codegen: a float accumulator over masked reads earns the dense range clone — 17_loop_data_dependent at node parity (475→219ms)

changelog.d/9294-affine-range-index.md

@@ -0,0 +1,44 @@
+**A counted loop whose reads use an affine index now hoists its receiver guard
+into the preheader** (#9253). `16_matrix_multiply` goes 100 ms → 69 ms against
+node's 32 ms on an idle machine.
+
+The interesting part was where the time was *not*. That loop spends 97% of its
+time inside generated code with no runtime calls, so the cost was never a
+missing inline or an unremoved helper. Per iteration, for both receivers, it
+re-derived the pointer tag check, the handle-band check, the header
+dereference, the `_reserved` flag tests and the two 16,000,000 length/capacity
+sanity compares — for receivers that are loop-invariant parameters whose
+headers cannot change inside the loop. LLVM cannot hoist that: the guard
+reloads the header through a pointer it cannot prove unaliased, and the
+incremental-barrier atomic read is a motion barrier.
+
+The packed-f64 range tier already had everything required except a way to
+describe `a[i * size + k]`, whose index has no compile-time window: it already
+takes a loop-invariant local or parameter bound, emits one guard per receiver
+AND-reduced into a single branch, and keeps its cached receivers GC-safe by
+refreshing them on the back-edge poll. An access may now be *affine* — an
+integer-producing expression over the loop counter and loop-invariant integer
+locals — and such an access publishes a receiver-only fact: the entry guard
+proves shape, raw-f64 packedness, integrity and the sanity bounds once in the
+preheader, and each read pays one inline `icmp ult idx, len` with the fact's
+existing side exit.
+
+The index is materialised in i64 rather than i32, because `i * size` can exceed
+i32 for a large matrix even when the final index is valid and an i32
+computation would wrap — turning an out-of-bounds access into an in-bounds one.
+The bounds compare is unsigned, so a negative index reads as a huge unsigned
+value and side-exits; no static non-negativity proof is needed, which matters
+because `size` is a parameter with no callsite range summary and no static
+window for the product is obtainable. The index must also mention the counter:
+a wholly loop-invariant index like `a[0]` is affine by the grammar but has a
+compile-time window, and admitting it here made the classic walker succeed and
+silently stole those loops from the dense tier's masked path that serves them
+better.
+
+Reads only, in the classic mode only. Dense mode's loads carry no side exit and
+so cannot take a per-read bounds check, and an affine store is rejected because
+the side exit re-executes the iteration.
+
+This does not reach parity. The residual is the per-read bounds check and index
+materialisation, plus the `c[i * size + j]` store in the enclosing loop, which
+stays generic for the reason above.

changelog.d/dense-accumulator-masked-reads.md

@@ -0,0 +1,32 @@
+**A float accumulator over masked reads now earns the dense range clone**
+(`17_loop_data_dependent`: 475 ms → 219 ms against node's 220 ms on an idle
+machine — parity, from 2.16×).
+
+`sum = sum * x[i & 63] + x[(i * 7) & 63]` was rejected by the dense range tier
+while `sum = sum * x[i & 63]` was admitted. The discriminator was the
+accumulator's static numeric proof: `+` can be concatenation, so the
+per-statement proof demands both operands numeric, and a reassigned
+accumulator has no such proof — its own writes read the guarded array, whose
+element proof only exists once the guard has run. A chicken-and-egg that `*`
+never faces, because multiplication needs only the weaker inert fact.
+
+The matcher now peels the accumulator: when the proof fails on the `LocalSet`
+target of a self-accumulating write, it retries with the target treated as
+numeric BY CONTRACT, records it pending, and then verifies every pending
+local with the same collector the lowering runs — rejecting the whole dense
+match (with its own named trace reasons) if the two disagree, so the clone can
+never contain a dynamic `+` under facts that forbid one. The contract is
+enforced at run time twice over: the clone's entry emits a genuine-double tag
+check on the accumulator, and the dense entry guard validates the whole masked
+window hole-free. A string-seeded accumulator and a string element both route
+to the slow copy and produce node's concatenation, verified under forced
+evacuation.
+
+Along the way the accumulator walk's index leaf learned masked reads — and
+fixed a match-arm reachability bug while doing so: `_ if offset_reads_inlined`
+was a guarded catch-all, so any arm placed after it was unreachable whenever
+the flag was set. Admitted masked-only single arrays now qualify for
+accumulator admission (counter-bearing arrays keep priority; multiple arrays
+still decline), and `MaskedWindowArrayFact` carries the admitted accumulators
+so `is_numeric_expr` can see them while the clone lowers, mirroring the
+string-window fact's field.

