JIT: build the optimizing tier with deoptimization and precise GC

Parent: #134 Related: #44, #132, #133, #429

Build a general optimizing tier beyond verified baseline regions. Baseline and bytecode remain exact fallbacks and must not be reported as optimizing execution.

Acceptance

• Add profiling, optimizing IR, canonicalization, guarded speculation, and target lowering (#431).
• Implement OSR entry/exit, deoptimization reconstruction, exception edges, stack maps, and precise GC integration (#432).
• Add shape/property/call inline caches with correct invalidation under mutation and concurrency (#132, #433).
• Lower verified packed-array regions with exact guards and resumable fallback (#133).
• Manage executable memory, trap polling, code lifetime, jettison, and concurrent artifact reclamation safely (#433).
• Complete every declared architecture backend and differential-test optimized execution against interpreter and baseline tiers (#434).
• Publish reproducible correctness and performance evidence against JavaScriptCore (#434).

Children

• #431 — profiles, IR, canonicalization, and publication.
• #432 — OSR, deoptimization, exceptions, precise GC, runtime effects, and reducible loops (#435–#439).
• #132 — guarded named-property regions (#440–#444).
• #133 — verified packed-array regions (#448–#453).
• #433 — concurrency-safe polling, watchpoints, call records, and artifact lifetime (#454–#457).
• #434 — backend completion and differential/JSC evidence.
• #429 — promote the ten PR-249 optimizer executables through the real tier.

Completion

The released optimizer subset executes guarded numeric/control SSA, exact deoptimization and completion dispatch, reducible loop OSR, precise moving-GC safepoints, runtime effects, polymorphic own/inherited property access, call links, and packed array regions. Unsupported operations retain exact baseline/bytecode fallback.

The sole declared code-generation backend is macOS AArch64. docs/.data/optimizer-release-inventory.json binds it to normal/no-GIL/TSan differentials, lifetime evidence, the terminal PR-249 inventory, explicit unsupported-host builds, and the dated raw JavaScriptCore comparison. Closure commit: 9e51e1ff.

Checkpoint ec65181 starts #431 with race-safe advisory profiles, a separate optimizer publication model, and deterministic fail-closed CFG planning. It does not execute optimizer plans: the baseline numeric tier remains the only native JavaScript tier. Next #431 work is SSA/value IR plus canonicalization/DCE before guarded lowering; #432/#433/#434 continue to own deoptimization/GC, concurrent lifetime, backends, and differential evidence.

The architecture-neutral IR portion of #431 landed in 3736fc5: deterministic CFG + block-argument SSA, loop-carried values, effect-aware canonicalization, and DCE. This is still planning only, with no optimizer execution claim. The next #431 slice is guarded portable lowering and fail-closed plan installation.

Checkpoint 9cede38 hardens #431 plan publication against stale claims and invalidation races and adds cached rejection/counter convergence evidence. This deliberately does not close executable artifact lifetime (#433) or claim optimizer execution; guarded lowering remains next.

Checkpoint 74fd22d moves #431 from planning-only to its first honest executable optimizer subset: exact constant SSA native artifacts with owner-leased lifetime, optimizer-first hot dispatch, exact step accounting, and fail-closed fallback. General parameter/control lowering, OSR/deopt, and the ten PR-249 optimizer cases remain open.

#431 is complete at e3f411a. The initial optimizer now has real portable SSA lowering plus guarded numeric and exact two-way control execution; normal/TSan focused JIT are 110/110 and optimizer filters are 19/19.

The first #146 acceptance item and child checkbox are now closed. Work proceeds to #432 for dynamic control, OSR/deoptimization, exception edges, and precise stack maps.

#432 is underway through d0f8aae and 67e878a. Published optimizer artifacts now retain immutable frame recovery tables, and the VM can reconstruct locals, operand stack, accumulator, and resume IP while distinguishing deoptimization from a pre-entry miss. Direct-call restart paths reject partial-exit artifacts.

No #146 checkbox changes yet. Generated side exits, dynamic checkpoint state, handlers/exceptions, OSR, invalidation, and precise stack maps remain before #432 acceptance.

#432 advanced in 3cbc26a with the first real resumable optimizer side exit. Unequal-cost numeric branches execute their common prefix natively and resume the selected bytecode successor with exact frame/IP/step state; checkpoint crossings fail back before entry. Normal/TSan optimizer filters pass 23/23.

No parent checkbox closes yet; general OSR/control, handlers/exceptions, invalidation polling, and precise stack maps remain.

