@threadedstack/wmd-web 0.0.0-stage → 0.1.12

package/src/host/jit-hub-core.js

@@ -0,0 +1,208 @@
+// The JIT door's module hub logic (P-B2 adversarial F1), apart from the Worker shell in
+// jit-hub.js so tests can run it in-process. Each vCPU Worker has a port to the hub. The
+// Worker that compiles a module (jit_load / jit_compile) posts the WebAssembly.Module here
+// once; the hub forwards it to every other port and keeps it for ports that connect later.
+// A posted Module shares its compiled code (it is not compiled again), so the process holds
+// one copy of each module instead of one per vCPU Worker; Firefox has a per-process limit on
+// wasm code. A flush (a newer generation) drops the old ones.
+//
+// W31: the hub is the authority on delivery. Once it has posted a record's Module to every
+// port it has (the poster excepted: it has the Module) and keeps the Module and a copy of
+// the module's bytes for ports to come, it sets the record's R_DELIVERED cell in store.recs
+// (Atomics.store, after the posts) and counts it in H_DELIV. append() may then reuse that
+// record's log bytes. A post that fails (a 'lost' message) leaves the cell clear: the door
+// that could not get the Module compiles a local copy from the log bytes, which stay.
+//
+// W31b: a post can also fail on the receiving side, after the hub counted it delivered
+// (Firefox past its per-process wasm code limit cannot deserialize a Module: 'messageerror'
+// at the door, which cannot tell which Module it lost), and a Worker that starts late gets
+// the replay of Modules whose log bytes are long reused. Either door asks for the bytes
+// ({t:'want'}) and compiles its own copy from them, so the log never has to keep them.
+//
+// ports: objects with postMessage(msg); the owner feeds their messages to receive(port, msg).
+// The bytes kept are capped (bytesMax, oldest evicted first; the Modules themselves are not):
+// a 'want' for evicted bytes is answered 'lost', and that door then fails at once with a
+// clear error (only a Worker that also lost the Module itself needs them).
+//
+//   in:  {t:'mod', logOff, gen, module, bytes} | {t:'flush', gen}   (forwarded, without bytes)
+//        {t:'want', logOff, gen}   a door needs the bytes of that record
+//        {t:'drop', gen, owners}   D-514: forget these Modules (forwarded, to wake syncs)
+//        {t:'resend', logOff, gen} W57: a door did not get that Module: post it again (no answer when the
+//                                  hub has none of that generation yet: the loader's post is still coming)
+//   out: {t:'mod', logOff, gen, module} | {t:'flush', gen}   ({..., resent: true} when it answers 'resend')
+//        {t:'lost', logOff, gen}   a Module could not be posted, or bytes are not here
+//        {t:'bytes', logOff, gen, bytes}   the answer to 'want'
+import { H_DELIV, R_DELIVERED, REC_INTS } from './jit.js'
+
+export function createHubCore({ bytesMax: bytesMax0 = 256 << 20 } = {}) {
+  let bytesMax = bytesMax0
+  const ports = []
+  const starting = new Set() // W57: ports whose door has not said hello yet: nothing is posted to them
+  const pulling = new Set() // W57: ports whose door asks for each Module ({t:'resend'}): no pushes
+  const owed = new Map() // W57: pulling port -> logOffs it asked for before the hub had them (sent when they come)
+  let gen = 0
+  let mods = new Map() // logOff (the owner record index) -> Module (generation `gen`)
+  let bytes = new Map() // logOff -> the module's bytes (Uint8Array, generation `gen`), oldest first
+  let bytesHeld = 0
+  let answered = 0
+  let evicted = 0
+  let forwarded = 0
+  let resent = 0
+  let dropped = 0
+  let R = null
+  let hdr = null
+
+  function newGen(g) {
+    if (g <= gen) return
+    gen = g
+    mods = new Map()
+    bytes = new Map()
+    bytesHeld = 0
+    owed.clear()
+  }
+
+  // A post can fail (Firefox past its code limit may fail to serialize a Module): tell
+  // that Worker, so a sync waiting for the Module compiles a copy instead of waiting.
