontend/lowering/expressions/binary.ts

@@ -37,6 +37,7 @@ import {
   dynCompoundValue,
   lowerAbsenceProbe,
   lowerDynMemberAssignment,
+  lowerDereferencedElementAssignment,
   lowerOptionalNumber,
   lowerPresenceOperand,
   nullishBranches,
@@ -334,6 +335,25 @@ function isMemberReceiver(node: ts.Expression): boolean {
   );
 }
 
+/** A literal default (`0`, `-1`, `""`, `true`): it always has its own type.
+ * Other defaults, such as an element read that can be undefined, keep the
+ * dynamic path. */
+function literalDefault(node: ts.Expression): boolean {
+  while (ts.isParenthesizedExpression(node)) node = node.expression;
+  if (
+    ts.isPrefixUnaryExpression(node) &&
+    (node.operator === ts.SyntaxKind.MinusToken || node.operator === ts.SyntaxKind.PlusToken)
+  )
+    node = node.operand;
+  return (
+    ts.isNumericLiteral(node) ||
+    ts.isStringLiteral(node) ||
+    ts.isNoSubstitutionTemplateLiteral(node) ||
+    node.kind === ts.SyntaxKind.TrueKeyword ||
+    node.kind === ts.SyntaxKind.FalseKeyword
+  );
+}
+
 export function lowerNullishPair(
   lowerer: Lowerer,
   expr: ts.BinaryExpression,
@@ -388,6 +408,26 @@ export function lowerNullishPair(
     lowerer.runtimeOptionalArithmeticTypes.set(expr, type);
   }
   if (type.kind === "dyn" && lowerer.dynConvertible(left.type)) {
+    // `counts.get(k) ?? 0` in JavaScript: a scalar optional left and a
+    // default of its value's type give a scalar, so the test and the default
+    // run on the typed path and only the result converts. Converting the
+    // optional left itself would allocate a union for every read.
+    if (
+      rest.length === 1 &&
+      primitive(rest[0]!) &&
+      rightType &&
+      typeEquals(rightType, rest[0]!) &&
+      literalDefault(expr.right)
+    ) {
+      const typed: IrExpr = {
+        kind: "nullish",
+        left,
+        right: lowerer.lowerExprExpecting(expr.right, rest[0]!),
+        type: rest[0]!,
+        loc,
+      };
+      return lowerer.coerceToExpected(typed, DYN);
+    }
     return {
       kind: "nullish",
       left: lowerer.coerceToExpected(left, DYN),
@@ -1029,6 +1069,8 @@ export function lowerBinary(lowerer: Lowerer, expr: ts.BinaryExpression): IrExpr
       if (prototypeWrite) return prototypeWrite;
       const callableWrite = lowerNativeFunctionAssignment(lowerer, expr);
       if (callableWrite) return callableWrite;
+      const dereferenced = lowerDereferencedElementAssignment(lowerer, expr);
+      if (dereferenced) return dereferenced;
     }
     if (
       op === ts.SyntaxKind.QuestionQuestionEqualsToken ||

packages/compiler/src/frontend/lowering/generator-dynamic-dispatch.ts

@@ -1,7 +1,8 @@
-import { dynUndefinedExpr, varRef } from "../../ir/build.js";
+import { dynUndefinedExpr, numLit, varRef } from "../../ir/build.js";
 import {
   BOOL,
   DYN,
+  F64,
   STRING,
   canConvertToDyn,
   funcOf,
@@ -16,7 +17,7 @@ import {
 import { transformStmtList } from "../../ir/traverse.js";
 import { genResultRecord } from "../type-mapper.js";
 import type { DispatchSites } from "./dispatch-sites.js";
-import type { Lowerer } from "./lowerer.js";
+import type { Lowerer, UntypedLoopSite } from "./lowerer.js";
 
 type GeneratorType = Extract<IrType, { kind: "generator" }>;
 type Invoke = Extract<IrExpr, { kind: "dynInvoke" }>;
@@ -401,6 +402,310 @@ export class GeneratorDynamicDispatch {
         });
         changed = true;
       }
+    return this.stepUntypedLoops(lowerer, functions) || changed;
+  }
+
+  /** The generator types a loop over an untyped iterable can step natively:
+   * sync generators for `for … of`, and both kinds for `for await` (a sync
+   * generator through the async-from-sync rules). Insertion order, so a
+   * type keeps its index as later waves add types. */
+  private loopTypes(lowerer: Lowerer, site: UntypedLoopSite): [string, GeneratorType][] {
+    const out: [string, GeneratorType][] = [];
+    for (const [key, type] of this.generators) {
+      if (type.async === true && !site.async) continue;
+      const result = genResultRecord(type.yieldT, type.retT, lowerer.shapes, lowerer.unions);
+      if (result === null) continue;
+      // next() with no argument, as the protocol calls it.
+      const channel = type.nextT;
+      if (channel.kind !== "undefinedT" && channel.kind !== "void" && channel.kind !== "dyn")
+        continue;
+      if (
+        !canConvertToDyn(
+          result,
+          (id) => lowerer.shapes.get(id),
+          (id) => lowerer.unions.get(id),
+        )
+      )
+        continue;
+      out.push([key, type]);
+    }
+    return out;
+  }
+
+  /** Loops over untyped iterables step the program's own generators on the
+   * typed path. Once the loop has its iterator and next method, a kind local
+   * records which generator type the iterator is, when its next method is
+   * the generator's own (`%dyn.generator.method.next`); each step then
+   * resumes the generator directly and boxes only the value, where the
+   * protocol would box the result record and its promise and read them
+   * back. Every other iterator, and every early exit (return() through the
+   * protocol), keeps the dynamic path. The awaits are the protocol's: a
+   * `for await` over an async generator awaits next()'s promise, and over a
+   * sync generator awaits once for the result and, reached through
+   * Symbol.iterator, once for the value. */
+  private stepUntypedLoops(lowerer: Lowerer, functions: readonly IrFunction[]): boolean {
+    if (this.generators.size === 0 || lowerer.untypedLoops.size === 0) return false;
+    // The loop reads next through the getter only once it exists.
+    if (!this.properties.has("next")) return false;
+    let changed = false;
+    for (const fn of functions) {
+      if (this.generated.has(fn)) continue;
+      const byKind = new Map<string, UntypedLoopSite>();
+      const byValue = new Map<string, UntypedLoopSite>();
+      for (const local of fn.locals) {
+        const site = lowerer.untypedLoops.get(local);
+        if (site === undefined) continue;
+        byKind.set(site.kind, site);
+        byValue.set(site.value, site);
+      }
+      if (byKind.size === 0) continue;
+      fn.body = transformStmtList(fn.body, {
+        expr: (expr) => expr,
+        stmt: (stmt) => {
+          if (stmt.kind !== "varDecl" || stmt.init === null) return stmt;
+          const opened = byKind.get(stmt.localId);
+          if (opened !== undefined) {
+            const types = this.loopTypes(lowerer, opened);
+            const init = this.loopKind(opened, types, stmt.loc);
+            if (this.loopKindCount(stmt.init) === types.length) return stmt;
+            changed = true;
+            return { ...stmt, init };
+          }
+          const site = byValue.get(stmt.localId);
+          if (site === undefined) return stmt;
+          const types = this.loopTypes(lowerer, site);
+          // The protocol step is the innermost else of the type chain.
+          let fallback = stmt.init;
+          let present = 0;
+          while (
+            fallback.kind === "ternary" &&
+            fallback.cond.kind === "bin" &&
+            fallback.cond.left.kind === "varRef" &&
+            fallback.cond.left.localId === site.kind
+          ) {
+            fallback = fallback.else_;
+            present++;
+          }
+          if (present === types.length) return stmt;
+          let init = fallback;
+          for (let i = types.length - 1; i >= 0; i--) {
+            const [, type] = types[i]!;
+            const record = `${site.kind}.r${i + 1}`;
+            init = {
+              kind: "ternary",
+              cond: {
+                kind: "bin",
+                op: "===",
+                left: varRef(site.kind, F64, stmt.loc),
+                right: numLit(i + 1, stmt.loc),
+                type: BOOL,
+                loc: stmt.loc,
+              },
+              then: this.loopStep(lowerer, fn, site, type, record, stmt.loc),
+              else_: init,
+              type: DYN,
+              loc: stmt.loc,
+            };
+          }
+          changed = true;
+          return { ...stmt, init };
+        },
+      });
+    }
     return changed;
   }
+
+  /** How many generator types a loop's kind initializer tests: the chain
+   * inside its own-method test (loopKind). */
+  private loopKindCount(init: IrExpr): number {
+    if (init.kind !== "ternary") return 0;
+    let count = 0;
+    for (let chain = init.then; chain.kind === "ternary"; chain = chain.else_) count++;
+    return count;
+  }
+
+  /** The loop's kind: the 1-based index of the generator type its iterator
+   * is, when the next method it read is that generator's own, else 0. */
+  private loopKind(
+    site: UntypedLoopSite,
+    types: readonly [string, GeneratorType][],
+    loc: IrExpr["loc"],
+  ): IrExpr {
+    const own: IrExpr = {
+      kind: "libCall",
+      fn: "dyn.sameValue",
+      args: [
+        varRef(site.next, DYN, loc),
+        {
+          kind: "dynFrom",
+          value: {
+            kind: "closure",
+            fnName: "%dyn.generator.method.next",
+            captures: [],
+            type: funcOf([DYN], DYN),
+            loc,
+          },
+          type: DYN,
+          loc,
+        },
+      ],
+      type: BOOL,
+      loc,
+    };
+    let kind: IrExpr = numLit(0, loc);
+    for (let i = types.length - 1; i >= 0; i--)
+      kind = {
+        kind: "ternary",
+        cond: {
+          kind: "libCall",
+          fn: "dyn.typedRefIs",
+          args: [
+            varRef(site.iterator, DYN, loc),
+            { kind: "strLit", value: types[i]![0], type: STRING, loc },
+          ],
+          type: BOOL,
+          loc,
+        },
+        then: numLit(i + 1, loc),
+        else_: kind,
+        type: F64,
+        loc,
+      };
+    return types.length === 0
+      ? kind
+      : { kind: "ternary", cond: own, then: kind, else_: numLit(0, loc), type: F64, loc };
+  }
+
+  /** One step of a loop over an untyped iterable that is a `type`
+   * generator: sets the loop's done flag and answers the value, boxed. */
+  private loopStep(
+    lowerer: Lowerer,
+    fn: IrFunction,
+    site: UntypedLoopSite,
+    type: GeneratorType,
+    recordId: string,
+    loc: IrExpr["loc"],
+  ): IrExpr {
+    const gen: IrExpr = { kind: "dynCheck", value: varRef(site.iterator, DYN, loc), type, loc };
+    const setDone = (value: IrExpr): IrStmt => ({ kind: "assign", localId: site.done, value, loc });
+    const doneRef = varRef(site.done, BOOL, loc);
+    const result = genResultRecord(type.yieldT, type.retT, lowerer.shapes, lowerer.unions)!;
+    if (!fn.locals.some((local) => local.id === recordId))
+      fn.locals.push({ id: recordId, name: recordId, type: result, mutable: false });
+    const field = (name: "value" | "done", fieldType: IrType): IrExpr => ({
+      kind: "recordGet",
+      obj: varRef(recordId, result, loc),
+      shapeId: result.shapeId,
+      field: name,
+      type: fieldType,
+      loc,
+    });
+    const valueType = lowerer.shapes
+      .get(result.shapeId)!
+      .fields.find((f) => f.name === "value")!.type;
+    const boxed: IrExpr = { kind: "dynFrom", value: field("value", valueType), type: DYN, loc };
+    const awaitDyn = (value: IrExpr): IrExpr => ({
+      kind: "libCall",
+      fn: "async.awaitDyn",
+      args: [value],
+      type: DYN,
+      loc,
+    });
+    const resumed: IrExpr = {
+      kind: "genResume",
+      mode: "next",
+      gen,
+      arg: null,
+      type: type.async === true ? { kind: "promise", inner: result } : result,
+      loc,
+    };
+    if (!site.async)
+      return {
+        kind: "seqExpr",
+        stmts: [
+          { kind: "varDecl", localId: recordId, init: resumed, loc },
+          setDone(field("done", BOOL)),
+        ],
+        result: {
+          kind: "ternary",
+          cond: doneRef,
+          then: dynUndefinedExpr(loc),
+          else_: boxed,
+          type: DYN,
+          loc,
+        },
+        type: DYN,
+        loc,
+      };
+    if (type.async === true)
+      return {
+        kind: "seqExpr",
+        stmts: [
+          {
+            kind: "varDecl",
+            localId: recordId,
+            init: { kind: "awaitExpr", value: resumed, type: result, loc },
+            loc,
+          },
+          setDone(field("done", BOOL)),
+        ],
+        result: {
+          kind: "ternary",
+          cond: doneRef,
+          then: dynUndefinedExpr(loc),
+          else_: boxed,
+          type: DYN,
+          loc,
+        },
+        type: DYN,
+        loc,
+      };
+    // for await over a sync generator: the result awaits once. When the
+    // loop reached it through Symbol.iterator, the async-from-sync iterator
+    // also awaits the value (the final one too); a sync generator that an
+    // object's Symbol.asyncIterator returns passes the value as it is, as
+    // the protocol does.
+    const fromSync: IrExpr =
+      site.sync === null
+        ? { kind: "boolLit", value: false, type: BOOL, loc }
+        : varRef(site.sync, BOOL, loc);
+    return {
+      kind: "seqExpr",
+      stmts: [
+        { kind: "varDecl", localId: recordId, init: resumed, loc },
+        setDone(field("done", BOOL)),
+        { kind: "exprStmt", expr: awaitDyn(dynUndefinedExpr(loc)), loc },
+      ],
+      result: {
+        kind: "ternary",
+        cond: doneRef,
+        then: {
+          kind: "ternary",
+          cond: fromSync,
+          then: {
+            kind: "seqExpr",
+            stmts: [{ kind: "exprStmt", expr: awaitDyn(boxed), loc }],
+            result: dynUndefinedExpr(loc),
+            type: DYN,
+            loc,
+          },
+          else_: dynUndefinedExpr(loc),
+          type: DYN,
+          loc,
+        },
+        else_: {
+          kind: "ternary",
+          cond: fromSync,
+          then: awaitDyn(boxed),
+          else_: boxed,
+          type: DYN,
+          loc,
+        },
+        type: DYN,
+        loc,
+      },
+      type: DYN,
+      loc,
+    };
+  }
 }

packages/compiler/src/frontend/lowering/lower-exprs.ts

@@ -83,6 +83,8 @@ import { unitOnlyUnion } from "../type-mapper.js";
 import { lowerYield } from "./lower-generators.js";
 import { unionWideningTags } from "../../ir/analysis.js";
 import { isSafeToDiscard, isSafeToRepeat } from "./expressions/evaluation-safety.js";
+import { everyExprChild } from "../../ir/traverse.js";
+import { declareContextLocal } from "./function-context.js";
 import { hasOptionalChainGuard, isOptionalChainTail } from "./expressions/optional-chains.js";
 import { classToStringConversion, classUnionToString } from "./class-to-primitive.js";
 import { lowerCjsTopLevelThis, lowerRequireCacheElement } from "./lower-node-module.js";
@@ -413,6 +415,10 @@ function lowerExprInner(lowerer: Lowerer, expr: ts.Expression): IrExpr {
       const probe = lowerAbsenceProbe(lowerer, expr.expression);
       if (probe?.type.kind === "union") return probe;
     }
+    const dereferenced = dereferencedElementReceiver(lowerer, expr, loc);
+    if (dereferenced) return dereferenced;
+    const element = assertedElementOperand(lowerer, expr, loc);
+    if (element) return element;
     const inner = lowerer.lowerExpr(expr.expression);
     if (inner.type.kind === "union") {
       // `!` performs no runtime check: a missing array element stays
@@ -1075,18 +1081,10 @@ function assertionOperand(
   loc: SrcLoc,
 ): IrExpr | null {
   if (inner.type.kind !== "union" || target === null || target.kind === "union") return null;
-  const arms = lowerer.unions.get(inner.type.unionId)?.arms;
-  if (
-    !arms?.some(isUnitType) ||
-    !arms.every(
-      (arm) =>
-        arm.kind === "f64" || arm.kind === "string" || arm.kind === "bool" || isUnitType(arm),
-    )
-  )
-    return null;
-  // Array element reads keep their own handling of a missing element. A
-  // typed-array read is optional here only where its use tells undefined
-  // from NaN (assertedReadObservesUndefined).
+  if (!scalarUnion(lowerer, inner.type.unionId)) return null;
+  // Array element reads take assertedElementOperand or keep their own
+  // handling of a missing element. A typed-array read is optional here only
+  // where its use tells undefined from NaN (assertedReadObservesUndefined).
   let operand: ts.Expression = expr.expression;
   while (ts.isParenthesizedExpression(operand)) operand = operand.expression;
   if (ts.isElementAccessExpression(operand)) {
@@ -1095,19 +1093,489 @@ function assertionOperand(
   }
   const use = convertingUseOf(lowerer, expr);
   if (use === null) return null;
-  if (use === "value") return inner;
+  if (use === "value" || use === "string") return inner;
   return lowerPrimitiveUnionNumber(lowerer, inner, expr, loc);
 }
 