crates/perry-codegen/src/expr/index_get.rs

@@ -43,7 +43,10 @@ use super::{
 mod foreign_counter;
 mod guarded_array;
 pub(crate) use foreign_counter::packed_f64_loop_index_parts;
-use foreign_counter::{foreign_packed_loop_read, packed_f64_loop_offset_read};
+use foreign_counter::{
+    affine_packed_loop_read, emit_affine_index_i64, foreign_packed_loop_read,
+    packed_f64_loop_offset_read,
+};
 mod inline_dyn_typed_array;
 
 use guarded_array::{
@@ -774,6 +777,31 @@ pub(crate) fn lower_numeric_index_get_for_number_context(
         // `is_packed_f64_loop_foreign_read_index` for read-only bodies. The
         // guard already proved this receiver's packed layout, so the element
         // load is the clone's raw slot load behind one inline bounds check.
+
+        // #9253: `a[i * size + k]` against a receiver-only affine fact. The
+        // entry guard proved the receiver once in the preheader; the index is
+        // materialised in i64 and range-clamped, then the shared bounds-checked
+        // element load does one `icmp ult idx, len` and takes the fact's side
+        // exit. That leaves per iteration only the compare and the raw load,
+        // instead of re-deriving tag/handle/header/flags/16M-sanity per access.
+        if let Some(fact) = affine_packed_loop_read(ctx, *arr_id, index.as_ref()) {
+            let arr_box = lower_expr(ctx, object)?;
+            if let Some(idx64) = emit_affine_index_i64(ctx, index.as_ref(), fact.index_local_id) {
+                // Unsigned: a negative index reads as a huge unsigned value and
+                // takes the side exit, so no static non-negativity proof is
+                // needed. The i32 ceiling keeps the truncation below exact.
+                let fits = ctx.block().icmp_ult(I64, &idx64, "2147483647");
+                let cont_idx = ctx.new_block("packed_f64_affine.index_fits");
+                let cont_label = ctx.block_label(cont_idx);
+                ctx.block()
+                    .cond_br(&fits, &cont_label, &fact.store_side_exit_label);
+                ctx.current_block = cont_idx;
+                let idx_i32 = ctx.block().trunc(I64, &idx64, I32);
+                return Ok(Some(lower_packed_f64_loop_index_get(
+                    ctx, *arr_id, &arr_box, &idx_i32, &fact, true,
+                )));
+            }
+        }
         if let Some((fact, idx_id)) = foreign_packed_loop_read(ctx, *arr_id, index.as_ref()) {
             if let Some(i32_slot) = ctx.i32_counter_slots.get(&idx_id).cloned() {
                 let arr_box = lower_expr(ctx, object)?;

