feat(jit): spec-driven family 5 6 array map mutations and iterators

Author: fffonion

src/vm/jit/builtin_spec.rs

@@ -426,6 +426,67 @@ pub(crate) const MAP_HAS_SPEC: BuiltinSpec = BuiltinSpec {
     needs_failure_exit: false,
 };
 
+// ── Family 5: array/map mutations ───────────────────────────────────
+
+/// `array.push(value)` — owned mutation, returns the mutated array.
+pub(crate) const ARRAY_PUSH_SPEC: BuiltinSpec = BuiltinSpec {
+    name: "array_push",
+    arity: 2,
+    inputs: &[
+        InputRepr::Any,    // value (popped second)
+        InputRepr::Tagged, // array (popped first, must be owned Tagged)
+    ],
+    output: OutputKind::Tagged(ValueType::Array),
+    effect: BuiltinEffect::OwnedMutation,
+    needs_failure_exit: false,
+};
+
+/// `map.set(key, value)` — owned mutation, returns the mutated map.
+pub(crate) const MAP_SET_SPEC: BuiltinSpec = BuiltinSpec {
+    name: "map_set",
+    arity: 3,
+    inputs: &[
+        InputRepr::Any,    // value (popped third)
+        InputRepr::Any,    // key (popped second)
+        InputRepr::Tagged, // map (popped first, must be owned Tagged)
+    ],
+    output: OutputKind::Tagged(ValueType::Map),
+    effect: BuiltinEffect::OwnedMutation,
+    needs_failure_exit: false,
+};
+
+// ── Family 6: map iterators ─────────────────────────────────────────
+
+/// `map_iter_next(slot)` — advance iterator, bool result.
+pub(crate) const MAP_ITER_NEXT_SPEC: BuiltinSpec = BuiltinSpec {
+    name: "map_iter_next",
+    arity: 1,
+    inputs: &[InputRepr::Int], // slot
+    output: OutputKind::Bool,
+    effect: BuiltinEffect::Pure,
+    needs_failure_exit: false,
+};
+
+/// `map_iter_take_key(slot)` — take current key, tagged result.
+pub(crate) const MAP_ITER_TAKE_KEY_SPEC: BuiltinSpec = BuiltinSpec {
+    name: "map_iter_take_key",
+    arity: 1,
+    inputs: &[InputRepr::Int], // slot
+    output: OutputKind::TaggedUnknown,
+    effect: BuiltinEffect::Pure,
+    needs_failure_exit: false,
+};
+
+/// `map_iter_take_value(slot)` — take current value, tagged result.
+pub(crate) const MAP_ITER_TAKE_VALUE_SPEC: BuiltinSpec = BuiltinSpec {
+    name: "map_iter_take_value",
+    arity: 1,
+    inputs: &[InputRepr::Int], // slot
+    output: OutputKind::TaggedUnknown,
+    effect: BuiltinEffect::Pure,
+    needs_failure_exit: false,
+};
+
 /// Look up the spec for a specialized builtin kind, if one exists.
 ///
 /// Returns `None` for builtins not yet covered by the spec-driven
@@ -468,6 +529,13 @@ pub(crate) fn spec_for(
         super::recorder::SpecializedBuiltinKind::ArrayGet => Some(&ARRAY_GET_SPEC),
         super::recorder::SpecializedBuiltinKind::MapGet => Some(&MAP_GET_SPEC),
         super::recorder::SpecializedBuiltinKind::MapHas => Some(&MAP_HAS_SPEC),
+        super::recorder::SpecializedBuiltinKind::ArrayPush => Some(&ARRAY_PUSH_SPEC),
+        super::recorder::SpecializedBuiltinKind::MapSet => Some(&MAP_SET_SPEC),
+        super::recorder::SpecializedBuiltinKind::MapIterNext => Some(&MAP_ITER_NEXT_SPEC),
+        super::recorder::SpecializedBuiltinKind::MapIterTakeKey => Some(&MAP_ITER_TAKE_KEY_SPEC),
+        super::recorder::SpecializedBuiltinKind::MapIterTakeValue => {
+            Some(&MAP_ITER_TAKE_VALUE_SPEC)
+        }
         _ => None,
     }
 }

