The teardown of a type with children of its own type called itself for
each child: a call, its register saves and the segment bookkeeping per
node, 45 instructions per node in a binary tree.
A record or standalone class whose every reference field holds its own
type and that has no collector header now tears down in one loop. A child
whose last reference the dead node held goes onto a pending list linked
through its own count word, which it no longer needs, and the loop takes
the list's first node next, so nodes are visited parent first. Each node
frees its block as before (dispose observers, the RC audit, blocks of
other arenas), the calling thread's blocks go into the teardown segment
in visit order, and the segment goes onto the free list in one step, so a
structure built parent first takes the blocks in its allocation order.
Shared and immortal children keep their release. The loop needs no depth
budget. Other teardowns keep the recursive form.
forEach, map, filter, some, every, find, findIndex, findLast,
findLastIndex and flatMap on a dynamic array, and through
Array.prototype.<method>.call on a native array, called the callback
without its thisArg, so `this` in the callback was not the second
argument. These methods now bind `this` to the thisArg, or undefined
when there is none, once per call, around all of the method's callbacks.
A const that kept its initializer's layout records the initializer's
checker type by declaration symbol. A function body lowers once per
instance, and only an instance for a wider argument keeps the layout, so
the record from that instance made the function's own lowering bind the
wider layout for `grow(alias)`: the argument converted into a copy and the
callee's writes did not reach the caller. The recorded type now applies
only while it maps to the layout of the binding the current lowering
resolves.
- A const that kept its initializer's layout (`const view: Counted[] = entries`)
is typed by its annotation, so a call that passed it compared the annotated
layout with the parameter's and copied it. The const now records its
initializer's type, and a call that passes it binds that type, at function
and module scope.
- Comparing two recursive layouts (`{ kids: Tree[]; note? }` against
`{ kids: Plain[] }`) recursed without end and stopped compilation with
"Maximum call stack size exceeded". A pair already being compared now holds
for the fields that reach it again.
- The divergence scan reported SC6001 for calls and consts whose layout the
lowering kept, which the coverage test refuses for corpus programs. The
lowering records those arguments and initializers, and the scan skips them.
Node passes a stream's one onwrite function to every _write and _writev
call, and a new function to every _transform call. A write or writev
option callback now receives the same closure on every call
(scr_stream_write_closure), kept or not, so a Set, WeakSet or WeakMap
finds it again. A reused transform, flush, final, construct or destroy
callback is first forgotten by weak collections, as at its free, so a
WeakSet or WeakMap that recorded the previous call's callback does not
find it on the next call.
An array or record converts by copying it when its layout differs from the
type it flows into (`{ id; name; owned?: true }[]` into a `{ id; name }[]`
parameter). JavaScript passes the same object, so a callee's `push`, index
stores and element-field writes reached the caller's array in Node but a
copy in the compiled program, and `===` against the original was false.
When an argument names an existing array or record whose layout has every
field of the parameter's type plus optional fields, a direct call of a
declared function now targets an instance of the function lowered with that
parameter bound to the argument's own type. The body reads and writes the
caller's value; a value it stores converts into the argument's layout by
completing the optional fields as absent. Instances are keyed by the
parameter layouts. An instance whose body does not lower is discarded with
everything it recorded, and the call converts as declared.
With the same rule, a non-exported function whose every return names such
a value returns its layout (including the parameter's element or field),
and a const keeps its initializer's layout when the initializer names an
existing value or is a call.
A local that only holds exact integers or NaN, such as one assigned from
an integer typed-array read, now keeps whether it is NaN beside its
integer view. Its reads, and sums, differences and products of them,
carry an i64 that holds the integer whenever the number is not NaN, so
an index check or a counted loop's guard tests that integer and the
ordered bit instead of converting the double back and checking that it
is an exact integer.
require("buffer").Blob and timers.setTimeout now read as their global
spellings, so island-web-plumbing and misc-shims run past the SC2020
they stopped at and reach a later deferred SC1090: require() inside a
function in plumbing, and constructing a value that is not a program
class in misczoo. fetch-destructure reads fetch from the aliased global
object and matches Node.
Each call of a typed or untyped write, writev, transform, flush, final,
construct or destroy option callback allocated a closure and a box holding
the stream for its `callback` argument. The emitted thunks now take it
from scr_stream_done_closure, which keeps the last one on the stream state and
hands it out again while the stream holds its only reference and it has
no own properties. A callback the user kept (stored, or passed to
setImmediate or a promise) is not reused: the next call gets a new
closure, and the kept one keeps its own stream reference.
The cached closure holds the stream, so the stream drops it when it
emits 'close' and traces it, which lets the cycle collector reclaim a
stream dropped before it closes.
RUNTIME_ABI_VERSION goes from 46 to 47 for scr_stream_done_closure.
