perf(codegen): #6812 — widen whole-loop write-clone eligibility (Mul RHS, let alias, while form, dynamic bounds)

[proggeramlug]

Second gap-closure slice from the #6812 matrix, stacked on #6829. Widens the whole-loop object-write clone's eligibility — four narrow relaxations of one matcher/emitter pair:

1. Multiplication in the numeric RHS — match_object_array_write_number admits Mul, with endpoint-product interval arithmetic in the finite-range proof and fmul emission.
2. let-declared receiver aliases — sound because every statement in the matched region must be a PutValueSet on the alias, so reassignment is structurally impossible; captures were already excluded via boxed_vars.
3. The let i = 0; while (i < N) { …; i++ } spelling of the counted inner loop — the store-shape constraints admit no continue or other control flow, and the emitter's existing counter finalization gives the function-scoped counter its post-loop value.
4. Dynamic inner bounds — for (let i = 0; i < arr.length; i++) over the SAME array the loop writes. The guard receives a u32::MAX sentinel and resolves the scan length from the validated array's header (rejecting > 16M); the emitter loads the length register in a new guard-ok fast.entry block, so the fast nest can never outrun the proven prefix. Length is loop-invariant by construction (the matched body admits only element-field stores). The 16M cap doubles as the finite-range ceiling.

Measured (3-run medians, node v26.3.0/arm64, release + default pipeline)

cell	before	after	ratio vs node
w3_mul_rhs	47 ms	6 ms	0.75× — beats node
w4_dyn_bound	50 ms	6 ms	0.75× — beats node
w5_while	46 ms	5 ms	0.62–0.71× — beats node
w7_mut_alias	70 ms	6 ms	0.75× — beats node

9 of 18 matrix rows now beat node. Full-sweep regression check, suites, and gap-gate results in the PR comment (re-run on this tip).

Review notes

• A mid-slice edit widened the WRONG matcher (packed_f64_range_loop_index_offset shares an identical guard line; Mul there would have read an i * c index as offset c). Caught pre-merge because the target cell didn't improve; reverted surgically, and a multiplied-index semantic sanity (byte-diffed vs node) now guards that family.
• Call-in-body (w6) is deliberately NOT widened — calls introduce safepoints into the call-free nest; that row needs its own design (the discarded-regression territory from perf: add bounded polymorphic object-write PIC #6823's notes).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1953cda1-8af1-44e6-964f-202810c74d9e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch perf/6812-clone-eligibility

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}