#432 advanced on main with ea669989: optimizer SSA now preserves exact edge-specific recovery states, including distinct preheader/backedge values at loop headers. This removes the ambiguity that prevented a correct loop OSR contract. Focused JIT verification passed 111/111 with zero leaks; benchmark paths and published scores are unchanged.

#432 checkpoint bc8c997f is on main: loop headers now produce immutable, exact OSR entry contracts and transactional VM-to-SSA imports. IP/frame/handler/accumulator mismatches fail closed to bytecode. Focused JIT verification passed 112/112 with zero leaks; executable loop publication is the next boundary, so benchmark scores remain unchanged.

#432 advanced with 6fba2c4e on main: the first executable loop OSR region now enters a guarded numeric AArch64 header after hot backedges, accounts the header exactly, and resumes the selected edge without replay. Normal and TSan focused JIT gates both passed 113/113 with zero leaks. README limits are current; benchmark scores are unchanged because existing benchmark workloads do not use this subset.

#432 invalidation progress is on main in 70e6cdae and 51bfef3e: invalidation closes all later VM native-entry/OSR polls, and optimizer code rechecks the owner generation before executing its first operation. Race losers do no work and preserve exact bytecode fallback. Normal and TSan focused checks passed; internal polls for future long-running native loops remain open.

#432 is now split into concrete remaining children: #435 native loop bodies/internal invalidation polls, #436 calls/exceptions/handler reconstruction, and #437 optimized-frame tracing/relocation. 254415a1 landed deopt-indexed precise stack-map ownership for every current optimizer recovery point; primitive-only masks are explicitly zero and focused JIT passed 113/113 with zero leaks.

Optimizer loop progress: #435 checkpoint c152d97a executes one full numeric body iteration per OSR entry, with explicit SSA edge copies, exact path-specific accounting, and next-header recovery of updated locals. Normal and TSan focused JIT passed 113/113. Native multi-iteration backedges and internal polls remain.

Optimizer loop checkpoint e65880ca is on main: supported numeric OSR bodies now execute multiple native iterations with body-to-header copies and per-header invalidation/budget/checkpoint polls. Exact recovery and step convergence are covered; normal and TSan focused JIT passed 113/113. General copy cycles and broader loop CFGs remain under #435.

Optimizer loop checkpoint e9d0dac0 completes #435's parallel edge-copy item with a reusable cycle breaker and multi-local swapped-backedge recovery evidence. Normal and TSan focused JIT passed 115/115; README/docs are current and benchmark scores remain unchanged.

Optimizer loop checkpoint 9bf10349 adds a fail-closed equal-cost nested branch diamond with exact merged-latch OSR recovery. Normal and TSan loop-OSR filters passed 4/4; README/docs are current and benchmark scores remain unchanged.

Optimizer loop checkpoint 6852f5f2 completes #435's first-region acceptance with deterministic active-loop invalidation evidence. Full normal and TSan JIT passed 117/117. General unequal/deeper reducible loop CFGs are split honestly into #438; README/docs are current and benchmark scores remain unchanged.

Optimizer exception groundwork a8d094a5 begins #436 with immutable handler-stack recovery and transactional VM reconstruction. Throwing bytecode is still rejected; this is substrate, not completed exception execution. Focused normal/TSan checks pass and benchmark scores remain unchanged.

Optimizer exception checkpoint 321b1593 publishes handler-aware frame/edge states end to end under #436. The bytecode graph still supplies empty handler slices; no throwing execution is claimed. README/docs are current and benchmark scores remain unchanged.

Optimizer exception checkpoint 1ee7e18a preserves active normal-flow catch handlers across real side exits and checks #436's fail-closed item. Calls/throws and exceptional successors remain unoptimized. README/docs are current; benchmark scores remain unchanged.

Precise-GC progress: 057a2ef adds bounded live moving-GC safepoints to optimizer loops and typed recovery-only object locals; 11e4b24 updates README/docs. Current focused evidence is 9/9 normal and 9/9 TSan. #432 now marks exact deoptimization reconstruction and live movable stack maps complete, while #437 remains open for no-GIL relocation stress and future pointer-producing native operations. Benchmark scores remain unchanged and current.

Optimizing-tier checkpoint 1b812e2/c3833eb: deterministic explicit throw→catch paths, including nested rethrow into an outer catch, now stay in AArch64 native optimizer code through return. The new exceptional SSA edge preserves exact unwound frame and handler state; uncaught throws still side-exit exactly. Combined optimizer TSan evidence is 83/83. #436 remains open for finally dispatch and call/effect exceptional successors; benchmark scores are unchanged.