+  function send(p, m) {
+    try {
+      p.postMessage(m)
+      forwarded++
+      return true
+    } catch {
+      try {
+        p.postMessage({ t: 'lost', logOff: m.logOff, gen: m.gen })
+      } catch {}
+      return false
+    }
+  }
+
+  function receive(from, m) {
+    if (m.t === 'hello') {
+      // W57: the door is listening: now its replay (every Module of the generation, which includes
+      // the ones forwarded while it was starting), then the new ones
+      if (!starting.delete(from)) return
+      // D-512: a door that asks for each Module gets none unasked. A Worker that never reads its port (a
+      // compile thread, a helper waiting for work) kept every Module posted to it alive: Firefox frees a
+      // Module's code only once no Worker's queue holds it, and ran out of code space after a release.
+      if (m.pull) return void pulling.add(from)
+      for (const [logOff, module] of mods) send(from, { t: 'mod', logOff, gen, module })
+      return
+    }
+    if (m.t === 'flush') {
+      newGen(m.gen)
+      for (const p of ports) if (p !== from && !starting.has(p)) p.postMessage(m) // wakes syncs waiting for old modules
+      return
+    }
+    if (m.t === 'drop') {
+      // D-514: the guest dropped these cold modules: let their code go (a door that needs one again loads its bytes anew)
+      if (m.gen !== gen) return
+      for (const o of m.owners) {
+        mods.delete(o)
+        const b = bytes.get(o)
+        if (b) {
+          bytes.delete(o)
+          bytesHeld -= b.byteLength
+        }
+        for (const set of owed.values()) set.delete(o)
+      }
+      dropped += m.owners.length
+      for (const p of ports) if (p !== from && !starting.has(p)) p.postMessage(m) // wakes syncs waiting for one of them
+      return
+    }
+    if (m.t === 'want') {
+      const b = m.gen === gen ? bytes.get(m.logOff) : undefined
+      try {
+        from.postMessage(b ? { t: 'bytes', logOff: m.logOff, gen, bytes: b } : { t: 'lost', logOff: m.logOff, gen: m.gen })
+        if (b) answered++
+      } catch {}
+      return
+    }
+    if (m.t === 'pull') {
+      pulling.add(from)
+      return
+    }
+    if (m.t === 'resend') {
+      // W57: Firefox lost runs of pushed Module messages ('messageerror', its code space far from full)
+      // but delivered the ones posted in answer to the door's request. Without this the door compiled its
+      // own copy, every vCPU did, and the copies used up the code space the shared Modules were saving.
+      // A Module the hub does not have yet (the loader's post is still on its way) is sent to a pulling
+      // port when it comes: nothing else is pushed to that port.
+      if (m.gen !== gen) return
+      for (const logOff of m.logOffs || [m.logOff]) {
+        const mod = mods.get(logOff)
+        if (mod) {
+          if (send(from, { t: 'mod', logOff, gen, module: mod, resent: true })) resent++
+        } else if (pulling.has(from)) {
+          let o = owed.get(from)
+          if (!o) owed.set(from, (o = new Set()))
+          o.add(logOff)
+        }
+      }
+      return
+    }
+    if (m.t !== 'mod' || m.gen < gen) return
+    newGen(m.gen)
+    if (mods.has(m.logOff)) return
+    mods.set(m.logOff, m.module)
+    const kept = m.bytes instanceof Uint8Array
+    if (kept) {
+      bytes.set(m.logOff, m.bytes)
+      bytesHeld += m.bytes.byteLength
+      for (const [k, b] of bytes) {
+        if (bytesHeld <= bytesMax || k === m.logOff) break
+        bytes.delete(k)
+        bytesHeld -= b.byteLength
+        evicted++
+      }
+    }
+    const fwd = { t: 'mod', logOff: m.logOff, gen: m.gen, module: m.module }
+    let all = true
+    for (const p of ports) if (p !== from && !starting.has(p) && !pulling.has(p) && !send(p, fwd)) all = false // a starting port gets it in its replay, a pulling one when it asks
+    for (const [p, o] of owed) if (o.delete(m.logOff) && send(p, { ...fwd, resent: true })) resent++
+    if (all && kept && R) {
+      Atomics.store(R, m.logOff * REC_INTS + R_DELIVERED, 1) // only now: after every post, with the Module and its bytes kept
+      Atomics.add(hdr, H_DELIV, 1)
+    }
+  }
+
+  return {
+    /** The store whose records this hub marks delivered (the page's, from createJitStore). */
+    setStore(store) {
+      R = new Int32Array(store.recs)
+      hdr = new Int32Array(store.ctl, 0, 16)
+    },
+    /**
+     * A new port: once its door says hello it gets every Module of the generation (a replay), then the
+     * new ones. W57: nothing before that; Firefox delivered the Modules posted to a Worker that was still
+     * starting as 'messageerror' (each vCPU then compiled its own copies and ran out of code space).