- A string held in a binding or returned by a call can be a missing element
read (undefined), so `head + PAD[j]` and `at(i) + PAD[j]` still add to NaN
when both are missing. Only string literals, templates and sums with such
an operand now count as always a string.
- `readdirSync(path, { recursive })` folds only the `true` and `false`
keywords. Any other flag expression, including one typed as a literal,
evaluates at run time for its effects and exceptions.
A speculative integer loop's fast copy exits to a copy that resumes the
failed iteration, and both read the header fields of the views they
access. GVN's load PRE moved the fast copy's read of a view's data
pointer ahead of the exit branch, to make the resume copy's read
redundant, and put a copy on the exit edge. The loop then kept its first
iteration in the loop, so the overflow checks of a value whose range is
known after one iteration stayed in every iteration, with a reload of the
data pointer.
A view held by a const local or a parameter that the loop does not rebind
is the same view in every iteration, and its length, data pointer and
shared storage never change. The loop's entry now reads them once, and the
element accesses of every copy use those values.
The store a constant choice emits for its arms used the first arm's
index expression, with the ranges proven inside that arm. When the index
is the compared local, `j === 0` narrows it to [0, 0] there, so the one
store, which also runs on the final else's path, converted the index to
an int32 from that range. For `j` = 4294967297 that conversion has no
defined result, and the bounds check that follows could accept it: an
out-of-bounds write could reach a valid element.
The store now reads such an index through the first comparison's
operand: the same local, read before the chain branches, so its range
holds on every path. An index that is another local is not narrowed by
the comparisons and is unchanged.
7515-net-socket-backpressure's server picks each connection's handling from
`mode` when it accepts it. The lookup client's 70000 bytes fit in the
kernel's buffers, so its 'drain', and the step that sets `mode` to "pause",
can run before the server accepts that connection. On macOS the accept can
come in a later kqueue batch: the server then paused the lookup socket,
never read its EOF, and the open connection kept the program running after
server.close(). The program now waits for that accept before it changes
`mode`. Its output is unchanged.
An if/else-if chain that compares one number local with integer literals
and stores a number literal to the same typed-array element in every arm,
including a final else, such as
if (x === 97) a[i] = 0;
else if (x === 116) a[i] = 1;
else if (x === 99) a[i] = 2;
else a[i] = 3;
is now emitted as one store of an entry of a constant table indexed by
the local's value (constant-choices.ts). On input whose cases do not
repeat in a pattern, such as the bases of a DNA sequence, the branches
mispredict; LLVM keeps them, because cases this far apart are too sparse
for its own switch tables.
The chain needs at least three distinct values within 256 of each other.
The table covers the cases' span, or the local's proven integer range
when that range has at most 256 values, in which case no test is
emitted. Otherwise a value that is not an exact integer in the table's
span (NaN, a fraction, or a value outside it) stores the final else's
literal, chosen with a select. The first arm wins for a repeated
value, and -0 selects the arm for 0, as strict equality does. The store
is the arms' own (the same receiver and index), converted to the
element's type as each arm's would be. Debug builds keep the arms.
k-nucleotide's transform of the input sequence uses this form: its
median wall time drops from 2.71 s to 2.21 s.
A limited pass (scr_cyc_collect_set, which freeing a LifetimeRegion runs
over the objects the region owned) takes only the candidates in its set.
Its walk can still reach other candidates, and one that is referenced from
outside is blackened by scan and promoted to the next generation while it
keeps its slot in its old generation's buffer. scr_cyc_on_dead finds a
candidate's buffer by its generation, so when that object died it removed
another buffer's entry and left its own slot pointing at the freed block,
which the next pass then read.
Such a candidate is no longer promoted: it keeps the generation of the
buffer it is in until a pass takes it.
The element-independent callback paths read the slot after the callback:
- filter appended the slot as it was after the predicate;
- find and findLast read the element only once the predicate held.
A predicate that overwrote or removed the current slot therefore kept or
returned the new value, where JavaScript keeps the element it read before
calling the predicate. An unfused filter over proven-present elements also
stored the placeholder it passed to a predicate with an unused element
parameter.
- filter, find and findLast keep a snapshot of the slot, read before the
callback runs (arraySlotSnapshot): the value, or the dynamic value of an
element outside the element type. filter appends that snapshot as it
was stored, and find returns it, with the checked conversion for such an
element. Fused loops take the same snapshot before a stage whose
callback ignores the element.
- Leaving an ignored element unread now applies only to arrays that can
hold elements outside their element type (elementMayBeForeign) and are
not proven present. Every other array reads the element as before, so
its filter stores the element it read.
The bootstrap test builds its own seed when CI shares none, and that build
still applied the committed function layout, so its LLVM listed functions in
a different order from the native compiler's own emission. Both seed builds
now share one environment, which leaves the layout out.
Chris Tate