-/** How the converting use of `x!` (see assertionOperand) reads it:
- * "number" where the use applies ToNumber, "value" where the consumer
- * lowers the union itself (strings, equality, truthiness), null for other
+/** `xs[i]!` on an array as the operand of a converting use (see
+ * assertionOperand). The read answers undefined for a missing element, as
+ * in Node, instead of trapping: a numeric use reads NaN for it, and other
+ * uses get the optional element value. Returns null for other reads and
  * uses. */
-function convertingUseOf(lowerer: Lowerer, expr: ts.NonNullExpression): "number" | "value" | null {
+function assertedElementOperand(
+  lowerer: Lowerer,
+  expr: ts.NonNullExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  let read: ts.Expression = expr.expression;
+  while (ts.isParenthesizedExpression(read)) read = read.expression;
+  if (!ts.isElementAccessExpression(read) || read.questionDotToken) return null;
+  // Plain arrays only: regex match results and other array subtypes keep
+  // their own element reads.
+  const receiverType = lowerer.typeOf(read.expression);
+  if (
+    !lowerer.checker.isArrayType(receiverType) ||
+    lowerer.mapTypeOf(receiverType)?.kind !== "array"
+  )
+    return null;
+  // A counter below the length reads an existing index: the read keeps
+  // its plain element access.
+  if (lowerer.nanCodedReads?.counterIndexInBounds(read)) return null;
+  const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
+  if (!target || !isScalarArm(target)) return null;
+  const use = convertingUseOf(lowerer, expr);
+  if (use === null) return null;
+  if (use === "string" && target.kind === "string")
+    return stringElementOrUndefined(lowerer, read, loc);
+  const probe = lowerAbsenceProbe(lowerer, read);
+  if (probe?.type.kind !== "union" || !scalarUnion(lowerer, probe.type.unionId)) return null;
+  if (use === "value" || use === "string") return probe;
+  return lowerer.stripUndefinedArm(probe.type).kind === "f64"
+    ? lowerOptionalNumber(lowerer, probe, loc)
+    : lowerPrimitiveUnionNumber(lowerer, probe, expr, loc);
+}
+
+/** `xs[i]!` on an array as the receiver of a member read
+ * (`xs[i]!.name`, `xs[i]!.size()`, `xs[i]![0]`). `!` performs no runtime
+ * check, so a missing element is undefined there and the member access
+ * throws Node's TypeError ("Cannot read properties of undefined (reading
+ * 'name')") instead of the bounds trap. The receiver is the element when it
+ * is present. A write (`xs[i]!.name = v`) is lowered as a statement by
+ * lowerDereferencedElementWrite, which evaluates the value before the
+ * receiver throws; elsewhere it keeps the bounds trap. Returns null for
+ * other reads and uses. */
+function dereferencedElementReceiver(
+  lowerer: Lowerer,
+  expr: ts.NonNullExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  const use = runtimeOptionalUseOf(expr);
+  if (!use || isAssignmentTarget(use.access)) return null;
+  const parts = dereferencedElementParts(lowerer, expr, loc, false);
+  if (parts?.message == null) return null;
+  const message = parts.message;
+  const value: IrExpr = {
+    kind: "ternary",
+    cond: parts.present,
+    then: parts.element,
+    else_: nodeTypeError(message, parts.element.type, loc),
+    type: parts.element.type,
+    loc,
+  };
+  return parts.stmts.length === 0
+    ? value
+    : { kind: "seqExpr", stmts: parts.stmts, result: value, type: value.type, loc };
+}
+
+/** The parts of a member access through `xs[i]!` (see
+ * dereferencedElementReceiver): statements that evaluate the array and the
+ * index, whether the element is present, the element read, and Node's
+ * TypeError message for a missing one. A `write` holds its key, so its
+ * message may be left for dereferencedElementWrite to build from the key. */
+export function dereferencedElementParts(
+  lowerer: Lowerer,
+  expr: ts.NonNullExpression,
+  loc: SrcLoc,
+  write: boolean,
+): { stmts: IrStmt[]; present: IrExpr; element: IrExpr; message: IrExpr | null } | null {
+  let read: ts.Expression = expr.expression;
+  while (ts.isParenthesizedExpression(read)) read = read.expression;
+  if (!ts.isElementAccessExpression(read) || read.questionDotToken) return null;
+  const receiverType = lowerer.typeOf(read.expression);
+  if (
+    !lowerer.checker.isArrayType(receiverType) ||
+    lowerer.mapTypeOf(receiverType)?.kind !== "array"
+  )
+    return null;
+  if (lowerer.nanCodedReads?.counterIndexInBounds(read)) return null;
+  const use = runtimeOptionalUseOf(expr);
+  if (!use || use.optional || use.complex || use.comma || use.kind === "call") return null;
+  // A write holds its key, so the message can name any number or string
+  // key (dereferencedElementWrite builds it).
+  const message =
+    memberAccessMessage(lowerer, use.access) ??
+    (write && ts.isElementAccessExpression(use.access) && namedKey(lowerer, use.access)
+      ? null
+      : undefined);
+  if (message === undefined) return null;
+  if (lowerer.mapTypeOf(lowerer.typeOf(read.argumentExpression))?.kind !== "f64") return null;
+  // The element must already have the asserted type: an element union the
+  // assertion or a guard narrows keeps its checked narrow.
+  const target = lowerer.mapTypeOf(lowerer.typeOf(expr));
+  const declared = lowerer.mapTypeOf(receiverType);
+  if (
+    !target ||
+    declared?.kind !== "array" ||
+    declared.elem.kind === "void" ||
+    !typeEquals(declared.elem, target)
+  )
+    return null;
+  const arr = lowerer.lowerExpr(read.expression);
+  if (arr.type.kind !== "array" || !typeEquals(arr.type.elem, target)) return null;
+  const elem = arr.type.elem;
+  const index = lowerer.lowerExprExpecting(read.argumentExpression, F64);
+  // Plain reads (a local, a field of one) evaluate once more instead of
+  // through a hidden local: the receiver then stays a borrowed element
+  // read, like the plain `xs[i]` it replaces. An index that can assign
+  // can replace the array binding or field (`xs[(xs = other, 0)]!`), so the
+  // array is held before it, as JavaScript reads it first.
+  const stmts: IrStmt[] = [];
+  const plain = (value: IrExpr): boolean => isSafeToRepeat(value) || plainProjection(value);
+  const held = (value: IrExpr, name: string): IrExpr => {
+    const tmp = lowerer.declareHiddenLocal(name, value.type);
+    stmts.push({ kind: "varDecl", localId: tmp.id, init: value, loc });
+    return varRef(tmp.id, value.type, loc);
+  };
+  const a = !mayAssign(index) && plain(arr) ? arr : held(arr, "%elementArray");
+  const i = plain(index) ? index : held(index, "%elementIndex");
+  return {
+    stmts,
+    present: {
+      kind: "bin",
+      op: "===",
+      left: { kind: "arrayState", arr: a, index: i, type: F64, loc },
+      right: numLit(1, loc),
+      type: BOOL,
+      loc,
+    },
+    element: { kind: "arrayGet", arr: a, index: i, type: elem, loc },
+    message,
+  };
+}
+
+/** A write through `xs[i]!` (`xs[i]!.name = v`, `xs[i]![k] = v`): as in
+ * Node, the array, the index, the key and the value evaluate in order (the
+ * statements), then a missing element makes the write throw Node's
+ * TypeError and a present one takes the write, which reads the element,
+ * the key and the value through `overrides`. Null for other targets. */
+export function dereferencedElementWrite(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+): {
+  stmts: IrStmt[];
+  present: IrExpr;
+  message: IrExpr;
+  overrides: { node: ts.Expression; value: IrExpr }[];
+} | null {
+  if (expr.operatorToken.kind !== ts.SyntaxKind.EqualsToken) return null;
+  const target = expr.left;
+  if (
+    !(ts.isPropertyAccessExpression(target) || ts.isElementAccessExpression(target)) ||
+    target.questionDotToken ||
+    lowerer.chainRecvByNode.has(target.expression)
+  )
+    return null;
+  let receiver: ts.Expression = target.expression;
+  while (ts.isParenthesizedExpression(receiver)) receiver = receiver.expression;
+  if (!ts.isNonNullExpression(receiver)) return null;
+  const loc = locOf(expr);
+  const keyValue = ts.isElementAccessExpression(target)
+    ? lowerer.lowerExpr(target.argumentExpression)
+    : null;
+  const rightValue = lowerer.lowerExpr(expr.right);
+  const parts = dereferencedElementParts(lowerer, receiver, loc, true);
+  if (parts === null) return null;
+  const stmts = [...parts.stmts];
+  let present = parts.present;
+  let element = parts.element;
+  // JavaScript reads the element before the key and the value. When either
+  // has an effect, which can replace, remove or add the element, its
+  // presence and value are read first; otherwise the write tests and reads
+  // it after them.
+  if (!unobservable(rightValue) || (keyValue !== null && !unobservable(keyValue))) {
+    const presentLocal = lowerer.declareHiddenLocal("%elementPresent", BOOL);
+    // Assigned only when the element is present.
+    const elementLocal = declareContextLocal(
+      lowerer.ctx,
+      "%elementValue",
+      element.type,
+      true,
+      undefined,
+      undefined,
+    );
+    stmts.push(
+      { kind: "varDecl", localId: presentLocal.id, init: present, loc },
+      { kind: "varDecl", localId: elementLocal.id, init: null, loc },
+    );
+    present = varRef(presentLocal.id, BOOL, loc);
+    stmts.push({
+      kind: "if",
+      cond: present,
+      then: [{ kind: "assign", localId: elementLocal.id, value: element, loc }],
+      else_: null,
+      loc,
+    });
+    element = varRef(elementLocal.id, element.type, loc);
+  }
+  const overrides: { node: ts.Expression; value: IrExpr }[] = [];
+  // The write lowers the node with or without its parentheses.
+  const override = (node: ts.Expression, value: IrExpr): void => {
+    for (let n: ts.Expression = node; ; n = n.expression) {
+      overrides.push({ node: n, value });
+      if (!ts.isParenthesizedExpression(n)) break;
+    }
+  };
+  const held = (value: IrExpr, name: string, inline: boolean): IrExpr => {
+    if (inline) return value;
+    // A call without a result evaluates to undefined.
+    if (value.type.kind === "void") {
+      stmts.push({ kind: "exprStmt", expr: value, loc });
+      return { kind: "unitLit", unit: "undefined", type: UNDEFINED_T, loc };
+    }
+    const tmp = lowerer.declareHiddenLocal(name, value.type);
+    stmts.push({ kind: "varDecl", localId: tmp.id, init: value, loc });
+    return varRef(tmp.id, value.type, loc);
+  };
+  override(target.expression, element);
+  let message = parts.message;
+  if (ts.isElementAccessExpression(target) && keyValue !== null) {
+    // The key evaluates before the value, which can assign the binding or
+    // field it reads; a literal, or an unobservable key the value cannot
+    // change, may evaluate in the write.
+    const key = held(
+      keyValue,
+      "%elementWriteKey",
+      keyValue.kind === "numLit" ||
+        keyValue.kind === "strLit" ||
+        (unobservable(keyValue) && !mayAssign(rightValue)),
+    );
+    override(target.argumentExpression, key);
+    // The message names the key's value as the write evaluated it.
+    if (key !== keyValue || message === null)
+      message = keyMessage(messageHead(target), key, loc) ?? message;
+  }
+  // A value whose evaluation is unobservable may evaluate in the write
+  // itself, after the element is tested.
+  override(
+    expr.right,
+    held(rightValue, "%elementWriteValue", isSafeToRepeat(rightValue) || unobservable(rightValue)),
+  );
+  if (message === null) return null;
+  return { stmts, present, message, overrides };
+}
+
+/** dereferencedElementWrite in value position (`f(xs[i]!.name = v)`). */
+export function lowerDereferencedElementAssignment(
+  lowerer: Lowerer,
+  expr: ts.BinaryExpression,
+): IrExpr | null {
+  const write = dereferencedElementWrite(lowerer, expr);
+  if (write === null) return null;
+  const loc = locOf(expr);
+  const value = lowerer.withExpressionOverrides(write.overrides, () => lowerer.lowerExpr(expr));
+  return {
+    kind: "seqExpr",
+    stmts: write.stmts,
+    result: {
+      kind: "ternary",
+      cond: write.present,
+      then: value,
+      else_: nodeTypeError(write.message, value.type, loc),
+      type: value.type,
+      loc,
+    },
+    type: value.type,
+    loc,
+  };
+}
+
+/** Whether evaluating `e` has no effect and cannot throw: a discardable
+ * expression, or the compiler's element-or-undefined read of one. */
+function unobservable(e: IrExpr): boolean {
+  if (e.kind === "call" && e.callee.startsWith("%arr.idxOr.")) return e.args.every(unobservable);
+  return isSafeToDiscard(e);
+}
+
+/** Whether evaluating `e` can assign a binding or a field: it contains an
+ * assignment, an increment, statements, a suspension, or a call that can
+ * run program code (a library call only through a function it is given). */
+function mayAssign(e: IrExpr): boolean {
+  switch (e.kind) {
+    case "call":
+      // The compiler's element-or-undefined read and union narrows run no
+      // program code.
+      if (!e.callee.startsWith("%arr.idxOr.") && !e.callee.startsWith("%union.narrow."))
+        return true;
+      break;
+    case "assignExpr":
+    case "incDec":
+    case "seqExpr":
+    case "callValue":
+    case "virtualCall":
+    case "dynCall":
+    case "dynInvoke":
+    case "ffiCall":
+    case "new":
+    case "newValue":
+    case "awaitExpr":
+    case "awaitUnionExpr":
+    case "yieldExpr":
+      return true;
+    case "closure":
+      return false;
+    case "libCall":
+      if (e.args.some((arg) => arg.type.kind === "func")) return true;
+      break;
+  }
+  return !everyExprChild(
+    e,
+    (child) => !mayAssign(child),
+    () => false,
+  );
+}
+
+/** Node's TypeError, thrown in place of a value of `type`. */
+export function nodeTypeError(message: IrExpr, type: IrType, loc: SrcLoc): IrExpr {
+  return {
+    kind: "libCall",
+    fn: "error.nodeThrow",
+    args: [numLit(1, loc), strLit("", loc), message],
+    type,
+    loc,
+  };
+}
+
+/** Whether `access` is the target of `=`. */
+function isAssignmentTarget(access: ts.Expression): boolean {
+  let outer: ts.Expression = access;
+  while (ts.isParenthesizedExpression(outer.parent)) outer = outer.parent;
+  const parent = outer.parent;
+  return (
+    ts.isBinaryExpression(parent) &&
+    parent.left === outer &&
+    parent.operatorToken.kind === ts.SyntaxKind.EqualsToken
+  );
+}
+
+/** A local, a number literal, or a field or record member read through a
+ * local: reading it again has no effect and yields the same value. */
+function plainProjection(e: IrExpr): boolean {
+  if (e.kind === "varRef" || e.kind === "numLit") return true;
+  return (e.kind === "fieldGet" || e.kind === "recordGet") && plainProjection(e.obj);
+}
+
+/** Node's TypeError message for a member access on undefined: reading the
+ * member, or setting it when the access is the target of `=`. Null when
+ * the key is not a name, a literal, or a plain read of a number or string
+ * (which the message reads a second time). */
+function memberAccessMessage(
+  lowerer: Lowerer,
+  access: ts.PropertyAccessExpression | ts.ElementAccessExpression | ts.CallExpression,
+): IrExpr | null {
+  const head = messageHead(access);
+  const loc = locOf(access);
+  if (ts.isPropertyAccessExpression(access)) {
+    if (ts.isPrivateIdentifier(access.name)) return null;
+    return strLit(`${head}${access.name.text}')`, loc);
+  }
+  if (!ts.isElementAccessExpression(access)) return null;
+  const key = runtimeOptionalElementKey(access.argumentExpression);
+  if (key !== null) return strLit(`${head}${key}')`, loc);
+  let keyNode = access.argumentExpression;
+  while (ts.isParenthesizedExpression(keyNode)) keyNode = keyNode.expression;
+  if (!ts.isIdentifier(keyNode)) return null;
+  const keyType = lowerer.mapTypeOf(lowerer.typeOf(keyNode))?.kind;
+  if (keyType !== "f64" && keyType !== "string") return null;
+  const keyValue = lowerer.lowerExpr(keyNode);
+  if (!isSafeToRepeat(keyValue) || keyValue.type.kind !== keyType) return null;
+  return keyMessage(head, keyValue, loc);
+}
+
+/** The start of Node's TypeError message for a member access on undefined:
+ * setting the member when the access is the target of `=`, else reading
+ * it. */
+function messageHead(access: ts.Expression): string {
+  return isAssignmentTarget(access)
+    ? "Cannot set properties of undefined (setting '"
+    : "Cannot read properties of undefined (reading '";
+}
+
+/** Whether `access`'s key is typed a number or a string, which the message
+ * can name from its value. */
+function namedKey(lowerer: Lowerer, access: ts.ElementAccessExpression): boolean {
+  const kind = lowerer.mapTypeOf(lowerer.typeOf(access.argumentExpression))?.kind;
+  return kind === "f64" || kind === "string";
+}
+
+/** The message naming a key from its value (a number or a string), or null
+ * for another type. */
+function keyMessage(head: string, key: IrExpr, loc: SrcLoc): IrExpr | null {
+  if (key.type.kind !== "f64" && key.type.kind !== "string") return null;
+  const text: IrExpr =
+    key.type.kind === "string" ? key : { kind: "toString", operand: key, type: STRING, loc };
+  const concat = (left: IrExpr, right: IrExpr): IrExpr => ({
+    kind: "strConcat",
+    left,
+    right,
+    type: STRING,
+    loc,
+  });
+  return concat(concat(strLit(head, loc), text), strLit("')", loc));
+}
+
+/** A string array's element converted to a string: the element, or
+ * "undefined" for a missing index or a hole. */
+function stringElementOrUndefined(
+  lowerer: Lowerer,
+  read: ts.ElementAccessExpression,
+  loc: SrcLoc,
+): IrExpr | null {
+  if (lowerer.mapTypeOf(lowerer.typeOf(read.argumentExpression))?.kind !== "f64") return null;
+  const arr = lowerer.lowerExpr(read.expression);
+  if (arr.type.kind !== "array" || arr.type.elem.kind !== "string") return null;
+  const index = lowerer.lowerExprExpecting(read.argumentExpression, F64);
+  const stmts: IrStmt[] = [];
+  const held = (value: IrExpr, name: string): IrExpr => {
+    const tmp = lowerer.declareHiddenLocal(name, value.type);
+    stmts.push({ kind: "varDecl", localId: tmp.id, init: value, loc });
+    return varRef(tmp.id, value.type, loc);
+  };
+  // An index that can assign can replace the array binding or field, so
+  // the array is held before it, as JavaScript reads it first.
+  const a = !mayAssign(index) && isSafeToRepeat(arr) ? arr : held(arr, "%elementArray");
+  const i = isSafeToRepeat(index) ? index : held(index, "%elementIndex");
+  const value: IrExpr = {
+    kind: "ternary",
+    cond: {
+      kind: "bin",
+      op: "===",
+      left: { kind: "arrayState", arr: a, index: i, type: F64, loc },
+      right: numLit(1, loc),
+      type: BOOL,
+      loc,
+    },
+    then: { kind: "arrayGet", arr: a, index: i, type: STRING, loc },
+    else_: strLit("undefined", loc),
+    type: STRING,
+    loc,
+  };
+  return stmts.length === 0 ? value : { kind: "seqExpr", stmts, result: value, type: STRING, loc };
+}
+
+function isScalarArm(arm: IrType): boolean {
+  return arm.kind === "f64" || arm.kind === "string" || arm.kind === "bool" || isUnitType(arm);
+}
+
+/** A union of numbers, strings, booleans, null and undefined with at least
+ * one unit arm. */
+function scalarUnion(lowerer: Lowerer, unionId: string): boolean {
+  const arms = lowerer.unions.get(unionId)?.arms;
+  return !!arms?.some(isUnitType) && arms.every(isScalarArm);
+}
+
+/** How the converting use of `x!` (see assertionOperand) reads it:
+ * "number" where the use applies ToNumber, "string" where it converts the
+ * value to a string (a template span, `+` with a string), "value" where the
+ * consumer lowers the union itself (equality, truthiness, a comparison with
+ * a string), null for other uses. */
+function convertingUseOf(
+  lowerer: Lowerer,
+  expr: ts.NonNullExpression,
+): "number" | "string" | "value" | null {
   let outer: ts.Expression = expr;
   while (ts.isParenthesizedExpression(outer.parent)) outer = outer.parent;
   const parent = outer.parent;
-  if (ts.isTemplateSpan(parent)) return parent.expression === outer ? "value" : null;
+  if (ts.isTemplateSpan(parent)) return parent.expression === outer ? "string" : null;
   if (ts.isTypeOfExpression(parent)) return "value";
   if (ts.isPrefixUnaryExpression(parent)) {
     if (parent.operator === ts.SyntaxKind.ExclamationToken) return "value";
@@ -1140,7 +1608,7 @@ function convertingUseOf(lowerer: Lowerer, expr: ts.NonNullExpression): "number"
     if (op === ts.SyntaxKind.PlusEqualsToken && parent.right !== outer) return null;
     let partner = other;
     while (ts.isParenthesizedExpression(partner)) partner = partner.expression;
-    if (isString(other)) return ts.isNonNullExpression(partner) ? null : "value";
+    if (isString(other)) return ts.isNonNullExpression(partner) ? null : "string";
     if (!numericPartner(lowerer.typeOf(other))) return "value";
     return isString(expr) ? null : "number";
   }
@@ -1226,7 +1694,8 @@ export function assertedReadObservesUndefined(
   lowerer: Lowerer,
   node: ts.NonNullExpression,
 ): boolean {
-  if (convertingUseOf(lowerer, node) === "value") return true;
+  const use = convertingUseOf(lowerer, node);
+  if (use === "value" || use === "string") return true;
   let outer: ts.Expression = node;
   while (ts.isParenthesizedExpression(outer.parent)) outer = outer.parent;
   const parent = outer.parent;