Optimizer checkpoint e3cb3bb/bd94239: deterministic finally bodies now execute natively from explicit exceptional SSA edges, with exact completion/outer-handler recovery at end_finally and native return-overrides-throw behavior. Combined optimizer TSan evidence is 85/85. Remaining #436 work is dynamic native finally dispatch plus call/effect exceptional successors and the full differential matrix. Published benchmark scores are unchanged.

Optimizer checkpoint 0cb719d/80281cc adds exact exceptional control metadata for handler-active calls, constructors, properties, coercions, and all other interpreter-owned effects. The #436 modeling acceptance item is now complete; optimizer TSan passes 87/87. Native call/effect execution and dynamic finally dispatch remain. Benchmark scores are unchanged.

#436 is complete; #439 now has its first executable-exception-region prerequisite at e66f4f4/5a227e3: a backend-neutral operation descriptor and non-collapsing runtime result ABI. Focused normal+TSan evidence passes 3/3. Benchmarks are unchanged.

#439 now owns and publishes exact native-operation descriptors at 6c1d86a/443f6f0, including contiguous staged inputs and exceptional targets; artifact teardown releases them. Optimizer TSan passes 87/87. No benchmark workload changed.

#439 now has descriptor ownership plus an installed VM operation dispatcher through 2e401c0/2dcc3c9. The first operation is to_numeric; focused normal+TSan evidence passes 3/3 and the descriptor batch retains 87/87 optimizer TSan. Native generated invocation is not claimed yet.

#439 advanced in c8639bb/95e5675: the first native runtime effect now resumes owned catch/finally continuations after a throwing callback without replay. Exact operation/deopt/origin/step identity, live scratch roots, handler unwinding, throw-completion injection, and malformed-target refusal are covered; the optimizer TSan gate passes 149/149. Calls/constructors, additional effects, and native completion dispatch remain open under #439.

Progress on child #439: 19474871 executes ordinary AArch64 calls through the native runtime-operation ABI, including dynamic arity, precise callee/argument roots, normal return, and one-shot catch/finally continuation. c660c72 updates the concise README and optimizer status. The batched broad optimizer gate passes 149/149 under TSan; benchmark scores remain unchanged because the current published workloads do not exercise this call path. Main CI: https://github.com/zig-utils/zig-js/actions/runs/29891461400

Further #439 progress landed in 02a6aba/7ec0384: explicit-this calls and construction now execute through precisely rooted AArch64 runtime operations, including normal construction and exact one-shot caught constructor throws. The whole related batch passes 150/150 under TSan. README/status docs are current and benchmark scores remain unchanged. Main CI: https://github.com/zig-utils/zig-js/actions/runs/29891834824

Further #439 progress landed in 5603c4b/c0a502b: native named/computed reads plus zero-cost dup/swap now form complete source-level method-call chains with existing explicit-this calls. Artifact-owned names, dynamic input roots, null-before-key ordering, and one-shot getter/key/callee exceptions are covered. The batched broad optimizer gate passes 152/152 under TSan; benchmark scores remain unchanged. Main CI: https://github.com/zig-utils/zig-js/actions/runs/29892528373

The optimizer executable subset now includes named/computed property writes (e81430d), with artifact-owned names, precise receiver/key/RHS roots, canonical accessor/proxy/GC-barrier semantics, assignment-result preservation, and exact exceptional continuation. The batched broad JIT gate passes 155/155 under TSan; README and optimizer status were updated in df57bc7.

Published benchmark scores are unchanged because those workloads do not exercise this runtime-operation slice. Latest main CI: https://github.com/zig-utils/zig-js/actions/runs/29893229195

The optimizer executable subset now includes all three membership forms (in, instanceof, private-brand in) through 749c2aa. The operations preserve canonical proxy, coercion, Symbol.hasInstance, prototype/private-brand, TypeError, rooting, and exact catch behavior. The batched broad JIT gate passes 156/156 under TSan; README and optimizer status were updated in d7773bf.

Published benchmark scores are unchanged because these workloads do not exercise the runtime-operation slice. Latest main CI: https://github.com/zig-utils/zig-js/actions/runs/29893818314

The optimizer executable subset now includes the full unary/coercion bytecode group through 7ce8b63: -, unary +, !, typeof, ~, increment/decrement, ToString, and ToPropertyKey use the rooted operation ABI, while void lowers directly. Shared interpreter/VM/native semantics preserve conversion order, Number/BigInt behavior, and exact exceptions; callback results can feed Boolean control with exact step ownership.