src/vm/jit/recorder.rs

@@ -3425,7 +3425,12 @@ fn analyze_specialized_builtin_call(
         | SpecializedBuiltinKind::RegexReplace
         | SpecializedBuiltinKind::ArrayGet
         | SpecializedBuiltinKind::MapGet
-        | SpecializedBuiltinKind::MapHas => {
+        | SpecializedBuiltinKind::MapHas
+        | SpecializedBuiltinKind::ArrayPush
+        | SpecializedBuiltinKind::MapSet
+        | SpecializedBuiltinKind::MapIterNext
+        | SpecializedBuiltinKind::MapIterTakeKey
+        | SpecializedBuiltinKind::MapIterTakeValue => {
             unreachable!("spec-covered builtins are handled by the spec-driven path")
         }
         SpecializedBuiltinKind::TypeOfKnown(_) => {
@@ -3460,34 +3465,6 @@ fn analyze_specialized_builtin_call(
             frame.push(ValueInfo::tagged_typed(ValueType::Array));
             Ok("array_new")
         }
-        SpecializedBuiltinKind::ArrayPush => {
-            let _ = frame.pop()?;
-            let _ = frame.pop()?;
-            frame.push(ValueInfo::tagged_typed(ValueType::Array));
-            Ok("array_push")
-        }
-        SpecializedBuiltinKind::MapSet => {
-            let _ = frame.pop()?;
-            let _ = frame.pop()?;
-            let _ = frame.pop()?;
-            frame.push(ValueInfo::tagged_typed(ValueType::Map));
-            Ok("map_set")
-        }
-        SpecializedBuiltinKind::MapIterNext => {
-            let _ = frame.pop()?;
-            frame.push(ValueInfo::bool(None));
-            Ok("map_iter_next")
-        }
-        SpecializedBuiltinKind::MapIterTakeKey => {
-            let _ = frame.pop()?;
-            frame.push(ValueInfo::tagged());
-            Ok("map_iter_take_key")
-        }
-        SpecializedBuiltinKind::MapIterTakeValue => {
-            let _ = frame.pop()?;
-            frame.push(ValueInfo::tagged());
-            Ok("map_iter_take_value")
-        }
     }
 }
 