packages/compiler/src/frontend/lowering/lower-stmts.ts

@@ -242,10 +242,12 @@ import { globalSymbolKey } from "./expressions/global-symbols.js";
 import { identifiersNamed } from "./identifier-uses.js";
 import { lowerShortCircuitAssignment } from "./expressions/nullish-assignment.js";
 import {
+  dereferencedElementWrite,
   jsHoldsDynObject,
   lowerEnvironmentKey,
   lowerNativeFunctionAssignment,
   lowerStrictEquality,
+  nodeTypeError,
 } from "./lower-exprs.js";
 import { keptIdentityAssertion } from "./assertion-identity.js";
 import { isNativeProxyInitializer } from "./expressions/native-proxy.js";
@@ -7992,6 +7994,29 @@ function lowerCjsSingleValueExport(
  * assignment, and `({ a, b } = e);` (destructuring ASSIGNMENT, which JS
  * requires parenthesized in statement position) lands in the
  * object-literal-target branch below. */
+/** dereferencedElementWrite in statement position. */
+function lowerDereferencedElementWrite(lowerer: Lowerer, expr: ts.BinaryExpression): IrStmt | null {
+  const write = dereferencedElementWrite(lowerer, expr);
+  if (write === null) return null;
+  const loc = locOf(expr);
+  return {
+    kind: "block",
+    body: [
+      ...write.stmts,
+      {
+        kind: "if",
+        cond: write.present,
+        then: [
+          lowerer.withExpressionOverrides(write.overrides, () => lowerExprStatement(lowerer, expr)),
+        ],
+        else_: [{ kind: "exprStmt", expr: nodeTypeError(write.message, VOID, loc), loc }],
+        loc,
+      },
+    ],
+    loc,
+  };
+}
+
 export function lowerExprStatement(lowerer: Lowerer, expr: ts.Expression): IrStmt {
   const stmtNode = expr.parent;
   while (ts.isParenthesizedExpression(expr)) expr = expr.expression;
@@ -8254,6 +8279,10 @@ export function lowerExprStatement(lowerer: Lowerer, expr: ts.Expression): IrStm
         const ex = lowerExpandoAssignStmt(lowerer, expr);
         if (ex) return ex;
       }
+      {
+        const dereferenced = lowerDereferencedElementWrite(lowerer, expr);
+        if (dereferenced) return dereferenced;
+      }
       if (ts.isElementAccessExpression(expr.left)) return lowerer.lowerElementWrite(expr);
       if (ts.isPropertyAccessExpression(expr.left)) {
         fenceNodeModuleMutation(lowerer, expr.left, "assignment");
@@ -11824,6 +11853,7 @@ function lowerForOfDyn(
   const iterator = lowerer.declareHiddenLocal("%dofIterator", DYN);
   const next = lowerer.declareHiddenLocal("%dofNext", DYN);
   const fast = lowerer.declareHiddenLocal("%dofNative", BOOL);
+  const generator = lowerer.declareHiddenLocal("%dofGenerator", F64);
   const done = lowerer.declareHiddenLocal("%dofDone", BOOL);
   done.mutable = true;
   const value = lowerer.declareHiddenLocal("%dofValue", DYN);
@@ -11833,6 +11863,15 @@ function lowerForOfDyn(
   needsClose.mutable = true;
   const error = lowerer.declareHiddenLocal("%dofError", CAUGHT);
   const syncIterator = asyncLoop ? lowerer.declareHiddenLocal("%dofSync", BOOL) : null;
+  lowerer.untypedLoops.set(generator, {
+    kind: generator.id,
+    value: value.id,
+    iterator: iterator.id,
+    next: next.id,
+    done: done.id,
+    async: asyncLoop,
+    sync: syncIterator?.id ?? null,
+  });
   const awaitDyn = (value: IrExpr): IrExpr => ({
     kind: "libCall",
     fn: "async.awaitDyn",
@@ -12107,6 +12146,14 @@ function lowerForOfDyn(
             : iteratorCanStep(varRef(iterator.id, DYN, loc), varRef(next.id, DYN, loc), loc),
           loc,
         },
+        // Which of the program's generator types the iterator is, once
+        // generator-dynamic-dispatch.ts knows them; 0 keeps the protocol.
+        {
+          kind: "varDecl",
+          localId: generator.id,
+          init: { kind: "numLit", value: 0, type: F64, loc },
+          loc,
+        },
         {
           kind: "varDecl",
           localId: done.id,

packages/compiler/src/frontend/lowering/lowerer.ts

@@ -21,7 +21,7 @@ import {
 import { isDeclBoundaryFile } from "../decl-projection.js";
 import { relieveHeapPressure } from "../../heap-pressure.js";
 import { moduleNamespaceObject, moduleNamespaceValue } from "./module-namespace-elements.js";
-import { keyedHelperName } from "./stable-names.js";
+import { keyedHelperName, moduleTagNumber, portableRelativePath } from "./stable-names.js";
 import { positionTag, StructuralPositions } from "./structural-positions.js";
 import { bindingSymbolOfRead, onlyForwarded, stripTypeWrappers } from "./typed-arguments.js";
 import {
@@ -217,7 +217,7 @@ export { newFnCtx, type FnCtx } from "./function-context.js";
  * - Lexical scoping is resolved here: locals get function-unique ids
  *   ("x.0", "x.1" for shadowing); the IR is scope-flat.
  */
-import { dirname, relative, resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { bindingSource } from "../binding-source.js";
 import { compilerOwnedFileName, tsgoPath } from "../dts-paths.js";
 import * as ts from "../ts7/adapter.js";
@@ -2068,6 +2068,21 @@ function byName(fns: readonly IrFunction[]): IrFunction[] {
   );
 }
 
+/** A loop over an untyped iterable (lowerForOfDyn). `kind` is a local the
+ * loop sets once it has opened the iterator: 0 for the dynamic protocol,
+ * or the 1-based index of the program's generator type it steps natively.
+ * `value` is the per-step local whose initializer takes one step. */
+export interface UntypedLoopSite {
+  kind: string;
+  value: string;
+  iterator: string;
+  next: string;
+  done: string;
+  /** `for await`; `sync` names its async-from-sync flag. */
+  async: boolean;
+  sync: string | null;
+}
+
 /** The program module a createRequire binding requires. */
 type CreateRequireTarget = NonNullable<ReturnType<typeof createRequireProgramModuleOf>>;
 