The TSan JIT gate passes 157/157 and docs are current at 4f8ffa0. Published benchmark scores are unchanged because these workloads do not exercise this slice. Latest main CI: https://github.com/zig-utils/zig-js/actions/runs/29894681886

Optimizer checkpoint at edae6d74/b169dbf5: deterministic AArch64 regions now execute exponentiation and all bitwise/shift operators through the shared binary semantics path, including Number/BigInt behavior and exact exceptional continuation. Focused gates pass 5/5 binary coercions, 3/3 exceptional targets, and 4/4 dispatcher validation; the broad TSan JIT gate passes 158/158 with no skips, failures, or leaks. README capability wording is current; benchmark scores remain unchanged because these operations are outside the published workloads. Work continues in #439. Latest main CI: https://github.com/zig-utils/zig-js/actions/runs/29895064566

Optimizer checkpoint at bb28a32b/a5981afb: instruction-local, atomic operand profiles now distinguish guarded Number arithmetic from native dynamic runtime semantics at each bytecode site. + - * / %, relational operators, and loose/strict equality preserve canonical string/Number/BigInt/coercion behavior and exact exceptional continuation without regressing numeric specialization. Focused dynamic paths pass 6/6 normally and under TSan; profile concurrency passes 4/4; the broad optimizer TSan gate passes 161/161 with no skips, failures, or leaks. README capability wording is current and benchmark scores are unchanged. Work continues in #439. Latest main CI: https://github.com/zig-utils/zig-js/actions/runs/29895820403

Optimizer progress via #439: 3a32d9a adds executable direct-eval, named-method, spread-call, receiver-spread, and spread-construction SSA values with exact roots and exceptional targets. 979d541 updates README/docs; benchmark scores remain unchanged because these callbacks are outside the published workloads. The batched broad JIT gate passes 162/162 under TSan.

Tail-call optimizer checkpoint: fd687e3 makes plain, direct-eval, named-method, and explicit-this tails executable terminal SSA values while preserving the heap activation trampoline. Docs/README follow at 06c962f. Broad JIT TSan remains 162/162; benchmark scores are unchanged because this is outside the published workloads.

Optimizer construction checkpoint: ef1c0f8 makes every literal object/array construction effect executable, including zero-input allocations and one-shot throwing spreads. README/docs follow at 6aa623a. Broad JIT TSan passes 163/163; benchmark scores remain unchanged because these paths are outside the published workloads.

#432 and its final child #439 are complete. Main now has exact OSR/deopt/GC recovery plus executable runtime effects and native normal/throw/return/break/continue finally dispatch through b6d1b62. The final batch passes 164/164 broad JIT tests and 7/7 focused full-root native-finally tests under TSan with zero failures, skips, or leaks. #146 remains open for #132/#133, #433, #434, and the resulting #429 promotions; published benchmark scores are unchanged because this batch does not affect those workloads.

#440 completed the first #132 child: optimizer artifacts now own seqlock-stable polymorphic named-property snapshots and use guarded callback fast paths for reads/existing-slot writes. Evidence is 5/5 property-cache full-root TSan, 7/7 named property/accessor/proxy integration, and 165/165 broad JIT TSan. #132 remains open for direct generated guards, full differential/invalidation evidence, and the exact-parent profile; #433 now has real immutable property-IC metadata for its revalidation/retirement work.

#133 checkpoint: #450 is complete through 96d54ac2, 59063a77, and d372d0ae. General reducible optimizer regions now execute exact calls, construction, allocation, and literal effects with variable-arity frame-state staging. Push overrides/throws, injected OOM, termination, exact steps, native-on/off, and moving GC pass 4/4 normally and under TSan. #449 remains open for direct append/growth specialization, benchmark tier arbitration, and exact-parent profile/broad evidence; published scores are unchanged.

#451 is complete on main (a2010acc, 90de5f08): isolated optimizer exact-end assignment, literal append, and one-argument intrinsic push now use guarded spare-capacity publication after the GC barrier. Canonical fallback covers reallocation/full capacity, shared realms, holes, indexed prototypes, overrides, restrictions, and misses. Focused packed/allocating normal and TSan batches pass with zero leaks; the published arrays workload still selects the older VM kernels, so benchmark scores and tier priority are unchanged.

The optimizer roadmap is complete through f4f1ebcd and 9e51e1ff. All children (#431, #432, #132, #133, #433, #434, #429) are closed and reconciled. The released subset retains exact fallback outside its documented operations and sole macOS AArch64 backend.