+     */
+    addPort(port) {
+      ports.push(port)
+      starting.add(port)
+    },
+    receive,
+    /** P-B9: the bytes the hub keeps for these owner records of the current generation (copies), and the ones it does not. */
+    bytesFor(owners) {
+      const got = []
+      const missing = []
+      for (const o of owners) {
+        const b = bytes.get(o)
+        if (b) got.push([o, b.slice()])
+        else missing.push(o)
+      }
+      return { gen, got, missing }
+    },
+    /** W57: [Module, bytes] of each Module of the generation whose bytes the hub still keeps. */
+    *kept() {
+      for (const [logOff, module] of mods) {
+        const b = bytes.get(logOff)
+        if (b) yield [module, b]
+      }
+    },
+    /** P-B9: a checkpointing machine keeps every module's bytes: raise the limit (bytes held). */
+    setBytesMax(n) {
+      if (n > bytesMax) bytesMax = n
+    },
+    stats: () => ({ ports: ports.length, modules: mods.size, gen, forwarded, answered, bytesHeld, evicted, resent, dropped }),
+  }
+}

package/src/host/jit-hub.js

@@ -0,0 +1,93 @@
+// The JIT door's module hub (P-B2 adversarial F1): one Worker that never runs guest
+// code, so it always answers messages. The logic is jit-hub-core.js.
+//
+// in (self):  {t:'store', recs, ctl}      the JIT store (once, before any port)
+//             {t:'port', port}            a new Worker's port (from the page)
+//             {t:'bytes-of', id, owners}  P-B9: copies of those records' bytes -> {t:'bytes-of', id, gen, got:[[owner, bytes]], missing}
+//             {t:'config', bytesMax}      P-B9: raise the limit on the bytes kept
+//             {t:'replay', id, gen, mods:[{owner, bytes}]}  P-B9/W57: a restore's modules, compiled here (not in the
+//                                         page: a Module the page compiled keeps its code alive until the page collects
+//                                         its garbage, so in Firefox each restored machine's code outlived it) and kept
+//                                         as if a door had posted them -> {t:'replayed', id, n, reused} | {t:'replayed', id, error}
+//             {t:'handoff', port}         W57: post every Module of this generation with its bytes on port ({t:'mods',
+//                                         list:[{key, module, bytes}]}), for the hub of the machine a restore makes
+//             {t:'adopt', port}           W57: the next replay takes Modules from that port's {t:'mods'} instead of
+//                                         compiling the same bytes again (Firefox holds two copies of a guest's code
+//                                         otherwise, the old machine's until its Workers are collected, and its 2 GiB
+//                                         code space ran out when two guests in one page were restored). No answer
+//                                         in 30 s, or one that cannot be received here: the replay compiles.
+import { gcNudgeEvery } from './gcnudge.js'
+import { createHubCore } from './jit-hub-core.js'
+import { moduleKey, replayModuleList, sameBytes } from './jit-snap.js'
+
+// W32: WebKit gives a released Module's code back only after every thread that held the
+// Module has collected it. The hub holds every Module and allocates little, so without the
+// nudge (D-419, gcnudge.js) a flush never gave the code back: in WebKit, 93 MB of JIT code
+// stayed after a flush with the page and the vCPUs nudging, 2 MB with the hub nudging too
+// (docs/plans/w32-holder-results.md).
