Parent: #1017
Umbrella: #473
Follows: ac67db5
Measured problem
After the primitive String length fix, frozen representative_json keeps checksum 324952086 and improves exact-parent median 400.774 ms -> 364.558 ms, but JIT remains 2.2% slower than forced VM (365.050 ms vs 357.070 ms, interleaved seven-sample medians).
A bounded native-operation trace shows the stable inner-iteration callback sequence:
- load_var x2
- get_prop x2
- call_with_this x2
- bit_and x1
The bit_and at bytecode origin 100 implements (record.values[i % 3] + i + lane) & 65535. It is one native-to-runtime callback per inner iteration despite both operands taking the Number path.
Scope
- Add an architecture-neutral guarded direct path for Number bitwise operations used by optimizer native regions, starting with bit_and.
- Implement exact ECMAScript ToInt32/ToUint32 behavior for fractional, negative-zero, NaN, infinite, and wrapping inputs.
- Preserve canonical runtime callbacks for BigInt, objects/coercion, mixed numeric kinds, exceptions, and unsupported targets.
- Keep step accounting, deopt reconstruction, GC roots, invalidation, and no-GIL synchronization unchanged.
- Measure callback-count and wall-time deltas on the frozen base/variant plus anti-specialization controls.
Acceptance
- Focused native tests prove exact Number edge cases and callback fallback for BigInt/object inputs.
- The frozen JSON bit_and executes without a runtime-operation callback and preserves checksum 324952086.
- ReleaseFast, ReleaseSafe+TSan, required-VM agreement, affected test262 bitwise cases, OOM/deep-input, and real-GC evidence pass.
- Seven-sample exact-parent and JIT-on/off evidence shows no hidden control regression; #1017 is closed only if JIT no longer loses to forced VM.
Guardrails
No source/workload recognition, threshold suppression, changed checksum, disabled JIT, Number-only semantic shortcut without guards, or omitted BigInt/coercion behavior.