@@ -3591,6 +3606,11 @@ export class Lowerer {
    * values other than fresh literals (noteUntypedIntegrity). */
   untypedIntegrity = false;
   readonly liftedFns: IrFunction[] = [];
+  /** `for … of` and `for await` loops over untyped iterables, by their
+   * generator-kind local (generator-dynamic-dispatch.ts steps the program's
+   * own generators there on the typed path). Local ids repeat across
+   * functions; the local itself is in its function's locals. */
+  readonly untypedLoops = new Map<IrLocal, UntypedLoopSite>();
   /** global-values.ts's answer per JavaScript source: the receiver of its
    * first read of the global object by a computed name, or null. */
   readonly computedGlobalReads = new Map<ts.SourceFile, ts.Expression | null>();
@@ -3616,12 +3636,17 @@ export class Lowerer {
    * names do not depend on where the program sits, default library files
    * by their base name (two checkers install them in different
    * directories), and the files scriptc ships by their name inside scriptc,
-   * so names do not depend on where scriptc is installed either. */
-  readonly positions = new StructuralPositions((sf) =>
-    this.program.isSourceFileDefaultLibrary(sf)
+   * so names do not depend on where scriptc is installed either. Relative
+   * paths use `/` on every platform. */
+  readonly positions = new StructuralPositions((sf) => this.stableFileName(sf));
+
+  /** The name of `sf` in positions and module tags. */
+  stableFileName(sf: ts.SourceFile): string {
+    return this.program.isSourceFileDefaultLibrary(sf)
       ? `lib:${sf.fileName.slice(sf.fileName.lastIndexOf("/") + 1)}`
-      : (compilerOwnedFileName(sf.fileName) ?? relative(dirname(this.entry.fileName), sf.fileName)),
-  );
+      : (compilerOwnedFileName(sf.fileName) ??
+          portableRelativePath(dirname(this.entry.fileName), sf.fileName));
+  }
 
   /** The outermost node whose token span is exactly `loc`, or null. */
   nodeAtLoc(loc: SrcLoc): ts.Node | null {
@@ -4320,9 +4345,20 @@ export class Lowerer {
     // moduleOrder BEFORE any pass constructed — lowerToIr runs
     // appendDynamicImportModules once on the shared array (a per-pass run
     // here would repeatedly extend the graph and duplicate cycle reports).
-    this.moduleOrder.forEach((sf, i) => {
-      this.fileTag.set(sf, sf === entry ? "" : `%m${i}.`);
-    });
+    // A module's tag hashes its stable file name rather than numbering its
+    // place in moduleOrder, so adding or reordering modules leaves the other
+    // modules' function names, and the closure names keyed by them,
+    // unchanged. The native compiler's profile matches functions by name.
+    const tagNumbers = new Set<number>();
+    for (const sf of this.moduleOrder) {
+      if (sf === entry) {
+        this.fileTag.set(sf, "");
+        continue;
+      }
+      const n = moduleTagNumber(this.stableFileName(sf), tagNumbers);
+      tagNumbers.add(n);
+      this.fileTag.set(sf, `%m${n}.`);
+    }
     if (this.moduleOrder.length === 0) this.fileTag.set(entry, "");
     const jsDynamic = jsDynamicDeclarations(this.moduleOrder, this.checker);
     if (jsDynamic.size > 0) this.typeCtx.jsDynamicDeclaration = (decl) => jsDynamic.has(decl);

packages/compiler/src/frontend/lowering/nan-coded-reads.ts

@@ -451,6 +451,19 @@ export class NanCodedReads {
 
   // ---- present reads ------------------------------------------------------
 
+  /** `xs[i]` whose index is a non-negative integer counter of the reading
+   * function and that a dominating `i < xs.length` guard bounds by the
+   * length: the read names an existing index. */
+  counterIndexInBounds(read: ts.ElementAccessExpression): boolean {
+    const index = peelTransparent(read.argumentExpression);
+    if (!ts.isIdentifier(index)) return false;
+    const symbol = this.symbolOf(index);
+    if (!symbol || !this.nonNegativeCounter(symbol)) return false;
+    const decl = this.host.declarationOf(symbol);
+    if (!decl || this.containingFunction(decl) !== this.containingFunction(read)) return false;
+    return indexReadInBounds(read);
+  }
+
   /** `t[i]` names an existing element: `i` is a non-negative integer
    * counter and a dominating guard bounds it by `t.length` (or by the
    * length of a typed array that always has the same length).

packages/compiler/src/frontend/lowering/stable-names.test.ts

@@ -0,0 +1,21 @@
+import { expect, test } from "vitest";
+import { moduleTagNumber, portableRelativePath } from "./stable-names.js";
+
+test("module tag numbers depend only on the file name and stay distinct", () => {
+  const first = moduleTagNumber("lib/a.ts", new Set());
+  expect(moduleTagNumber("lib/a.ts", new Set([7, 8]))).toBe(first);
+  expect(moduleTagNumber("lib/b.ts", new Set())).not.toBe(first);
+  expect(moduleTagNumber("lib/a.ts", new Set([first]))).toBe((first + 1) >>> 0);
+  expect(moduleTagNumber("lib/a.ts", new Set([first, (first + 1) >>> 0]))).toBe((first + 2) >>> 0);
+});
+
+test("relative module paths use / on every platform", () => {
+  expect(portableRelativePath("/repo/src", "/repo/src/lib/a.ts", "linux")).toBe("lib/a.ts");
+  expect(portableRelativePath("C:/repo/src", "C:/repo/src/lib/a.ts", "win32")).toBe("lib/a.ts");
+  expect(portableRelativePath("C:\\repo\\src", "C:/repo/node_modules/x/index.d.ts", "win32")).toBe(
+    "../node_modules/x/index.d.ts",
+  );
+  expect(
+    moduleTagNumber(portableRelativePath("C:/repo", "C:/repo/lib/a.ts", "win32"), new Set()),
+  ).toBe(moduleTagNumber(portableRelativePath("/repo", "/repo/lib/a.ts", "linux"), new Set()));
+});

packages/compiler/src/frontend/lowering/stable-names.ts

@@ -1,4 +1,7 @@
+import * as posix from "node:path/posix";
+import * as win32 from "node:path/win32";
 import { InternalCompilerError } from "../../errors.js";
+import { tsgoPath } from "../ts7/session-path.js";
 
 /** The owner of the names keyedHelperName hands out. */
 export interface KeyedNameOwner {
@@ -46,3 +49,26 @@ export function keyedHelperName(
     throw new InternalCompilerError(`helper name ${name} is shared by two helper keys`);
   return name;
 }
+
+/** The number in the `%m<number>.` tag of the module named `fileName`: a
+ * 32-bit FNV-1a hash of the name, so a module keeps its tag when other
+ * modules are added, removed or reordered. A number in `taken` moves to the
+ * next free one, which keeps tags distinct. */
+export function moduleTagNumber(fileName: string, taken: ReadonlySet<number>): number {
+  let h = 0x811c9dc5;
+  for (let i = 0; i < fileName.length; i++) h = Math.imul(h ^ fileName.charCodeAt(i), 0x01000193);
+  let n = h >>> 0;
+  while (taken.has(n)) n = (n + 1) >>> 0;
+  return n;
+}
+
+/** The path of `file` relative to the directory `from`, with `/` separators
+ * on every platform, so names built from it match across hosts. */
+export function portableRelativePath(
+  from: string,
+  file: string,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  const path = platform === "win32" ? win32.relative(from, file) : posix.relative(from, file);
+  return tsgoPath(path, platform);
+}

packages/compiler/src/ir/int32-slots.ts

@@ -1484,6 +1484,39 @@ export function analyzeInt32Slots(mod: IrModule, inputs: Int32SlotInputs = {}):
       continue;
     }
     const int32 = (e: IrExpr): boolean => withinInt32(ranges.get(e));
+    // The range of an exact integer that may also be NaN: an element read
+    // of a candidate through `getNumber` (`a[k]!` in arithmetic, NaN for a
+    // missing element), and `+`, `-` and `*` over such values and integers.
+    // A checked store widens the array at a NaN like at any value that is
+    // not an int32.
+    const integerOrNaN = (e: IrExpr): IntegerRange | null => {
+      const range = ranges.get(e);
+      if (range) return range;
+      if (e.kind === "numLit")
+        return Number.isInteger(e.value) ? { min: e.value, max: e.value } : null;
+      if (e.kind === "arrIntrinsic" && e.method === "getNumber" && e.receiver.kind === "varRef")
+        return slots.hasInt32ElementSlot(int32ArraySlot(int32ArrayKey(fn.name, e.receiver.localId)))
+          ? INT32_RANGE
+          : null;
+      if (e.kind !== "bin" || (e.op !== "+" && e.op !== "-" && e.op !== "*")) return null;
+      const left = integerOrNaN(e.left);
+      const right = left && integerOrNaN(e.right);
+      if (!left || !right) return null;
+      const bounds =
+        e.op === "+"
+          ? [left.min + right.min, left.max + right.max]
+          : e.op === "-"
+            ? [left.min - right.max, left.max - right.min]
+            : [
+                left.min * right.min,
+                left.min * right.max,
+                left.max * right.min,
+                left.max * right.max,
+              ];
+      const min = Math.min(...bounds);
+      const max = Math.max(...bounds);
+      return Math.abs(min) < 2 ** 53 && Math.abs(max) < 2 ** 53 ? { min, max } : null;
+    };
     // Every element stored into an int32 array candidate must be an int32
     // under the facts that assume the candidates' own elements are; a
     // failing store drops its array's element facts, and the function is
@@ -1513,6 +1546,10 @@ export function analyzeInt32Slots(mod: IrModule, inputs: Int32SlotInputs = {}):
       for (const [id, values] of int32ArrayStores(fn, arrays)) {
         const key = int32ArrayKey(fn.name, id);
         if (!slots.hasInt32ElementSlot(int32ArraySlot(key)) || values.every(int32)) continue;
+        // Checked stores serve a lone local: its allocations are the only
+        // arrays it holds. Its stores are judged under the element facts
+        // the ranges were computed with.
+        const checkable = values.every((value) => int32(value) || integerOrNaN(value) !== null);
         // The array's group drops together: every function reading a
         // member is analyzed again without its facts.
         const group = arrayGroups.group.get(key) ?? [key];
@@ -1523,17 +1560,11 @@ export function analyzeInt32Slots(mod: IrModule, inputs: Int32SlotInputs = {}):
             if (names) for (const name of names) requeue(name);
           } else requeue(member.slice(0, member.indexOf("\0")));
         }
-        // Checked stores serve a lone local: its allocations are the only
-        // arrays it holds.
-        const checkable = (value: IrExpr): boolean => {
-          const range = ranges.get(value);
-          return int32(value) || range != null;
-        };
         if (
           group.length === 1 &&
           !key.startsWith("\0") &&
           !params.has(id) &&
-          values.every(checkable) &&
+          checkable &&
           checkableInt32Allocations(fn, id)
         )
           slots.checkedInt32Arrays.add(key);

packages/compiler/src/ir/parameter-versions.ts

@@ -122,7 +122,7 @@ function numericLoop(loop: IrStmt, functions: ReadonlyMap<string, IrFunction>):
       const target = functions.get(e.callee);
       allowed = target !== undefined && simple(target);
     } else if (e.kind === "libCall") allowed = e.fn.startsWith("math.");
-    else if (e.kind === "arrIntrinsic") allowed = e.method === "length";
+    else if (e.kind === "arrIntrinsic") allowed = e.method === "length" || e.method === "getNumber";
     return allowed && everyExprChild(e, expr, stmt);
   };
   const stmt = (s: IrStmt): boolean =>

packages/compiler/test/await-call-emission.test.ts

@@ -9,13 +9,19 @@ afterEach(async () => {
   await Promise.all(directories.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
 });
 
-async function emit(source: string): Promise<string> {
+async function emit(source: string, optimization?: "dev"): Promise<string> {
   const outDir = await mkdtemp(join(tmpdir(), "scriptc-await-call-"));
   directories.push(outDir);
   const entry = join(outDir, "main.ts");
   await writeFile(entry, source);
   const outPath = join(outDir, "program.ll");
-  const result = await compile(entry, { entry, outDir, outPath, outputKind: "llvm" });
+  const result = await compile(entry, {
+    entry,
+    outDir,
+    outPath,
+    outputKind: "llvm",
+    ...(optimization !== undefined ? { optimization } : {}),
+  });
   expect(result.ok, JSON.stringify(result)).toBe(true);
   return readFile(outPath, "utf8");
 }
@@ -28,8 +34,9 @@ function definition(llvm: string, symbol: string): string {
   return match![0];
 }
 
-// Consuming an async generator keeps a body on its fiber: the await-call
-// entries serve fiber bodies (stackless bodies suspend at their awaits).
+// The await-call entries serve fiber bodies (stackless bodies suspend at
+// their awaits). Debug builds keep every async body on its fiber, so the
+// sources below that test them build with optimization "dev".
 const tick = `
 async function* tick(): AsyncGenerator<number, void, undefined> {
   yield 0;
@@ -58,7 +65,7 @@ void main();
 `;
 
 test("awaiting a direct call to a body that never suspends skips the promise", async () => {
-  const llvm = await emit(source);
+  const llvm = await emit(source, "dev");
   expect(definition(llvm, "sc_f_middle")).toContain("call double @sc_aw_leaf(double");
   const entry = definition(llvm, "sc_aw_leaf");
   expect(entry).toContain("call double @sc_f_leaf(double %a0)");
@@ -74,7 +81,7 @@ test("awaiting a direct call to a body that never suspends skips the promise", a
 });
 
 test("awaiting a direct call to a suspending body spawns and awaits in one call", async () => {
-  const llvm = await emit(source);
+  const llvm = await emit(source, "dev");
   const main = definition(llvm, "sc_f_main");
   expect(main).toContain("call double @sc_aw_middle(double");
   // A call whose promise is kept keeps the promise-returning entry.
@@ -82,7 +89,7 @@ test("awaiting a direct call to a suspending body spawns and awaits in one call"
   expect(definition(llvm, "sc_aw_middle")).toContain(
     "call double @scr_async_spawn_await_f64(ptr @sc_tr_middle, ptr %ap)",
   );
-  // middle consumes an async generator, so it keeps its fiber.
+  // The debug build keeps middle on its fiber.
   expect(definition(llvm, "sc_as_middle")).toContain("@scr_async_spawn(");
 });
 
