fix(quickcheck): produce shrink candidates without recursing per block

Replace the recursion in `removes_array` and `removes_list` with a cursor over
the block offsets. Both now walk `0, k, 2k, ..` directly — ascending for the
array, descending for the list — so building the iterator is O(1) and yielding
a candidate uses no stack beyond the call itself. The candidate sequences and
`size_hint`s are the ones the previous commit pinned, which is why that test
file is unchanged here.

This fixes the three stack-overflow tests from the previous commit on js, wasm
and wasm-gc, so a property test whose counterexample is a large collection now
shrinks instead of dying with `RangeError: Maximum call stack size exceeded`.

It is also much faster on the `List` side, because the old form rebuilt the
candidate through one `concat` per level on the way back up, where the new one
does a single `take`/`drop`/`concat`. First candidate from a 10,000-element
collection, native release:

| Collection | Before    | After     |
| ---------- | --------: | --------: |
| Array      | 240.69 ns | 288.55 ns |
| List       |   1.32 ms | 213.65 µs |

The array case is a hair slower — it now allocates the candidate through an
array spread instead of returning a shared empty literal — and in exchange the
`k == n` special case added in #4208 is gone, since taking a zero-length prefix
already costs nothing.

The benchmark goes back to 10,000 elements; #4208 had to lower it to 1,000
precisely because of the bug this fixes.

The comments in `deep_recursion_wbtest.mbt` move to the past tense here, so
that they describe the failure the tests guard against rather than the code as
it now stands.

Reviewed by Codex CLI together with the preceding test commit: "Verified
ordering, exact size hints, non-divisible lengths, `k == n` without element
copying, and cursor compatibility with single-use iterators. Independent
old/new models agree for 5,050 input pairs."

Signed-off-by: Codex CLI <codex@openai.com>

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jtBJHK749cpStav5ZMNCr

Author: bobzhang

quickcheck/shrink/deep_recursion_wbtest.mbt

@@ -19,10 +19,11 @@
 const DEEP : Int = 20000
 
 ///|
-/// `removes_list` recurses once per removed block, and the recursive call sits
-/// in argument position, so the whole descent runs while the iterator is being
-/// built -- before it can yield anything. With `k = 1` that is one frame per
-/// element.
+/// `removes_list` used to recurse once per removed block, with the recursive
+/// call in argument position, so the whole descent ran while the iterator was
+/// being built -- before it could yield anything. With `k = 1` that was one
+/// stack frame per element, and this test overflowed the stack on js, wasm and
+/// wasm-gc.
 test "removes_list builds its candidates without recursing per element" {
   let xs : @list.List[Int] = List(Array::makei(DEEP, i => i))
   guard removes_list(1, DEEP, xs).next() is Some(candidate) else {
@@ -34,9 +35,10 @@ test "removes_list builds its candidates without recursing per element" {
 }
 
 ///|
-/// `removes_array` has the same shape. Its candidate order reaches `k = 1`
-/// only at the end of the sequence, so a property test hits this later than it
-/// hits the `List` case, but the recursion depth is the same.
+/// `removes_array` had the same shape and overflowed the same way. Its
+/// candidate order reaches `k = 1` only at the end of the sequence, so a
+/// property test would have hit this later than it hits the `List` case, but
+/// the depth was the same.
 test "removes_array builds its candidates without recursing per element" {
   let xs = Array::makei(DEEP, i => i)
   guard removes_array(1, DEEP, xs).next() is Some(candidate) else {
@@ -48,8 +50,9 @@ test "removes_array builds its candidates without recursing per element" {
 }
 
 ///|
-/// The user-visible symptom: a property test whose counterexample is a large
-/// list crashes while shrinking instead of reporting the counterexample.
+/// The user-visible symptom this guards against: a property test whose
+/// counterexample was a large list crashed while shrinking instead of
+/// reporting the counterexample.
 test "shrinking a large list yields a candidate" {
   let xs : @list.List[Int] = List(Array::makei(DEEP, i => i))
   guard Shrink::shrink(xs).next() is Some(candidate) else {

quickcheck/shrink/utils.mbt

@@ -25,29 +25,42 @@ fn[T] deferred(f : () -> Iter[T]) -> Iter[T] {
 }
 
 ///|
-/// `n` must be `xs.length()`; the recursive call maintains that, and both
-/// guards below rely on it.
+/// Yields `xs` with one block of `k` consecutive elements removed: one
+/// candidate per block offset `0, k, 2k, ..`, up to the last offset that still
+/// leaves a whole block, in ascending order.
+///
+/// `n` must be `xs.length()`.
 fn[T] removes_array(k : Int, n : Int, xs : Array[T]) -> Iter[Array[T]] {
   guard k <= n else { [||] }
-  // Dropping every element leaves the empty array; taking the `k`-element
-  // prefix first would copy the whole array only to discard it. Past this
-  // guard `xs[k:]` is non-empty.
-  guard k < n else { [|[]|] }
-  let xs2 = xs[:k].to_owned()
-  let xs1 = xs[k:].to_owned()
-  [|xs1|].add(removes_array(k, n - k, xs1).map(x => xs2 + x))
+  let mut start = 0
+  Iter::new(
+    fn() {
+      guard start + k <= n else { None }
+      let candidate = [..xs[:start], ..xs[start + k:]]
+      start += k
+      Some(candidate)
+    },
+    size_hint=(n - k) / k + 1,
+  )
 }
 
 ///|
+/// The `@list.List` counterpart of `removes_array`, except that the offsets
+/// descend: the block nearest the end is removed first.
+///
+/// `n` must be `xs.length()`.
 fn[T] removes_list(k : Int, n : Int, xs : @list.List[T]) -> Iter[@list.List[T]] {
   guard k <= n else { [||] }
-  let xs_drop = xs.drop(k)
-  if xs_drop.is_empty() {
-    [|List([])|]
-  } else {
-    let xs_take = xs.take(k)
-    removes_list(k, n - k, xs_drop).map(x => xs_take.concat(x)).add([|xs_drop|])
-  }
+  let mut start = (n - k) / k * k
+  Iter::new(
+    fn() {
+      guard start >= 0 else { None }
+      let candidate = xs.take(start).concat(xs.drop(start + k))
+      start -= k
+      Some(candidate)
+    },
+    size_hint=(n - k) / k + 1,
+  )
 }
 
 ///|

quickcheck/shrink_collection_bench_test.mbt

@@ -13,13 +13,13 @@
 // limitations under the License.
 
 ///|
-test "bench shrink Array first candidate size=1000" (it : @bench.T) {
-  let input = Array::make(1000, ())
+test "bench shrink Array first candidate size=10000" (it : @bench.T) {
+  let input = Array::make(10000, ())
   it.bench(fn() { it.keep(@shrink.Shrink::shrink(input).next()) })
 }
 
 ///|
-test "bench shrink List first candidate size=1000" (it : @bench.T) {
-  let input : @list.List[Unit] = List(Array::make(1000, ()))
+test "bench shrink List first candidate size=10000" (it : @bench.T) {
+  let input : @list.List[Unit] = List(Array::make(10000, ()))
   it.bench(fn() { it.keep(@shrink.Shrink::shrink(input).next()) })
 }