codegen: affine window hoist + accumulator array axis — matmul 2× faster than node; fixes a live OOB read in the #9294 mixed-array guard

changelog.d/affine-window-hoist-and-accumulator-set.md

@@ -0,0 +1,31 @@
+**`16_matrix_multiply` is now twice as fast as node** (100 ms → 16 ms against
+node's 32 on an idle machine; checksums identical) — the last benchmark in
+the suite crosses parity, via two changes and one guard fix.
+
+**The affine window is proven at the loop's endpoints.** An index tree linear
+in the counter takes its extremes at the interval's ends, so the entry guard
+evaluates each recorded tree at `start` and at `bound − 1` (wrap-free by the
+magnitude bound) and unsigned-compares both against the live length — two
+compares per tree, once per loop entry, for any coefficient sign. Reads under
+a proven window drop both the range clamp and the per-read bounds check,
+leaving a bare `trunc` and raw load. Non-linear trees (`k * k`) keep their
+per-read checks.
+
+**The accumulator walk takes the guarded array set.** The old single-array
+restriction was why `sum = sum + a[..] * b[..]` never earned its number
+proof: every k-iteration wrote `sum` through a boxed shadow-slot store with a
+barrier, which profiling showed was the actual bottleneck once the guards
+were hoisted — removing the per-read checks alone moved nothing. Every array
+in the set is validated by the same AND-reduced entry guard, so a read of any
+of them inside the clone is a Number by the same argument that held for one;
+affine reads qualify as numeric leaves through the same shared predicate the
+matcher and the lowering use (`affine_leaf_admissible`), so the three cannot
+drift.
+
+**A guard hole in the #9294 arm is closed.** Its receiver-only `continue`
+also fired for arrays with BOTH counter-offset and affine accesses, skipping
+the windowed guard while the counter fact still said `window_validated:
+true` — `a[k + 1]` alongside `a[i * size + k]` then read one raw slot past
+the loop's window at the boundary. Mixed arrays now fall through to the
+windowed guard, with the affine endpoint proof appended to either path, and
+a test pins the mixed shape to node's NaN under both collector modes.

crates/perry-codegen/src/expr/index_get.rs

@@ -42,7 +42,10 @@ use super::{
 
 mod foreign_counter;
 mod guarded_array;
-pub(crate) use foreign_counter::{affine_index_fits_i64, packed_f64_loop_index_parts};
+pub(crate) use foreign_counter::{
+    affine_counter_occurrences, affine_index_fits_i64, emit_affine_index_i64_with,
+    packed_f64_loop_index_parts,
+};
 use foreign_counter::{
     affine_packed_loop_read, emit_affine_index_i64, foreign_packed_loop_read,
     packed_f64_loop_offset_read,
@@ -787,6 +790,18 @@ pub(crate) fn lower_numeric_index_get_for_number_context(
         if let Some(fact) = affine_packed_loop_read(ctx, *arr_id, index.as_ref()) {
             let arr_box = lower_expr(ctx, object)?;
             if let Some(idx64) = emit_affine_index_i64(ctx, index.as_ref(), fact.index_local_id) {
+                // Window proven at the loop's endpoints by the entry guard: a
+                // linear tree's value stays between its endpoint evaluations,
+                // both checked `< length <= 16M < 2^31`, so the clamp and the
+                // per-read bounds check are both implied — the read is a bare
+                // trunc + raw load, which is what lets LLVM strength-reduce
+                // and vectorize the loop.
+                if fact.window_validated {
+                    let idx_i32 = ctx.block().trunc(I64, &idx64, I32);
+                    return Ok(Some(lower_packed_f64_loop_index_get(
+                        ctx, *arr_id, &arr_box, &idx_i32, &fact, false,
+                    )));
+                }
                 // Unsigned: a negative index reads as a huge unsigned value and
                 // takes the side exit, so no static non-negativity proof is
                 // needed. The i32 ceiling keeps the truncation below exact.