@@ -119,7 +126,7 @@ void main();
 `;
 
 test("returning a direct call adopts its promise one microtask turn later", async () => {
-  const llvm = await emit(adoptSource);
+  const llvm = await emit(adoptSource, "dev");
   expect(definition(llvm, "sc_f_relay")).toContain("call double @sc_ad_leaf(double");
   // A body that never suspends: the adoption's then-job turn, then the
   // settled promise's own turn, still without materializing the promise.
@@ -141,7 +148,7 @@ test("returning a direct call adopts its promise one microtask turn later", asyn
 });
 
 test("a returned promise is adopted after finally regions, outside catch handlers", async () => {
-  const llvm = await emit(adoptSource);
+  const llvm = await emit(adoptSource, "dev");
   const guarded = definition(llvm, "sc_f_guarded");
   // The call produces the promise; the finally body runs; only then the
   // adoption turn and the await.
@@ -167,7 +174,7 @@ async function middle(x: number): Promise<number> {
   const z = await leaf(y);
   return y * 2 + z;
 }
-async function fibered(): Promise<number> {
+async function fibered(): Promise<any> {
   let s = 0;
   for await (const t of tick()) s += t;
   return s + (await middle(1));
@@ -206,8 +213,9 @@ test("bodies that suspend only at their own awaits compile to stackless coroutin
   expect(middle).not.toContain("@scr_await_f64(");
   expect(definition(llvm, "sc_as_middle")).toContain("@scr_async_spawn_stackless(");
   expect(definition(llvm, "sc_f_main")).toContain("@scr_coro_await_prepare(");
-  // A body that keeps its fiber still awaits a stackless callee in one
-  // call: spawn, then the ordinary await of its promise.
+  // A body with a dynamic result keeps its fiber, and still awaits a
+  // stackless callee in one call: spawn, then the ordinary await of its
+  // promise.
   expect(definition(llvm, "sc_as_fibered")).toContain("@scr_async_spawn(");
   expect(definition(llvm, "sc_f_fibered")).toContain("call double @sc_aw_middle(double");
   const entry = definition(llvm, "sc_aw_middle");

packages/compiler/test/generator-emission.test.ts

@@ -9,13 +9,19 @@ afterEach(async () => {
   await Promise.all(directories.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
 });
 
-async function emit(source: string): Promise<string> {
+async function emit(source: string, optimization?: "dev"): Promise<string> {
   const outDir = await mkdtemp(join(tmpdir(), "scriptc-generator-"));
   directories.push(outDir);
   const entry = join(outDir, "main.ts");
   await writeFile(entry, source);
   const outPath = join(outDir, "program.ll");
-  const result = await compile(entry, { entry, outDir, outPath, outputKind: "llvm" });
+  const result = await compile(entry, {
+    entry,
+    outDir,
+    outPath,
+    outputKind: "llvm",
+    ...(optimization !== undefined ? { optimization } : {}),
+  });
   expect(result.ok, JSON.stringify(result)).toBe(true);
   return readFile(outPath, "utf8");
 }
@@ -117,7 +123,7 @@ console.log(sum, r.value);
   expect(llvm).toMatch(/define internal ptr @sc_gres_\d+\(ptr %g\)[^\n]*\(dyn channel\)/);
 });
 
-test("async generators keep their fibers", async () => {
+test("async generators that suspend only at their own awaits and yields compile to stackless coroutines", async () => {
   const llvm = await emit(`
 async function* ticks(n: number): AsyncGenerator<number, void, undefined> {
   for (let i = 0; i < n; i++) {
@@ -130,6 +136,36 @@ async function main(): Promise<void> {
 }
 void main();
 `);
+  const body = definition(llvm, "sc_f_ticks");
+  expect(body).toMatch(/^define internal void @sc_f_ticks(?:\.i32)?\(double [^)]*\) #1 /);
+  // The await suspends the coroutine (one turn for a non-promise operand),
+  // and the yield stores OUT before its own suspension.
+  expect(body).toContain("call zeroext i1 @scr_coro_hop_prepare(ptr");
+  expect(body).toContain("call void @scr_coro_yield_f64(ptr");
+  expect(body).toContain("call void @scr_gen_coro_finish(ptr");
+  expect(body).not.toContain("@scr_await_hop(");
+  expect(body).not.toContain("@scr_gen_yield_f64(");
+  expect(definition(llvm, "sc_gs_ticks")).toContain("call ptr @scr_async_gen_new_stackless(");
+  // Consuming the generator does not park its consumer.
+  expect(definition(llvm, "sc_as_main")).toContain("@scr_async_spawn_stackless(");
+});
+
+test("debug builds keep async generators on their fibers", async () => {
+  const llvm = await emit(
+    `
+async function* ticks(n: number): AsyncGenerator<number, void, undefined> {
+  for (let i = 0; i < n; i++) {
+    await null;
+    yield i;
+  }
+}
+async function main(): Promise<void> {
+  for await (const t of ticks(3)) console.log(t);
+}
+void main();
+`,
+    "dev",
+  );
   expect(definition(llvm, "sc_gs_ticks")).toContain("call ptr @scr_async_gen_new(");
   expect(llvm).not.toContain("presplitcoroutine");
 });

packages/compiler/test/js-ic-emission.test.ts

@@ -50,6 +50,10 @@ console.log(read(o), at(dyn([5, 6]), 1), call(o), o.n);
     );
     expect(body(llvm, "read")).toContain("@scr_js_get_probe(");
     expect(body(llvm, "write")).toContain("@scr_js_store_probe(");
+    // Reads and writes test the first two entries inline: the second
+    // starts 40 bytes into the record.
+    for (const site of ["read", "write"])
+      expect(body(llvm, site)).toMatch(/getelementptr inbounds i8, ptr @sc_js_ic_\d+, i64 40$/m);
     expect(body(llvm, "at")).toContain("@scr_js_keyed_probe(");
     expect(body(llvm, "call")).toContain("@scr_js_load_probe(");
     // A compound assignment stores its number result from the jsval: an

packages/compiler/test/stable-names.test.ts

@@ -117,3 +117,44 @@ test("names do not depend on the directory the program sits in", async () => {
   const [second] = await lower(recursive);
   expect(names(second!)).toEqual(names(first!));
 });
+
+/** Lowers a program of several files; `main.ts` is the entry. */
+async function lowerFiles(files: Record<string, string>): Promise<IrModule> {
+  const dir = await mkdtemp(join(tmpdir(), "scriptc-stable-names-"));
+  try {
+    for (const [name, source] of Object.entries(files)) await writeFile(join(dir, name), source);
+    const outPath = join(dir, "main.ir.json");
+    const result = await compile(join(dir, "main.ts"), { outDir: dir, outPath, outputKind: "ir" });
+    if (!result.ok)
+      throw new Error(result.diagnostics.map((d) => `${d.code}: ${d.message}`).join("\n"));
+    return deserializeModule(await readFile(outPath, "utf8"));
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
+
+test("a module's names do not depend on the modules loaded before it", async () => {
+  const shapes = `
+export class Box {
+  constructor(private value: number) {}
+  scaled(by: number): number { return this.value * by; }
+}
+export function boxes(count: number): number[] {
+  return Array.from({ length: count }, (_, i) => new Box(i).scaled(2));
+}
+`;
+  const before = await lowerFiles({
+    "shapes.ts": shapes,
+    "main.ts": `import { boxes } from "./shapes";\nconsole.log(boxes(3).join(","));\n`,
+  });
+  const after = await lowerFiles({
+    "offsets.ts": `export function offset(x: number): number { return x + 1; }\n`,
+    "shapes.ts": shapes,
+    "main.ts": `import { offset } from "./offsets";\nimport { boxes } from "./shapes";\nconsole.log(offset(1), boxes(3).join(","));\n`,
+  });
+  // The class, its methods, the function and the closure it lifts.
+  const ofShapes = (mod: IrModule) =>
+    names(mod).filter((name) => /Box|boxes/.test(name) || name.startsWith("%fn."));
+  expect(ofShapes(before).length).toBeGreaterThanOrEqual(4);
+  expect(ofShapes(after)).toEqual(ofShapes(before));
+});

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7393-non-null-element-operands.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7393-non-null-element-operands.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/7395-non-null-element-dereference.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/7395-non-null-element-dereference.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/8370-stack-overflow-cycles/main.ts.json

@@ -0,0 +1,7 @@
+{
+ "order": [
+  "<repo>/tests/corpus/8370-stack-overflow-cycles/shapes.ts",
+  "<repo>/tests/corpus/8370-stack-overflow-cycles/main.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/8380-untyped-generator-loops.mjs.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/8380-untyped-generator-loops.mjs"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/8381-untyped-generator-stages.mjs.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/8381-untyped-generator-stages.mjs"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/8382-stackless-async-generator-steps.mjs.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/8382-stackless-async-generator-steps.mjs"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/8383-stackless-async-generator-steps.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/8383-stackless-async-generator-steps.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/8407-string-index-of-from-ascii.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/8407-string-index-of-from-ascii.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-array-subclass.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-array-subclass.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-arrays.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-arrays.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-cap.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-cap.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-escapes.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-escapes.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-mixed.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-mixed.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-outside.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-outside.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-region-throws.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-region-throws.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-regions.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-regions.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-thrown-member.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-thrown-member.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-throws.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-throws.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-trees.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-trees.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/arena-workers.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/arena-workers.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/typed-array-nested-loop-versions.ts.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/typed-array-nested-loop-versions.ts"
+ ],
+ "diags": []
+}

packages/compiler/test/ts7/baselines/order-parity/tests/corpus/untyped-nullish-scalar-defaults.mjs.json

@@ -0,0 +1,6 @@
+{
+ "order": [
+  "<repo>/tests/corpus/untyped-nullish-scalar-defaults.mjs"
+ ],
+ "diags": []
+}

packages/compiler/test/untyped-nullish-scalar.test.ts

@@ -0,0 +1,46 @@
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { expect, test } from "vitest";
+import { compile, deserializeModule, validateModule } from "../src/index.js";
+
+test("`??` in JavaScript tests a scalar optional left on the typed path when the default has its type", async () => {
+  const dir = mkdtempSync(join(tmpdir(), "scriptc-untyped-nullish-"));
+  try {
+    const entry = join(dir, "main.mjs");
+    writeFileSync(
+      entry,
+      [
+        "const counts = new Map();",
+        'for (const w of ["a", "b", "a"]) counts.set(w, (counts.get(w) ?? 0) + 1);',
+        'console.log(counts.get("a") ?? 0, counts.get("z") ?? "none");',
+      ].join("\n"),
+    );
+    const output = join(dir, "main.ir.json");
+    const lowered = await compile(entry, { outputKind: "ir", outDir: dir, outPath: output });
+    if (!lowered.ok) throw new Error(JSON.stringify(lowered.diagnostics));
+    const module = deserializeModule(readFileSync(output, "utf8"));
+    expect(validateModule(module)).toEqual([]);
+    const nullish: { type: string; left: string }[] = [];
+    const visit = (node: unknown, parent: string | null): void => {
+      if (node === null || typeof node !== "object") return;
+      if (Array.isArray(node)) return node.forEach((child) => visit(child, parent));
+      const n = node as { kind?: string; type?: { kind: string }; left?: { kind: string } };
+      if (n.kind === "nullish")
+        nullish.push({ type: `${parent}>${n.type!.kind}`, left: n.left!.kind });
+      for (const [key, value] of Object.entries(node))
+        if (key !== "loc") visit(value, n.kind ?? parent);
+    };
+    visit(module.functions, null);
+    // The loop's `?? 0`, whose result is an untyped value, reads the Map's
+    // number on the typed path and converts only the result. (The first
+    // console.log argument is a number already.) `?? "none"` takes another
+    // type, so its left converts first.
+    expect(
+      nullish.filter((n) => n.type === "dynFrom>f64" && n.left === "mapIntrinsic"),
+    ).toHaveLength(1);
+    expect(nullish.filter((n) => n.type.endsWith(">dyn") && n.left === "dynFrom")).toHaveLength(1);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

packages/runtime-pack-common/runtime-pack-matrix.mjs

@@ -47,6 +47,7 @@ export const BASE_RUNTIME_SOURCES = [
   "scr_cycle.c",
   "scr_publish.c",
   "scr_region.c",
+  "scr_arena.c",
   "scr_itable.c",
   "scr_slots.c",
   "scr_alloc.c",