+gcNudgeEvery()
+
+const core = createHubCore()
+let adopted = null // W57: a Promise of [{key, module, bytes}] from the machine a restore replaces
+
+self.onmessage = e => {
+  const m = e.data
+  if (m.t === 'store') {
+    core.setStore(m)
+  } else if (m.t === 'port') {
+    const port = m.port
+    port.onmessage = ev => core.receive(port, ev.data)
+    core.addPort(port)
+  } else if (m.t === 'bytes-of') {
+    // P-B9: the bytes of module records the log released (a checkpoint needs them)
+    const r = core.bytesFor(m.owners)
+    self.postMessage({ t: 'bytes-of', id: m.id, ...r }, r.got.map(([, b]) => b.buffer))
+  } else if (m.t === 'replay') {
+    const from = { postMessage() {} } // not a port: every port gets the Modules (none yet: they are kept for the vCPUs)
+    const take = adopted || Promise.resolve([])
+    adopted = null
+    let reused = 0
+    take
+      .then(list => {
+        const have = new Map(list.map(x => [x.key, x]))
+        const reuse = b => {
+          const x = have.get(moduleKey(b))
+          if (!x || !sameBytes(x.bytes, b)) return null
+          reused++
+          return x.module
+        }
+        return replayModuleList(m.mods, m.gen, mod => core.receive(from, mod), { reuse })
+      })
+      .then(
+        n => self.postMessage({ t: 'replayed', id: m.id, n, reused }),
+        err => self.postMessage({ t: 'replayed', id: m.id, error: String(err && err.message ? err.message : err) }),
+      )
+  } else if (m.t === 'handoff') {
+    const list = []
+    for (const [module, b] of core.kept()) list.push({ key: moduleKey(b), module, bytes: b })
+    try {
+      m.port.postMessage({ t: 'mods', list })
+    } catch {
+      m.port.postMessage({ t: 'mods', list: [] }) // a Module that cannot be posted: the new hub compiles them all
+    }
+  } else if (m.t === 'adopt') {
+    const port = m.port
+    adopted = new Promise(res => {
+      let over = false
+      const done = list => {
+        if (over) return
+        over = true
+        port.onmessage = port.onmessageerror = null
+        port.close()
+        res(list)
+      }
+      port.onmessage = e => done(e.data?.list || [])
+      port.onmessageerror = () => done([]) // not deliverable here (Firefox past its code limit): compile instead
+      setTimeout(() => done([]), 30_000)
+    })
+  } else if (m.t === 'config') {
+    core.setBytesMax(m.bytesMax)
+  } else if (m.t === 'stats') {
+    self.postMessage({ t: 'stats', ...core.stats() })
+  }
+}

package/src/host/jit-snap.js

@@ -0,0 +1,226 @@
+// P-B9: the JIT door's state in a checkpoint, and back.
+//
+// What compiled code a restored guest needs. The guest's block cache (in memory 0, so in the
+// checkpoint) names compiled blocks by table index, and a table index is a slot of the door's
+// slot list: slot k = tableMin + k, in every thread's table. A restored guest that finds an
+// index with nothing behind it does not recover: the dispatcher bails out with SYNC_MISS, the
+// guest retries the same block and gets the same answer (cache.c; the guest has no "restore
+// without slots" resume yet, research/10 5.8). So the slot list has to come back exactly, and
+// that needs each live module's bytes.
+//
+// What is kept: the current generation's records (a flush makes the older ones dead: nothing in
+// a machine run calls jit_flush today) with their slot bases and function counts, and the bytes
+// of each module that owns its bytes. The bytes are in the module log, or, when the hub
+// delivered the Module and the log reused the space (W31 reclaim), in the hub's copy (W31b),
+// which the page asks for first (collectBytes).
+//
+// What is not kept: compiled code. The restoring page compiles every module again
+// (WebAssembly.compile in parallel, in the page) and hands the Modules to the hub, as the
+// loading door did in the first run, before any vCPU starts. That compile is the cost of a
+// restore on the browser: it is measured in the proof.