@@ -3528,7 +3505,12 @@ fn emit_specialized_builtin_call(
         | SpecializedBuiltinKind::RegexReplace
         | SpecializedBuiltinKind::ArrayGet
         | SpecializedBuiltinKind::MapGet
-        | SpecializedBuiltinKind::MapHas => {
+        | SpecializedBuiltinKind::MapHas
+        | SpecializedBuiltinKind::ArrayPush
+        | SpecializedBuiltinKind::MapSet
+        | SpecializedBuiltinKind::MapIterNext
+        | SpecializedBuiltinKind::MapIterTakeKey
+        | SpecializedBuiltinKind::MapIterTakeValue => {
             unreachable!("spec-covered builtins are handled by the spec-driven path")
         }
         SpecializedBuiltinKind::TypeOfKnown(value_type) => {
@@ -3580,114 +3562,6 @@ fn emit_specialized_builtin_call(
                 .map_err(|err| TraceRecordError::InvalidIr(err.to_string()))?;
             Ok(("array_new", out))
         }
-        SpecializedBuiltinKind::ArrayPush => {
-            let value = frame.pop()?;
-            let array = frame.pop()?;
-            if array.info.repr != SsaValueRepr::Tagged {
-                return Err(TraceRecordError::TypeMismatch {
-                    expected: "owned tagged array",
-                    actual: array.info.repr,
-                });
-            }
-            let out = builder
-                .append_value_inst(
-                    block,
-                    ip,
-                    SsaValueRepr::Tagged,
-                    SsaInstKind::ArrayPush {
-                        array: array.value.id,
-                        value: value.value.id,
-                    },
-                )
-                .map(|value| SymbolicValue {
-                    value,
-                    info: ValueInfo::tagged_typed(ValueType::Array),
-                })
-                .map_err(|err| TraceRecordError::InvalidIr(err.to_string()))?;
-            Ok(("array_push", out))
-        }
-        SpecializedBuiltinKind::MapSet => {
-            let value = frame.pop()?;
-            let key = frame.pop()?;
-            let map = frame.pop()?;
-            if map.info.repr != SsaValueRepr::Tagged {
-                return Err(TraceRecordError::TypeMismatch {
-                    expected: "owned tagged map",
-                    actual: map.info.repr,
-                });
-            }
-            let out = builder
-                .append_value_inst(
-                    block,
-                    ip,
-                    SsaValueRepr::Tagged,
-                    SsaInstKind::MapSet {
-                        map: map.value.id,
-                        key: key.value.id,
-                        value: value.value.id,
-                    },
-                )
-                .map(|value| SymbolicValue {
-                    value,
-                    info: ValueInfo::tagged_typed(ValueType::Map),
-                })
-                .map_err(|err| TraceRecordError::InvalidIr(err.to_string()))?;
-            Ok(("map_set", out))
-        }
-        SpecializedBuiltinKind::MapIterNext => {
-            let slot = ensure_int(builder, block, ip, frame.pop()?)?;
-            let out = builder
-                .append_value_inst(
-                    block,
-                    ip,
-                    SsaValueRepr::Bool,
-                    SsaInstKind::MapIterNext {
-                        slot: slot.value.id,
-                    },
-                )
-                .map(|value| SymbolicValue {
-                    value,
-                    info: ValueInfo::bool(None),
-                })
-                .map_err(|err| TraceRecordError::InvalidIr(err.to_string()))?;
-            Ok(("map_iter_next", out))
-        }
-        SpecializedBuiltinKind::MapIterTakeKey => {
-            let slot = ensure_int(builder, block, ip, frame.pop()?)?;
-            let out = builder
-                .append_value_inst(
-                    block,
-                    ip,
-                    SsaValueRepr::Tagged,
-                    SsaInstKind::MapIterTakeKey {
-                        slot: slot.value.id,
-                    },
-                )
-                .map(|value| SymbolicValue {
-                    value,
-                    info: ValueInfo::tagged(),
-                })
-                .map_err(|err| TraceRecordError::InvalidIr(err.to_string()))?;
-            Ok(("map_iter_take_key", out))
-        }
-        SpecializedBuiltinKind::MapIterTakeValue => {
-            let slot = ensure_int(builder, block, ip, frame.pop()?)?;
-            let out = builder
-                .append_value_inst(
-                    block,
-                    ip,
-                    SsaValueRepr::Tagged,
-                    SsaInstKind::MapIterTakeValue {
-                        slot: slot.value.id,
-                    },
-                )
-                .map(|value| SymbolicValue {
-                    value,
-                    info: ValueInfo::tagged(),
-                })
-                .map_err(|err| TraceRecordError::InvalidIr(err.to_string()))?;
-            Ok(("map_iter_take_value", out))
-        }
     }
 }
 
@@ -3923,6 +3797,44 @@ fn emit_spec_driven_builtin(
             ValueInfo::bool(None),
             spec.name,
         ),
+        SpecializedBuiltinKind::ArrayPush => (
+            SsaInstKind::ArrayPush {
+                array: popped[1].value.id,
+                value: popped[0].value.id,
+            },
+            ValueInfo::tagged_typed(ValueType::Array),
+            spec.name,
+        ),
+        SpecializedBuiltinKind::MapSet => (
+            SsaInstKind::MapSet {
+                map: popped[2].value.id,
+                key: popped[1].value.id,
+                value: popped[0].value.id,
+            },
+            ValueInfo::tagged_typed(ValueType::Map),
+            spec.name,
+        ),
+        SpecializedBuiltinKind::MapIterNext => (
+            SsaInstKind::MapIterNext {
+                slot: popped[0].value.id,
+            },
+            ValueInfo::bool(None),
+            spec.name,
+        ),
+        SpecializedBuiltinKind::MapIterTakeKey => (
+            SsaInstKind::MapIterTakeKey {
+                slot: popped[0].value.id,
+            },
+            ValueInfo::tagged(),
+            spec.name,
+        ),
+        SpecializedBuiltinKind::MapIterTakeValue => (
+            SsaInstKind::MapIterTakeValue {
+                slot: popped[0].value.id,
+            },
+            ValueInfo::tagged(),
+            spec.name,
+        ),
         SpecializedBuiltinKind::ArraySet => {
             let value = &popped[0];
             let index = &popped[1];