packages/runtime/src/scr_arena.c

@@ -0,0 +1,263 @@
+/* Group arenas: see scr_arena.h. */
+#include "scr_runtime.h"
+
+#include <stdbool.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* The first chunk lives inside the arena, so a small group (one result
+ * record, a short builder) touches no other memory. */
+#define SCR_ARENA_INLINE 512
+#define SCR_ARENA_CHUNK_MIN ((size_t)4096)
+#define SCR_ARENA_CHUNK_MAX ((size_t)1 << 20)
+/* Bytes an arena that is not closed takes before its call allocates on the
+ * heap again: a group whose objects die before it is dropped holds at most
+ * this much dead memory. A closed arena has no cap: once on the heap, its
+ * later objects could come to be held by earlier ones, which are not on
+ * its dispose list. Neither do objects with a collector header: on the
+ * heap, they could form cycles that outlive the drop (llvm/arenas.ts). */
+#define SCR_ARENA_CAP ((size_t)32 << 20)
+/* What a thread keeps for reuse: arenas, chunk bytes, and dispose list
+ * entries per pooled arena. */
+#define SCR_ARENA_POOL 64
+#define SCR_ARENA_POOL_BYTES ((size_t)8 << 20)
+#define SCR_ARENA_POOL_DISPOSALS ((size_t)4096)
+
+/* A chunk's objects run from scr_arena_chunk_start to its end. */
+typedef struct ScrArenaChunk {
+  struct ScrArenaChunk *next;
+  size_t size; /* bytes, this header included */
+} ScrArenaChunk;
+
+/* The leading fields are an ABI: emitted arena-aware constructors bump
+ * `bump` up to `limit`, test `closed`, and append to the dispose list at
+ * `disposals` up to `disposals_end` inline (llvm/arenas.ts). Without the
+ * small-object allocator `bump` and `limit` stay NULL, so every object
+ * takes scr_arena_obj and is a block of its own. */
+struct ScrArena {
+  char *bump, *limit;
+  ScrArenaDisposal *disposals, *disposals_end;
+  uint32_t closed;
+  uint32_t open;   /* still the allocation target, or under one that is */
+  ScrArena *outer; /* the allocation target before it opened */
+  ScrArena *next;  /* its scope's list, or the pool */
+  ScrArenaDisposal *disposal_base;
+  ScrArenaChunk *chunks; /* newest first */
+  size_t bytes;
+#if !SCR_SMALL_ALLOC
+  char **blocks;
+  size_t nblocks, cap;
+#endif
+  _Alignas(16) char inline_chunk[SCR_ARENA_INLINE];
+};
+/* llvm/arenas.ts addresses these fields in pointer-sized units. */
+#define SCR_ARENA_PTR sizeof(void *)
+_Static_assert(offsetof(ScrArena, bump) == 0 && offsetof(ScrArena, limit) == SCR_ARENA_PTR,
+               "llvm/arenas.ts bumps the arena inline");
+_Static_assert(offsetof(ScrArena, disposals) == 2 * SCR_ARENA_PTR &&
+                   offsetof(ScrArena, disposals_end) == 3 * SCR_ARENA_PTR &&
+                   offsetof(ScrArena, closed) == 4 * SCR_ARENA_PTR,
+               "llvm/arenas.ts appends to the dispose list inline");
+_Static_assert(sizeof(ScrArenaDisposal) == 2 * SCR_ARENA_PTR,
+               "llvm/arenas.ts stores dispose entries of two pointers");
+_Static_assert(offsetof(ScrArenaHead, disposals) == offsetof(ScrArena, disposals) &&
+                   offsetof(ScrArenaHead, closed) == offsetof(ScrArena, closed),
+               "ScrArenaHead is ScrArena's prefix");
+
+SCR_TL ScrArena *scr_arena_cur = NULL;
+static SCR_TL ScrArena *scr_arena_pool;
+static SCR_TL unsigned scr_arena_pooled;
+static SCR_TL ScrArenaChunk *scr_arena_chunk_pool;
+static SCR_TL size_t scr_arena_chunk_bytes;
+
+void *scr_arena_current(void) { return scr_arena_cur; }
+
+void *scr_arena_suspend(void) {
+  ScrArena *a = scr_arena_cur;
+  scr_arena_cur = NULL;
+  return a;
+}
+
+void scr_arena_resume(void *arena) { scr_arena_cur = (ScrArena *)arena; }
+
+void *scr_arena_open(void **list, int32_t closed) {
+  ScrArena *a = scr_arena_pool;
+  if (a) {
+    scr_arena_pool = a->next;
+    scr_arena_pooled--;
+  } else {
+    a = malloc(sizeof *a);
+    if (!a) scr_trap("scriptc: out of memory\n");
+    a->disposal_base = NULL;
+    a->disposals_end = NULL;
+#if !SCR_SMALL_ALLOC
+    a->blocks = NULL;
+    a->cap = 0;
+#endif
+  }
+  a->closed = closed != 0;
+  a->chunks = NULL;
+  a->bytes = 0;
+  a->disposals = a->disposal_base;
+#if SCR_SMALL_ALLOC
+  a->bump = a->inline_chunk;
+  a->limit = a->inline_chunk + SCR_ARENA_INLINE;
+#else
+  a->bump = a->limit = NULL;
+  a->nblocks = 0;
+#endif
+  a->open = 1;
+  a->outer = scr_arena_cur;
+  scr_arena_cur = a;
+  a->next = (ScrArena *)*list;
+  *list = a;
+  return a;
+}
+
+/* Makes `a`'s outer target current again, if `a` is still the target or
+ * under it: an exception can leave the arenas a call opened unclosed until
+ * their scopes drop them. */
+static void scr_arena_unlink(ScrArena *a) {
+  if (!a->open) return;
+  a->open = 0;
+  for (ScrArena *t = scr_arena_cur; t; t = t->outer)
+    if (t == a) {
+      scr_arena_cur = a->outer;
+      return;
+    }
+}
+
+void scr_arena_close(void *arena) {
+  if (arena) scr_arena_unlink((ScrArena *)arena);
+}
+
+void scr_arena_disposal(void *arena, void *obj, ScrArenaDispose dispose) {
+  ScrArena *a = (ScrArena *)arena;
+  if (a->disposals == a->disposals_end) {
+    size_t n = (size_t)(a->disposals - a->disposal_base);
+    size_t cap = n ? n * 2 : 64;
+    ScrArenaDisposal *grown = realloc(a->disposal_base, cap * sizeof *grown);
+    if (!grown) scr_trap("scriptc: out of memory\n");
+    a->disposal_base = grown;
+    a->disposals = grown + n;
+    a->disposals_end = grown + cap;
+  }
+  a->disposals->obj = obj;
+  a->disposals->dispose = dispose;
+  a->disposals++;
+}
+
+#if SCR_SMALL_ALLOC
+static ScrArenaChunk *scr_arena_chunk(size_t want) {
+  for (ScrArenaChunk **p = &scr_arena_chunk_pool; *p; p = &(*p)->next)
+    if ((*p)->size >= want) {
+      ScrArenaChunk *c = *p;
+      *p = c->next;
+      scr_arena_chunk_bytes -= c->size;
+      return c;
+    }
+  ScrArenaChunk *c = malloc(want);
+  if (!c) scr_trap("scriptc: out of memory\n");
+  c->size = want;
+  return c;
+}
+
+static char *scr_arena_chunk_start(ScrArenaChunk *c) {
+  return (char *)(((uintptr_t)(c + 1) + 15) & ~(uintptr_t)15);
+}
+
+/* A new current chunk with room for `n` bytes, or false past the cap
+ * when `capped`. */
+static bool scr_arena_refill(ScrArena *a, size_t n, bool capped) {
+  size_t want = a->chunks ? a->chunks->size * 2 : SCR_ARENA_CHUNK_MIN;
+  if (want > SCR_ARENA_CHUNK_MAX) want = SCR_ARENA_CHUNK_MAX;
+  size_t need = n + sizeof(ScrArenaChunk) + 15;
+  if (want < need) want = need;
+  if (capped && a->bytes + want > SCR_ARENA_CAP) return false;
+  ScrArenaChunk *c = scr_arena_chunk(want);
+  a->bytes += c->size;
+  c->next = a->chunks;
+  a->chunks = c;
+  a->bump = scr_arena_chunk_start(c);
+  a->limit = (char *)c + c->size;
+  return true;
+}
+#endif
+
+void *scr_arena_obj(void *arena, size_t size, void *cyc) {
+  ScrArena *a = (ScrArena *)arena;
+  size_t hdr = cyc ? sizeof(ScrCycHdr) : 0;
+  bool capped = !a->closed && !cyc;
+  if (capped && size > SCR_ARENA_CAP) return NULL;
+  size_t n = (hdr + size + 7) & ~(size_t)7;
+#if SCR_SMALL_ALLOC
+  if ((size_t)(a->limit - a->bump) < n && !scr_arena_refill(a, n, capped)) return NULL;
+  char *block = a->bump;
+  a->bump += n;
+  memset(block, 0, n);
+#else
+  if (capped && a->bytes + n > SCR_ARENA_CAP) return NULL;
+  a->bytes += n;
+  if (a->nblocks == a->cap) {
+    size_t cap = a->cap ? a->cap * 2 : 16;
+    char **grown = realloc(a->blocks, cap * sizeof *grown);
+    if (!grown) scr_trap("scriptc: out of memory\n");
+    a->blocks = grown;
+    a->cap = cap;
+  }
+  char *block = calloc(1, n);
+  if (!block) scr_trap("scriptc: out of memory\n");
+  a->blocks[a->nblocks++] = block;
+#endif
+  if (!cyc) return block;
+  ScrCycHdr *ch = (ScrCycHdr *)block;
+  ch->id = (uint16_t)scr_cyc_type_id((ScrCycType *)cyc);
+  ch->buf = SCR_CYC_ACYCLIC;
+  return block + hdr;
+}
+
+static void scr_arena_free(ScrArena *a) {
+  /* Every entry before any memory: a release can reach another object of
+   * the arena. Newest first, the reverse of construction. */
+  for (ScrArenaDisposal *d = a->disposals; d != a->disposal_base;) {
+    d--;
+    d->dispose(d->obj);
+  }
+  if ((size_t)(a->disposals_end - a->disposal_base) > SCR_ARENA_POOL_DISPOSALS) {
+    free(a->disposal_base);
+    a->disposal_base = a->disposals_end = NULL;
+  }
+#if SCR_SMALL_ALLOC
+  for (ScrArenaChunk *c = a->chunks, *next; c; c = next) {
+    next = c->next;
+    if (scr_arena_chunk_bytes + c->size <= SCR_ARENA_POOL_BYTES) {
+      c->next = scr_arena_chunk_pool;
+      scr_arena_chunk_pool = c;
+      scr_arena_chunk_bytes += c->size;
+    } else
+      free(c);
+  }
+  if (scr_arena_pooled < SCR_ARENA_POOL) {
+    a->next = scr_arena_pool;
+    scr_arena_pool = a;
+    scr_arena_pooled++;
+    return;
+  }
+#else
+  for (size_t i = 0; i < a->nblocks; i++) free(a->blocks[i]);
+  free(a->blocks);
+#endif
+  free(a->disposal_base);
+  free(a);
+}
+
+void scr_arena_drop(void **list) {
+  ScrArena *a = (ScrArena *)*list;
+  *list = NULL;
+  while (a) {
+    ScrArena *next = a->next;
+    scr_arena_unlink(a);
+    scr_arena_free(a);
+    a = next;
+  }
+}

packages/runtime/src/scr_arena.h

@@ -0,0 +1,115 @@
+#ifndef SCR_ARENA_H
+#define SCR_ARENA_H
+/* Group arenas (llvm/region-groups.ts, llvm/arenas.ts): the objects a call
+ * allocates while the compiler has proven they die together, bump-allocated
+ * and released at once.
+ *
+ * Two kinds of call open one:
+ * - a fresh-result call (a root) whose value its caller keeps in one scope:
+ *   the arena stays the allocation target while the call runs, and is
+ *   dropped when that scope exits, on every path;
+ * - a call region, a call of a function that keeps nothing it allocates
+ *   and returns no reference: the arena is dropped when the call returns.
+ *
+ * Only allocation sites in functions the compiler reached from such a call
+ * consult the target (scr_arena_cur), and only those whose value the group
+ * keeps (llvm/region-sites.ts), so runtime-internal allocations and
+ * temporaries never land in an arena.
+ *
+ * An arena object is an ordinary object with an ordinary count, starting
+ * at SCR_ARENA_RC instead of 1, so no release reaches zero while it lives:
+ * no teardown, no free, and (with `buf` SCR_CYC_ACYCLIC) never a collector
+ * candidate. The count is far below SCR_RC_PUBLISHED, so the arena object
+ * stays mutable and thread-local like any other. Dropping the arena runs
+ * its dispose list, whose entries release their objects' fields (and
+ * storage) without freeing the objects, and then recycles the memory. A
+ * closed arena's objects hold only each other and immortal values, so only
+ * objects with storage of their own (arrays) go on its list.
+ *
+ * Without the small-object allocator (sanitized and audit builds), every
+ * arena object is a block of its own that the drop frees, so a use after
+ * the drop is a use after free that the sanitizer reports. */
+#include "scr_core.h"
+
+#include <stddef.h>
+#include <stdint.h>
+
+/* The starting count of an arena object (a count, in the low 32 bits of
+ * the rc word, so it also suits classes that keep their id in the high
+ * half). */
+#define SCR_ARENA_RC ((uint32_t)1 << 29)
+
+typedef struct ScrArena ScrArena;
+/* Releases what an arena object holds (its fields, an array's storage)
+ * without freeing the object. */
+typedef void (*ScrArenaDispose)(void *obj);
+
+/* An entry of an arena's dispose list. The emitted arena-aware
+ * constructors append one inline for an object whose type has fields to
+ * release, unless the arena is closed (llvm/arenas.ts). */
+typedef struct ScrArenaDisposal {
+  void *obj;
+  ScrArenaDispose dispose;
+} ScrArenaDisposal;
+
+/* The arena that allocation sites in arena-aware functions use, or NULL.
+ * Emitted code reads scr_arena_cur directly outside worker programs. */
+extern SCR_TL ScrArena *scr_arena_cur;
+void *scr_arena_current(void);
+/* Stops any arena being the allocation target while a call whose value
+ * its group does not keep runs; returns the target, which
+ * scr_arena_resume restores. */
+void *scr_arena_suspend(void);
+void scr_arena_resume(void *arena);
+/* Opens an arena as the allocation target and links it onto `*list`, the
+ * list its scope drops. Returns it. A `closed` arena's objects hold only
+ * each other and immortal values (the compiler proved it), so dropping it
+ * releases nothing. */
+void *scr_arena_open(void **list, int32_t closed);
+/* Stops `arena` (may be NULL) being the allocation target; its objects
+ * live on until its list is dropped. */
+void scr_arena_close(void *arena);
+/* Drops every arena on `*list`, newest first, and clears the list. */
+void scr_arena_drop(void **list);
+/* A zeroed object of `size` bytes in `arena` (behind a collector header
+ * when `cyc` is not NULL, its `buf` SCR_CYC_ACYCLIC), for when the emitted
+ * bump finds no room: a new chunk. Returns NULL when an arena that is not
+ * closed is past its byte cap and `cyc` is NULL, and the caller allocates
+ * on the heap. The caller stores the count (SCR_ARENA_RC). */
+void *scr_arena_obj(void *arena, size_t size, void *cyc);
+/* Appends `obj` to `arena`'s dispose list, which the drop runs. */
+void scr_arena_disposal(void *arena, void *obj, ScrArenaDispose dispose);
+
+/* The leading fields of an arena (scr_arena.c's ScrArena), for the
+ * runtime's own inline allocation. */
+typedef struct ScrArenaHead {
+  char *bump, *limit;
+  ScrArenaDisposal *disposals, *disposals_end;
+  uint32_t closed;
+} ScrArenaHead;
+
+/* `n` bytes (a multiple of 8) from `arena`'s current chunk, not cleared,
+ * or NULL when the chunk has no room (scr_arena_obj takes a new one). */
+static inline void *scr_arena_bump(void *arena, size_t n) {
+  ScrArenaHead *h = (ScrArenaHead *)arena;
+  if ((size_t)(h->limit - h->bump) < n) return NULL;
+  char *p = h->bump;
+  h->bump = p + n;
+  return p;
+}
+
+/* scr_arena_disposal with the append inline. */
+static inline void scr_arena_dispose_later(void *arena, void *obj, ScrArenaDispose dispose) {
+  ScrArenaHead *h = (ScrArenaHead *)arena;
+  if (h->disposals == h->disposals_end) {
+    scr_arena_disposal(arena, obj, dispose);
+    return;
+  }
+  h->disposals->obj = obj;
+  h->disposals->dispose = dispose;
+  h->disposals++;
+}
+
+static inline int scr_arena_is_closed(void *arena) { return ((ScrArenaHead *)arena)->closed != 0; }
+
+#endif