crates/perry-codegen/src/expr/index_get/foreign_counter.rs

@@ -117,6 +117,24 @@ pub(crate) fn packed_f64_loop_offset_read(
 /// computed in i128 at match time, so admission costs nothing at run time:
 /// a tree whose worst case fits i63 cannot wrap, and anything else declines
 /// to the generic path.
+
+/// How many times the counter appears in an affine tree. A tree LINEAR in
+/// the counter (exactly one occurrence, and only under Add/Sub/Mul with
+/// invariant co-factors) takes its extreme values at the loop's endpoints,
+/// which is what licenses the endpoint window proof in the entry guard. A
+/// tree where the counter appears twice (`k * k`) is not monotone and keeps
+/// its per-read bounds check.
+pub(crate) fn affine_counter_occurrences(index: &Expr, counter_id: u32) -> u32 {
+    match index {
+        Expr::LocalGet(id) if *id == counter_id => 1,
+        Expr::Binary { left, right, .. } => {
+            affine_counter_occurrences(left, counter_id)
+                + affine_counter_occurrences(right, counter_id)
+        }
+        _ => 0,
+    }
+}
+
 pub(crate) fn affine_index_magnitude_bound(index: &Expr) -> Option<i128> {
     match index {
         Expr::Integer(v) => Some((*v as i128).unsigned_abs().min(1 << 31) as i128),
@@ -196,22 +214,37 @@ pub(crate) fn emit_affine_index_i64(
     ctx: &mut FnCtx<'_>,
     index: &Expr,
     counter_id: u32,
+) -> Option<String> {
+    emit_affine_index_i64_with(ctx, index, counter_id, None)
+}
+
+/// Like [`emit_affine_index_i64`], with the counter's value optionally
+/// substituted by a caller-provided i64 SSA value instead of its slot load.
+/// The entry guard uses this to evaluate an affine tree at the loop's
+/// endpoints (counter = start, counter = bound - 1) while every other leaf
+/// still reads its live, loop-invariant slot.
+pub(crate) fn emit_affine_index_i64_with(
+    ctx: &mut FnCtx<'_>,
+    index: &Expr,
+    counter_id: u32,
+    counter_override: Option<&str>,
 ) -> Option<String> {
     match index {
         Expr::Integer(v) => Some(v.to_string()),
         Expr::Number(n) => Some(format!("{}", *n as i64)),
         Expr::LocalGet(id) => {
-            let slot = if *id == counter_id {
-                ctx.i32_counter_slots.get(id)?.clone()
-            } else {
-                ctx.i32_counter_slots.get(id)?.clone()
-            };
+            if *id == counter_id {
+                if let Some(value) = counter_override {
+                    return Some(value.to_string());
+                }
+            }
+            let slot = ctx.i32_counter_slots.get(id)?.clone();
             let narrow = ctx.block().load(I32, &slot);
             Some(ctx.block().sext(I32, &narrow, I64))
         }
         Expr::Binary { op, left, right } => {
-            let l = emit_affine_index_i64(ctx, left, counter_id)?;
-            let r = emit_affine_index_i64(ctx, right, counter_id)?;
+            let l = emit_affine_index_i64_with(ctx, left, counter_id, counter_override)?;
+            let r = emit_affine_index_i64_with(ctx, right, counter_id, counter_override)?;
             Some(match op {
                 perry_hir::BinaryOp::Add => ctx.block().add(I64, &l, &r),
                 perry_hir::BinaryOp::Sub => ctx.block().sub(I64, &l, &r),

crates/perry-codegen/src/expr/mod.rs

@@ -2746,7 +2746,8 @@ mod unary_bigint_tests;
 #[cfg(test)]
 mod unary_bitnot_tests;
 pub(crate) use index_get::{
-    affine_index_fits_i64, numeric_index_has_integer_array_index_proof, packed_f64_loop_index_parts,
+    affine_counter_occurrences, affine_index_fits_i64, emit_affine_index_i64_with,
+    numeric_index_has_integer_array_index_proof, packed_f64_loop_index_parts,
 };
 pub(crate) use masked_window::masked_window_fact_for_index;
 /// Rooting coverage for the computed-store arms the TS corpora cannot reach