crates/perry-codegen/src/expr/index_get/foreign_counter.rs

@@ -97,3 +97,87 @@ pub(crate) fn packed_f64_loop_offset_read(
     let needs_bounds_check = offset != 0 && !fact.allow_holes && !fact.window_validated;
     Some((fact, idx_id, offset, needs_bounds_check))
 }
+
+/// #9253: an active receiver-only (`affine_indices`) fact for `arr_id`, when
+/// `index` is an affine integer expression rather than a bare local.
+///
+/// The bare-local cases belong to `foreign_packed_loop_read` and the clone's
+/// own counter path; this is `a[i * size + k]`.
+pub(crate) fn affine_packed_loop_read(
+    ctx: &FnCtx<'_>,
+    arr_id: u32,
+    index: &Expr,
+) -> Option<PackedF64LoopFact> {
+    if matches!(index, Expr::LocalGet(_)) {
+        return None;
+    }
+    let fact = ctx
+        .packed_f64_loop_facts
+        .iter()
+        .rev()
+        .find(|fact| fact.array_local_id == arr_id && fact.affine_indices)?
+        .clone();
+    affine_index_leaves_materializable(ctx, index, fact.index_local_id).then_some(fact)
+}
+
+/// Every leaf must be readable as an i32 here, matching exactly what the
+/// matcher's `affine_leaf_ok` admitted. If these two disagree the matcher
+/// admits a shape this lowering declines, the read falls back to a helper
+/// call, and the clone's call-free scan discards the whole clone — the #9259
+/// cascade.
+fn affine_index_leaves_materializable(ctx: &FnCtx<'_>, index: &Expr, counter_id: u32) -> bool {
+    match index {
+        Expr::Integer(v) => i32::try_from(*v).is_ok(),
+        Expr::Number(n) => {
+            n.fract() == 0.0 && *n >= f64::from(i32::MIN) && *n <= f64::from(i32::MAX)
+        }
+        Expr::LocalGet(id) => *id == counter_id || ctx.i32_counter_slots.contains_key(id),
+        Expr::Binary {
+            op: perry_hir::BinaryOp::Add | perry_hir::BinaryOp::Sub | perry_hir::BinaryOp::Mul,
+            left,
+            right,
+        } => {
+            affine_index_leaves_materializable(ctx, left, counter_id)
+                && affine_index_leaves_materializable(ctx, right, counter_id)
+        }
+        _ => false,
+    }
+}
+
+/// Materialise the index in **i64** from each leaf's shared i32 shadow.
+///
+/// i64 rather than i32 because the source expression evaluates in doubles and
+/// `i * size` can exceed i32 for a large matrix even when the final sum is a
+/// valid index; computing in i32 would wrap and could produce an in-bounds
+/// index for an out-of-bounds access. Every leaf is a proven i32, so three
+/// levels of add/sub/mul cannot overflow i64.
+pub(crate) fn emit_affine_index_i64(
+    ctx: &mut FnCtx<'_>,
+    index: &Expr,
+    counter_id: u32,
+) -> Option<String> {
+    match index {
+        Expr::Integer(v) => Some(v.to_string()),
+        Expr::Number(n) => Some(format!("{}", *n as i64)),
+        Expr::LocalGet(id) => {
+            let slot = if *id == counter_id {
+                ctx.i32_counter_slots.get(id)?.clone()
+            } else {
+                ctx.i32_counter_slots.get(id)?.clone()
+            };
+            let narrow = ctx.block().load(I32, &slot);
+            Some(ctx.block().sext(I32, &narrow, I64))
+        }
+        Expr::Binary { op, left, right } => {
+            let l = emit_affine_index_i64(ctx, left, counter_id)?;
+            let r = emit_affine_index_i64(ctx, right, counter_id)?;
+            Some(match op {
+                perry_hir::BinaryOp::Add => ctx.block().add(I64, &l, &r),
+                perry_hir::BinaryOp::Sub => ctx.block().sub(I64, &l, &r),
+                perry_hir::BinaryOp::Mul => ctx.block().mul(I64, &l, &r),
+                _ => return None,
+            })
+        }
+        _ => None,
+    }
+}

crates/perry-codegen/src/expr/mod.rs

@@ -1992,6 +1992,16 @@ pub(crate) struct PackedF64LoopFact {
     /// is the dense range loop: the window is additionally hole-free, so
     /// loads carry no hole check at all).
     pub window_validated: bool,
+    /// #9253: reads on this receiver may use an AFFINE index — an
+    /// integer-producing expression over the loop counter and loop-invariant
+    /// integer locals (`a[i * size + k]`). The entry guard proved the receiver
+    /// only, so every such read pays an inline `icmp ult idx, len` against the
+    /// live length and takes `store_side_exit_label` when it fails.
+    ///
+    /// The matcher admits the loop only when EVERY tracked access qualifies,
+    /// so a lowering that finds this flag set may trust that the index shape in
+    /// front of it was the one admitted.
+    pub affine_indices: bool,
 }
 
 /// Element storage a masked-window fact's entry guard proved (#6750
@@ -2054,6 +2064,12 @@ pub(crate) struct MaskedWindowArrayFact {
     /// element type is exactly i32 (Int32Array tier), so loads may
     /// materialize elements as native `i32`.
     pub values_i32: bool,
+    /// Accumulator locals admitted by the entry tag check for THIS clone:
+    /// every in-clone write is numeric-preserving (verified by the
+    /// accumulator walk), so `is_numeric_expr` may treat them as Numbers
+    /// while the fact is live. Mirrors `StringWindowArrayFact`'s
+    /// `numeric_accumulator` (#9160) and `PackedF64LoopFact`'s vec.
+    pub numeric_accumulators: Vec<u32>,
     /// Storage layout the guard proved — selects the inline load shape.
     pub elem: MaskedWindowElem,
     /// True only in a dense fast-loop scope whose matcher admitted masked