packages/runtime/src/scr_arena.test.c

@@ -0,0 +1,108 @@
+/* Group arenas (scr_arena.h): allocation, nesting, closing and dropping,
+ * and the drop's dispose list. Prints one line per check. */
+#include "scr_runtime.h"
+
+#include <stdio.h>
+#include <string.h>
+
+typedef struct {
+  int64_t rc;
+  int64_t id;
+} TestObj;
+
+static int disposed;
+static int64_t disposed_sum;
+static void test_dispose(void *obj) {
+  disposed++;
+  disposed_sum += ((TestObj *)obj)->id;
+}
+/* What an emitted arena-aware constructor does: the object, and its
+ * dispose entry unless the arena is closed. */
+static TestObj *obj(void *arena, int64_t id, int closed) {
+  TestObj *o = scr_arena_obj(arena, sizeof *o, NULL);
+  if (!o) return NULL;
+  o->rc = SCR_ARENA_RC;
+  o->id = id;
+  if (!closed) scr_arena_disposal(arena, o, test_dispose);
+  return o;
+}
+
+int main(void) {
+  /* An open arena is the allocation target until it closes. */
+  void *list = NULL;
+  void *a = scr_arena_open(&list, 0);
+  printf("current while open: %s\n", scr_arena_current() == a ? "yes" : "no");
+  TestObj *first = obj(a, 1, 0);
+  int zero = 1, adjacent = 1;
+  TestObj *prev = first;
+  for (int i = 0; i < 16; i++) {
+    TestObj *o = scr_arena_obj(a, sizeof *o, NULL);
+    if (o->rc != 0 || o->id != 0) zero = 0;
+    if ((char *)o != (char *)(prev + 1)) adjacent = 0;
+    prev = o;
+  }
+  printf("objects start zeroed: %s\n", zero ? "yes" : "no");
+#if !SCR_SMALL_ALLOC
+  adjacent = 1; /* a block per object */
+#endif
+  printf("objects without headers: %s\n", adjacent ? "yes" : "no");
+  /* A nested arena makes the outer one current again when it closes. */
+  void *inner_list = NULL;
+  void *b = scr_arena_open(&inner_list, 0);
+  for (int i = 0; i < 10; i++) obj(b, 100, 0);
+  scr_arena_close(b);
+  scr_arena_close(b);
+  printf("outer current after inner close: %s\n", scr_arena_current() == a ? "yes" : "no");
+  scr_arena_drop(&inner_list);
+  printf("inner drop disposed %d (sum %lld)\n", disposed, (long long)disposed_sum);
+  /* Many objects span chunks; each is disposed once. */
+  disposed = 0;
+  disposed_sum = 0;
+  for (int i = 0; i < 100000; i++) obj(a, 1, 0);
+  scr_arena_close(a);
+  printf("current after close: %s\n", scr_arena_current() == NULL ? "none" : "some");
+  scr_arena_drop(&list);
+  printf("drop disposed %d (sum %lld), list %s\n", disposed, (long long)disposed_sum,
+         list == NULL ? "cleared" : "kept");
+
+  /* A closed arena's objects take no dispose entries, and it has no cap. */
+  disposed = 0;
+  void *closed = scr_arena_open(&list, 1);
+  int held = 0;
+  for (int i = 0; i < 3000000; i++)
+    if (obj(closed, 1, 1)) held++;
+  scr_arena_drop(&list);
+  printf("closed arena held %d, disposed %d, current %s\n", held, disposed,
+         scr_arena_current() == NULL ? "none" : "some");
+
+  /* Past the byte cap an arena that is not closed refuses, and its drop
+   * disposes everything it holds. */
+  disposed = 0;
+  void *capped = scr_arena_open(&list, 0);
+  int refused = 0;
+  held = 0;
+  for (int i = 0; i < 3000000 && !refused; i++) {
+    if (obj(capped, 1, 0))
+      held++;
+    else
+      refused = 1;
+  }
+  scr_arena_drop(&list);
+  printf("cap refused: %s, all disposed: %s\n", refused ? "yes" : "no", disposed == held ? "yes" : "no");
+
+  /* A drop of an arena that is still open (an exception skipped its close)
+   * restores the target it replaced. */
+  void *outer_list = NULL, *skipped_list = NULL;
+  void *outer = scr_arena_open(&outer_list, 0);
+  scr_arena_open(&skipped_list, 0);
+  scr_arena_drop(&skipped_list);
+  printf("target after dropping an open arena: %s\n", scr_arena_current() == outer ? "outer" : "other");
+  /* A suspended arena is no target until it resumes. */
+  void *saved = scr_arena_suspend();
+  printf("target while suspended: %s\n", scr_arena_current() == NULL ? "none" : "some");
+  scr_arena_resume(saved);
+  printf("target after resume: %s\n", scr_arena_current() == outer ? "outer" : "other");
+  scr_arena_close(outer);
+  scr_arena_drop(&outer_list);
+  return 0;
+}

packages/runtime/src/scr_arena.test.ts

@@ -0,0 +1,67 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { describe, expect, test } from "vitest";
+import { EXECUTABLE_RUNTIME_SOURCES } from "../../compiler/src/backend/native-toolchain.js";
+
+const exec = promisify(execFile);
+
+const EXPECTED = [
+  "current while open: yes",
+  "objects start zeroed: yes",
+  "objects without headers: yes",
+  "outer current after inner close: yes",
+  "inner drop disposed 10 (sum 1000)",
+  "current after close: none",
+  "drop disposed 100001 (sum 100001), list cleared",
+  "closed arena held 3000000, disposed 0, current none",
+  "cap refused: yes, all disposed: yes",
+  "target after dropping an open arena: outer",
+  "target while suspended: none",
+  "target after resume: outer",
+];
+
+// The size-class allocator build (chunks, the inline bump's fields), and
+// the sanitized lane's build (a block per object, freed by the drop).
+describe.skipIf(process.platform === "win32")("group arenas", () => {
+  test.each([
+    ["size-class", ["-fsanitize=undefined"]],
+    ["sanitized", ["-fsanitize=address,undefined", "-DSCR_RC_AUDIT"]],
+  ])(
+    "open, allocate, close and drop (%s)",
+    async (_lane, flags) => {
+      const dir = await mkdtemp(join(tmpdir(), "scriptc-arena-"));
+      try {
+        const bin = join(dir, "arena");
+        await exec("clang", [
+          "-std=c11",
+          "-O1",
+          "-pthread",
+          "-Wno-deprecated-declarations",
+          ...(process.platform === "linux" ? ["-D_GNU_SOURCE"] : []),
+          ...flags,
+          ...["scr_arena.test.c", ...EXECUTABLE_RUNTIME_SOURCES].map((source) =>
+            join(import.meta.dirname, source),
+          ),
+          ...(process.platform === "linux" ? ["-lm"] : []),
+          "-o",
+          bin,
+        ]);
+        const { stdout } = await exec(bin, [], {
+          timeout: 60000,
+          env: {
+            ...process.env,
+            ASAN_OPTIONS: "halt_on_error=1",
+            UBSAN_OPTIONS: "halt_on_error=1",
+          },
+        });
+        expect(stdout.trim().split("\n")).toEqual(EXPECTED);
+      } finally {
+        await rm(dir, { recursive: true, force: true });
+      }
+    },
+    300000,
+  );
+});

packages/runtime/src/scr_array.c

@@ -1426,15 +1426,53 @@ static void scr_arr_put_slots(ScrArr *a, size_t to, size_t count, const uint64_t
 
 /* Inlined into each constructor, so `small` and the slot unit fold to
  * constants there. */
+static void scr_arr_arena_dispose(void *object);
+static void scr_arr_arena_dispose_closed(void *object);
+static ScrCycType scr_arr_cyc_type;
+
+/* An array block of `size` bytes in the current group arena, or NULL.
+ * Its storage beyond the block is the heap's, so it goes on the arena's
+ * dispose list even when the arena is closed; there, its elements are
+ * arena objects and immortal values, which need no release. */
+static inline ScrArr *scr_arr_arena_block(size_t size, bool cyc) {
+  void *arena = scr_arena_cur;
+  if (!arena) return NULL;
+  size_t hdr = cyc ? sizeof(ScrCycHdr) : 0;
+  size_t n = (hdr + size + 7) & ~(size_t)7;
+  uint32_t id = cyc ? scr_cyc_type_id(&scr_arr_cyc_type) : 0;
+  char *block = scr_arena_bump(arena, n);
+  ScrArr *a;
+  if (block) {
+    /* The constructor sets every header field, as on the heap; only the
+     * collector header needs setting here. */
+    if (cyc) *(ScrCycHdr *)block = (ScrCycHdr){.id = (uint16_t)id, .buf = SCR_CYC_ACYCLIC};
+    a = (ScrArr *)(block + hdr);
+  } else {
+    a = scr_arena_obj(arena, size, cyc ? &scr_arr_cyc_type : NULL);
+    if (!a) return NULL;
+  }
+  scr_arena_dispose_later(arena, a,
+                          scr_arena_is_closed(arena) ? scr_arr_arena_dispose_closed
+                                                     : scr_arr_arena_dispose);
+  return a;
+}
+
 static inline __attribute__((always_inline)) ScrArr *scr_arr_make(ScrElemKind elem,
                                                                   size_t initial_cap,
-                                                                  bool small) {
+                                                                  bool small,
+                                                                  bool arena) {
   size_t unit = scr_elem_slot_width(elem);
   size_t inline_cap = small ? scr_arr_small_cap(SCR_ARR_INLINE_OFFSET, unit)
                             : scr_arr_known_cap(SCR_ARR_INLINE_OFFSET, initial_cap, unit);
-  ScrArr *a = scr_mem_alloc(inline_cap ? SCR_ARR_INLINE_OFFSET + inline_cap * unit : sizeof(ScrArr));
-  if (!a) scr_arr_oom();
-  a->rc = 1;
+  size_t size = inline_cap ? SCR_ARR_INLINE_OFFSET + inline_cap * unit : sizeof(ScrArr);
+  ScrArr *a = arena ? scr_arr_arena_block(size, false) : NULL;
+  if (a)
+    a->rc = SCR_ARENA_RC;
+  else {
+    a = scr_mem_alloc(size);
+    if (!a) scr_arr_oom();
+    a->rc = 1;
+  }
   a->len = 0;
   a->cap = 0;
   a->elem = (uint8_t)elem;
@@ -1451,10 +1489,16 @@ static inline __attribute__((always_inline)) ScrArr *scr_arr_make(ScrElemKind el
 }
 
 ScrArr *scr_arr_new(ScrElemKind elem, size_t initial_cap) {
-  return scr_arr_make(elem, initial_cap, false);
+  return scr_arr_make(elem, initial_cap, false, false);
 }
 
-ScrArr *scr_arr_new_small(ScrElemKind elem) { return scr_arr_make(elem, 0, true); }
+ScrArr *scr_arr_new_small(ScrElemKind elem) { return scr_arr_make(elem, 0, true, false); }
+
+ScrArr *scr_arr_new_r(ScrElemKind elem, size_t initial_cap) {
+  return scr_arr_make(elem, initial_cap, false, true);
+}
+
+ScrArr *scr_arr_new_small_r(ScrElemKind elem) { return scr_arr_make(elem, 0, true, true); }
 
 /* A non-cycle array whose final length the runtime knows when it builds
  * it (regex match results): its `cap` slots share the header's block, so
@@ -1463,7 +1507,7 @@ ScrArr *scr_arr_new_small(ScrElemKind elem) { return scr_arr_make(elem, 0, true)
  * `cap` moves the slots out like any inline array. */
 ScrArr *scr_arr_new_inline(ScrElemKind elem, size_t cap, bool states) {
   if (cap == 0) {
-    ScrArr *a = scr_arr_make(elem, 0, false);
+    ScrArr *a = scr_arr_make(elem, 0, false, false);
     if (states) a->spare |= SCR_ARR_STATES;
     return a;
   }
@@ -1572,13 +1616,16 @@ static void scr_arr_gc_free(void *a0) {
   scr_cyc_free_inline(a);
 }
 
+static ScrCycType scr_arr_cyc_type = {&scr_arr_trace_v, &scr_arr_gc_free, SCR_CYC_KIND_ARRAY};
+
 /* Inlined into each constructor like scr_arr_make: with `small`, the count
  * and `elem` constant, scr_arr_new_ops_small's size class folds to a table
  * index and the slot sizes to constants. */
 static inline __attribute__((always_inline)) ScrArr *scr_arr_make_ops_kind(const ScrArrOps *ops,
                                                                            size_t initial_cap,
                                                                            bool small,
-                                                                           uint8_t elem) {
+                                                                           uint8_t elem,
+                                                                           bool arena) {
   ScrArr *a;
   bool cyc = ops->trace != NULL;
   /* The array starts without states: slots of the value width alone. */
@@ -1587,14 +1634,18 @@ static inline __attribute__((always_inline)) ScrArr *scr_arr_make_ops_kind(const
   size_t inline_cap =
       small ? scr_arr_small_cap(prefix, unit) : scr_arr_known_cap(prefix, initial_cap, unit);
   size_t size = inline_cap ? SCR_ARR_INLINE_OFFSET + inline_cap * unit : sizeof(ScrArr);
-  if (cyc) {
-    static ScrCycType cyc_type = { &scr_arr_trace_v, &scr_arr_gc_free, SCR_CYC_KIND_ARRAY };
-    a = scr_cyc_alloc_inline(size, &cyc_type);
-  } else {
-    a = scr_mem_alloc(size);
-    if (!a) scr_arr_oom();
+  a = arena ? scr_arr_arena_block(size, cyc) : NULL;
+  if (a)
+    a->rc = SCR_ARENA_RC;
+  else {
+    if (cyc)
+      a = scr_cyc_alloc_inline(size, &scr_arr_cyc_type);
+    else {
+      a = scr_mem_alloc(size);
+      if (!a) scr_arr_oom();
+    }
+    a->rc = 1;
   }
-  a->rc = 1;
   a->len = 0;
   a->cap = 0;
   a->elem = elem;
@@ -1622,17 +1673,26 @@ static inline __attribute__((always_inline)) ScrArr *scr_arr_make_ops_kind(const
  * branch inlines scr_arr_make_ops_kind with a constant kind. */
 static inline __attribute__((always_inline)) ScrArr *scr_arr_make_ops(const ScrArrOps *ops,
                                                                       size_t initial_cap,
-                                                                      bool small) {
+                                                                      bool small,
+                                                                      bool arena) {
   if (__builtin_expect(scr_arr_ops_compact(ops), 0))
-    return scr_arr_make_ops_kind(ops, initial_cap, small, SCR_ELEM_CREF);
-  return scr_arr_make_ops_kind(ops, initial_cap, small, SCR_ELEM_REF);
+    return scr_arr_make_ops_kind(ops, initial_cap, small, SCR_ELEM_CREF, arena);
+  return scr_arr_make_ops_kind(ops, initial_cap, small, SCR_ELEM_REF, arena);
 }
 
 ScrArr *scr_arr_new_ops(const ScrArrOps *ops, size_t initial_cap) {
-  return scr_arr_make_ops(ops, initial_cap, false);
+  return scr_arr_make_ops(ops, initial_cap, false, false);
 }
 
-ScrArr *scr_arr_new_ops_small(const ScrArrOps *ops) { return scr_arr_make_ops(ops, 0, true); }
+ScrArr *scr_arr_new_ops_small(const ScrArrOps *ops) { return scr_arr_make_ops(ops, 0, true, false); }
+
+/* The constructors arena-aware functions call (llvm/arenas.ts): in the
+ * current group arena when one is open. */
+ScrArr *scr_arr_new_ops_r(const ScrArrOps *ops, size_t initial_cap) {
+  return scr_arr_make_ops(ops, initial_cap, false, true);
+}
+
+ScrArr *scr_arr_new_ops_small_r(const ScrArrOps *ops) { return scr_arr_make_ops(ops, 0, true, true); }
 
 /* Frees an acyclic array whose elements are already released. */
 static inline __attribute__((always_inline)) void scr_arr_free(ScrArr *a) {
@@ -1746,6 +1806,26 @@ static void scr_arr_destroy(void *object) {
   else scr_arr_free(a);
 }
 
+/* An arena array at its arena's drop: its contents and the storage beyond
+ * its block go; the block goes with the arena. */
+static void scr_arr_arena_dispose(void *object) {
+  ScrArr *a = object;
+  scr_arr_release_contents(a);
+  scr_arr_free_parts(a);
+#ifdef SCR_RC_AUDIT
+  scr_live_arrays--;
+#endif
+}
+
+/* The same in a closed arena, whose objects hold only each other and
+ * immortal values: only the storage beyond the block goes. */
+static void scr_arr_arena_dispose_closed(void *object) {
+  scr_arr_free_parts((ScrArr *)object);
+#ifdef SCR_RC_AUDIT
+  scr_live_arrays--;
+#endif
+}
+
 void scr_arr_subclass_init(ScrArr *a, uint8_t elem, const ScrArrOps *ops, const ScrArrClass *cls,
                            bool cyc) {
   a->len = 0;

packages/runtime/src/scr_array.h

@@ -490,6 +490,12 @@ ScrArr *scr_arr_new_small(ScrElemKind elem);
  * SCR_ELEM_F64); no-op for any other kind. */
 void scr_arr_widen_i32(ScrArr *a);
 ScrArr *scr_arr_new_ops_small(const ScrArrOps *ops);
+/* The same constructors in the current group arena, when one is open
+ * (scr_arena.h): what arena-aware functions call. */
+ScrArr *scr_arr_new_r(ScrElemKind elem, size_t initial_cap);
+ScrArr *scr_arr_new_small_r(ScrElemKind elem);
+ScrArr *scr_arr_new_ops_r(const ScrArrOps *ops, size_t initial_cap);
+ScrArr *scr_arr_new_ops_small_r(const ScrArrOps *ops);
 /* scr_arr_new(elem, cap) for a known final length: the `cap` slots share
  * the array's own block (one allocation). With `states`, the array starts
  * with states (for holes or present undefined). Returns +1. */

packages/runtime/src/scr_async.c

@@ -1518,7 +1518,11 @@ static void scr_switch(ScrCtx *from, ScrCtx *to, ScrFiber *to_fiber) {
   (void)to;
   scr_trap("scriptc: internal error: native stack switch reached on WASI\n");
 #elif defined(SCR_ASAN_FIBERS)
-  void **save = from_fiber ? &from_fiber->fake_stack : &scr_main_fake_stack;
+  /* A finished fiber leaves for the last time: a NULL slot has
+   * AddressSanitizer free its fake stack, which otherwise stays mapped
+   * until exit. */
+  void **save = from_fiber ? (from_fiber->done ? NULL : &from_fiber->fake_stack)
+                           : &scr_main_fake_stack;
   const void *bottom = to_fiber ? to_fiber->stack : NULL;
   size_t size = to_fiber ? SCR_FIBER_STACK : 0;
   __sanitizer_start_switch_fiber(save, bottom, size);
@@ -1527,10 +1531,13 @@ static void scr_switch(ScrCtx *from, ScrCtx *to, ScrFiber *to_fiber) {
 #else
   swapcontext(from, to);
 #endif
+  /* Back in this frame: the context that saved into `save` above runs
+   * again, whichever fiber `scr_current` names (a finished fiber returns
+   * to its resumer with no fiber to switch to). */
   const void *old_bottom;
   size_t old_size;
-  __sanitizer_finish_switch_fiber(
-      scr_current ? scr_current->fake_stack : scr_main_fake_stack, &old_bottom, &old_size);
+  __sanitizer_finish_switch_fiber(from_fiber ? from_fiber->fake_stack : scr_main_fake_stack,
+                                  &old_bottom, &old_size);
 #elif defined(SCR_FAST_CTX)
   scr_ctx_swap(from, to);
 #else
@@ -2228,6 +2235,7 @@ static void scr_prefix_trampoline(void) {
   scr_als_active = &f->als;
   entry(f, argpack);
   scr_current = carrier;
+  carrier->done = true; /* its stack is freed once the spawner is back */
   scr_switch(&carrier->ctx, carrier->return_to, NULL);
   /* unreachable */
 }
@@ -5435,6 +5443,14 @@ ScrGen *scr_async_gen_new(void (*entry)(ScrFiber *, void *), void *argpack,
   return scr_gen_new_common(entry, argpack, drop_args, settle, false);
 }
 
+#ifndef __wasi__
+ScrGen *scr_async_gen_new_stackless(void (*entry)(ScrFiber *, void *), void *argpack,
+                                    void (*drop_args)(void *),
+                                    void (*settle)(ScrGen *, ScrPromise *)) {
+  return scr_gen_new_common(entry, argpack, drop_args, settle, true);
+}
+#endif
+
 ScrGen *scr_gen_retain(ScrGen *g) {
   if (g) g->rc++;
   return g;
@@ -5783,7 +5799,7 @@ void scr_gen_ret_to_out(ScrGen *g) {
  * settle the generator's state, moving a finished body's exception to the
  * resumer and tearing the finished fiber down. `release` drops the hop's
  * own reference (see scr_gen_switch_in); `sync` marks a body known to be a
- * synchronous generator (every stackless one is). */
+ * synchronous generator. */
 __attribute__((always_inline)) static inline void scr_gen_switched_back(ScrGen *g, ScrFiber *f,
                                                                   bool release, bool sync) {
   if (__builtin_expect(f->done, 0)) {
@@ -5820,10 +5836,12 @@ static __attribute__((noinline)) void scr_async_gen_step_end(ScrFiber *f) { scr_
 
 #ifndef __wasi__
 /* The stackless form of the hop: the coroutine frame runs on this stack
- * until its next yield or its final suspension returns here. `retain`
- * holds the generator across the hop; a resumer whose own reference
- * provably outlives the hop passes false. */
-__attribute__((always_inline)) static inline void scr_gen_coro_hop(ScrGen *g, bool retain) {
+ * until its next yield, an async generator's await, or its final
+ * suspension returns here. `retain` holds the generator across the hop; a
+ * resumer whose own reference provably outlives the hop passes false.
+ * `sync` marks a body known to be a synchronous generator. */
+__attribute__((always_inline)) static inline void scr_gen_coro_hop(ScrGen *g, bool retain,
+                                                                  bool sync) {
   ScrFiber *f = g->fiber;
   if (retain) scr_gen_retain(g);
   /* A synchronous generator has no AsyncLocalStorage context of its own:
@@ -5848,10 +5866,29 @@ __attribute__((always_inline)) static inline void scr_gen_coro_hop(ScrGen *g, bo
   scr_exc_swap_cell(me != NULL ? &me->exc : NULL);
   scr_als_active = resumer_slot;
   if (g->is_async) scr_async_gen_step_end(f);
-  scr_gen_switched_back(g, f, retain, true);
+  scr_gen_switched_back(g, f, retain, sync);
 }
 
-static void scr_gen_coro_in(ScrGen *g) { scr_gen_coro_hop(g, true); }
+/* An async generator's step can resume the next one down a chain of them
+ * before it suspends, all on one stack, through runtime frames that check
+ * no guard: a step that would start below the stack guard throws the
+ * RangeError compiled code throws there, which rejects its request. */
+static __attribute__((noinline)) void scr_async_gen_coro_in(ScrGen *g) {
+  uintptr_t guard = scr_stack_guard;
+  if (guard != 0 && (uintptr_t)__builtin_frame_address(0) < guard) {
+    /* scr_stack_overflow's error, thrown here: this unit links without
+     * scr_context.c in the runtime's own tests. */
+    static const char text[] = "Maximum call stack size exceeded";
+    scr_throw_error_msg(SCR_ERR_RANGE, text, sizeof text - 1);
+    return;
+  }
+  scr_gen_coro_hop(g, true, false);
+}
+
+static void scr_gen_coro_in(ScrGen *g) {
+  if (g->is_async) scr_async_gen_coro_in(g);
+  else scr_gen_coro_hop(g, true, true);
+}
 #endif
 
 /* The consumer→fiber hop shared by every resume mode: switches in, and on
@@ -5947,8 +5984,9 @@ void scr_gen_close(ScrGen *g) {
 bool scr_gen_step(ScrGen *g) {
   if (g->in.kind != SCR_EXC_NONE) scr_gen_slot_reset(&g->in);
 #ifndef __wasi__
-  if ((g->state == SCR_GEN_SUSPENDED || g->state == SCR_GEN_UNSTARTED) && g->fiber->stackless) {
-    scr_gen_coro_hop(g, false);
+  if ((g->state == SCR_GEN_SUSPENDED || g->state == SCR_GEN_UNSTARTED) && g->fiber->stackless &&
+      !g->is_async) {
+    scr_gen_coro_hop(g, false, true);
     return g->state == SCR_GEN_DONE;
   }
 #endif

packages/runtime/src/scr_async.h

@@ -143,6 +143,9 @@ void scr_promise_rethrow_top_level(ScrPromise *p);
  * value), or NULL with the rejection re-thrown into the awaiter. */
 ScrDyn *scr_await_dyn(ScrPromise *p);
 ScrDyn *scr_await_dyn_value_settled(ScrDyn *value);
+/* The native coroutine form's extraction: the body has already suspended
+ * until the value's promise settled, or taken the non-promise hop. */
+ScrDyn *scr_coro_await_dyn_value(ScrDyn *value);
 void scr_promise_resolve_dyn(ScrPromise *destination, ScrDyn *value);
 /* `await v` over a checked-dynamic VALUE: dyn promises adopt, everything
  * else takes JS's one-hop non-thenable await and answers itself (+1). */

packages/runtime/src/scr_async_dyn.c

@@ -827,6 +827,19 @@ ScrDyn *scr_await_dyn_value_settled(ScrDyn *value) {
   return value->kind == SCR_DYN_PROMISE ? scr_await_dyn(value->v.promise) : scr_dyn_retain(value);
 }
 
+static ScrDyn *scr_dyn_promise_payload(ScrPromise *p);
+
+/* The same for a native stackless body: the suspension has taken the turn
+ * scr_await_dyn would take, so the extraction takes none. */
+ScrDyn *scr_coro_await_dyn_value(ScrDyn *value) {
+  if (value->kind != SCR_DYN_PROMISE) return scr_dyn_retain(value);
+  ScrPromise *p = value->v.promise;
+  if (!scr_promise_settled_now(p))
+    scr_trap("scriptc: internal error: resumed before awaited promise settled\n");
+  if (scr_promise_is_rejected(p)) return NULL;
+  return scr_dyn_promise_payload(p);
+}
+
 /* ── process warnings (emitWarning + the 'warning' event) ─────────────
  * Gated with the rest of this TU (a deprecation-emitting unit's gate
  * must imply the dynAsync link). Listeners are dyn functions; the

packages/runtime/src/scr_generator.h

@@ -60,6 +60,14 @@ void scr_gen_coro_finish(ScrFiber *self);
 ScrGen *scr_async_gen_new(void (*entry)(ScrFiber *, void *), void *argpack,
                           void (*drop_args)(void *),
                           void (*settle)(ScrGen *, ScrPromise *));
+/* An async generator whose body is a switched coroutine, as
+ * scr_gen_new_stackless's: its steps run on the resumer's stack (the loop's
+ * after an await), its awaits suspend through scr_coro_await_prepare and
+ * scr_coro_hop_prepare, and its yields store OUT through scr_coro_yield_*.
+ * Native targets only. */
+ScrGen *scr_async_gen_new_stackless(void (*entry)(ScrFiber *, void *), void *argpack,
+                                    void (*drop_args)(void *),
+                                    void (*settle)(ScrGen *, ScrPromise *));
 /* Runs when return() reaches the generator before its first resume, with
  * the packed arguments still alive: an iterator helper closes its source. */
 void scr_gen_set_unstarted_return(ScrGen *g, void (*hook)(void *));

packages/runtime/src/scr_js_object.test.ts

@@ -29,6 +29,7 @@ test("layouts stay within the layout and key-byte budgets, and dynamic-tier abse
         "scr_json.c",
         "scr_string.c",
         "scr_array.c",
+        "scr_arena.c",
         "scr_map.c",
         "scr_exception.c",
         "scr_error.c",

packages/runtime/src/scr_json.test.ts

@@ -30,6 +30,7 @@ test.each([false, true])(
           "scr_json.c",
           "scr_string.c",
           "scr_array.c",
+          "scr_arena.c",
           "scr_map.c",
           "scr_exception.c",
           "scr_error.c",

packages/runtime/src/scr_map.test.ts

@@ -27,6 +27,7 @@ test("number-key maps keep Map semantics across linear, direct and hashed indexe
         "scr_json.c",
         "scr_string.c",
         "scr_array.c",
+        "scr_arena.c",
         "scr_map.c",
         "scr_exception.c",
         "scr_error.c",

packages/runtime/src/scr_runtime.h

@@ -56,6 +56,7 @@
 #include "scr_blob.h"
 #include "scr_object.h"
 #include "scr_region.h"
+#include "scr_arena.h"
 #include "scr_itable.h"
 #include "scr_slots.h"
 #include "scr_async.h"

packages/runtime/src/scr_string.c

@@ -2172,11 +2172,19 @@ double scr_str_char_code_at(ScrStr *s, double i) {
 }
 
 double scr_str_index_of(ScrStr *s, ScrStr *needle, double fromIndex) {
-  /* A search from the start of a proven-ASCII receiver: byte offsets are
-   * UTF-16 indexes, and a needle with other bytes is never found. A start
-   * index that is not positive (NaN, -0 or negative) clamps to 0. */
-  if (s->ascii && !(fromIndex > 0)) {
-    const char *found = scr_byte_find(s->data, s->len, needle->data, needle->len);
+  /* A proven-ASCII receiver: byte offsets are UTF-16 indexes, and a needle
+   * with other bytes is never found. A start index that is not positive
+   * (NaN, -0 or negative) clamps to 0, a positive one truncates
+   * (ToIntegerOrInfinity) and clamps to the length, where only the empty
+   * needle is found. */
+  if (s->ascii) {
+    size_t start = 0;
+    if (fromIndex > 0) {
+      if (fromIndex >= (double)s->len) return needle->len == 0 ? (double)s->len : -1.0;
+      start = (size_t)fromIndex;
+    }
+    const char *found =
+        scr_byte_find(s->data + start, s->len - start, needle->data, needle->len);
     return found ? (double)(found - s->data) : -1.0;
   }
   double pos = scr_to_integer_or_infinity(fromIndex);

packages/runtime/test/array.test.ts

@@ -24,6 +24,7 @@ beforeAll(async () => {
     bin,
     join(testDir, "test_array.c"),
     join(testDir, "../src/scr_array.c"),
+    join(testDir, "../src/scr_arena.c"),
     // Checked-value collection equality shares the native JSON value runtime.
     join(testDir, "../src/scr_json.c"),
     join(testDir, "../src/scr_map.c"),

packages/runtime/test/bigint.test.ts

@@ -32,6 +32,7 @@ beforeAll(async () => {
     // which pull in the closure/array/box machinery
     join(testDir, "../src/scr_union.c"),
     join(testDir, "../src/scr_array.c"),
+    join(testDir, "../src/scr_arena.c"),
     // Checked-value collection equality shares the native JSON value runtime.
     join(testDir, "../src/scr_json.c"),
     join(testDir, "../src/scr_bigint.c"),

packages/runtime/test/bytes.test.ts

@@ -40,6 +40,7 @@ beforeAll(async () => {
     join(testDir, "../src/scr_hash.c"),
     join(testDir, "../src/scr_string.c"),
     join(testDir, "../src/scr_array.c"),
+    join(testDir, "../src/scr_arena.c"),
     join(testDir, "../src/scr_map.c"),
     join(testDir, "../src/scr_exception.c"),
     join(testDir, "../src/scr_error.c"),

packages/runtime/test/cipher.test.ts

@@ -20,6 +20,7 @@ const runtimeSources = [
   "scr_hash.c",
   "scr_string.c",
   "scr_array.c",
+  "scr_arena.c",
   "scr_map.c",
   "scr_exception.c",
   "scr_error.c",

packages/runtime/test/closure.test.ts

@@ -25,6 +25,7 @@ test("closure/box runtime: RC cascades clean under ASan + audit", async () => {
     join(srcDir, "scr_closure.c"),
     join(srcDir, "scr_string.c"),
     join(srcDir, "scr_array.c"),
+    join(srcDir, "scr_arena.c"),
     join(srcDir, "scr_json.c"),
     join(srcDir, "scr_bigint.c"),
     join(srcDir, "scr_map.c"),

packages/runtime/test/dh.test.ts

@@ -20,6 +20,7 @@ const runtimeSources = [
   "scr_hash.c",
   "scr_string.c",
   "scr_array.c",
+  "scr_arena.c",
   "scr_map.c",
   "scr_exception.c",
   "scr_error.c",