+import { H_GEN, H_LIVE_KIB, H_LOG_USED, H_MOD_START, H_NMOD, H_NSLOTS, H_SLOT0, HDR_INTS, REC_INTS, R_DELIVERED, R_DROPPED, R_FREED, R_GEN, R_LEN, R_LOG_OFF, R_NFUNCS, R_OWNER, R_SLOT_BASE, createJitStore, hash64 } from './jit.js'
+
+const align8 = n => (n + 7) & ~7
+
+/**
+ * The owners (record indexes) of the current generation whose bytes the module log no longer
+ * holds: the page asks the hub for these before capture().
+ */
+export function ownersNeedingHub(store) {
+  const hdr = new Int32Array(store.ctl, 0, HDR_INTS)
+  const R = new Int32Array(store.recs)
+  const out = []
+  const n = Atomics.load(hdr, H_NMOD)
+  for (let r = Atomics.load(hdr, H_MOD_START); r < n; r++) {
+    const b = r * REC_INTS
+    if (Atomics.load(R, b + R_OWNER) === r && Atomics.load(R, b + R_FREED) && !Atomics.load(R, b + R_DROPPED)) out.push(r)
+  }
+  return out
+}
+
+/**
+ * Reads the store. The guest must be stopped (compile workers included): the store is read
+ * without its lock. hubBytes: Map owner -> Uint8Array for the owners ownersNeedingHub named.
+ * Returns {gen, nslots, nrec, recs: Int32Array, log: Uint8Array} in the store's own layout, but
+ * dense: records renumbered from 0, the log holding each owner's bytes once.
+ */
+export function captureJit(store, hubBytes = new Map()) {
+  const hdr = new Int32Array(store.ctl, 0, HDR_INTS)
+  const R = new Int32Array(store.recs)
+  const L = new Uint8Array(store.log)
+  const gen = Atomics.load(hdr, H_GEN)
+  const first = Atomics.load(hdr, H_MOD_START)
+  const n = Atomics.load(hdr, H_NMOD)
+  // D-514: dropped modules are left out (the guest's table names none of their functions)
+  const kept = []
+  for (let r = first; r < n; r++) if (!Atomics.load(R, r * REC_INTS + R_DROPPED)) kept.push(r)
+  const nrec = kept.length
+  const recs = new Int32Array(nrec * REC_INTS)
+  const index = new Map() // old owner -> new index
+  let total = 0
+  for (const r of kept) {
+    const b = r * REC_INTS
+    if (Atomics.load(R, b + R_OWNER) === r) total += align8(Atomics.load(R, b + R_LEN))
+  }
+  const log = new Uint8Array(total)
+  let off = 0
+  for (let i = 0; i < nrec; i++) {
+    const r = kept[i]
+    const b = r * REC_INTS
+    const o = Atomics.load(R, b + R_OWNER)
+    const nb = i * REC_INTS
+    for (let k = 0; k < REC_INTS; k++) recs[nb + k] = Atomics.load(R, b + k)
+    recs[nb + R_GEN] = gen
+    recs[nb + R_DELIVERED] = 0 // the restoring hub marks it
+    recs[nb + R_FREED] = 0
+    if (o === r) {
+      const len = Atomics.load(R, b + R_LEN)
+      let bytes
+      if (Atomics.load(R, b + R_FREED)) {
+        bytes = hubBytes.get(r)
+        if (!bytes || bytes.length !== len) {
+          throw new Error(`jit snapshot: the bytes of module record ${r} (${len} bytes) were released from the module log and the hub does not hold them (evicted past its limit)`)
+        }
+      } else {
+        const lo = Atomics.load(R, b + R_LOG_OFF)
+        bytes = L.subarray(lo, lo + len)
+        // released while we copy would mean a vCPU is still running: the caller's contract
+        if (Atomics.load(R, b + R_FREED)) throw new Error(`jit snapshot: record ${r} was released while it was read (the guest is not stopped)`)
+      }
+      log.set(bytes, off)
+      recs[nb + R_LOG_OFF] = off
+      index.set(r, i)
+      off += align8(len)
+    }
+  }
+  for (let i = 0; i < nrec; i++) {
+    const r = kept[i]
+    const nb = i * REC_INTS
+    const o = Atomics.load(R, r * REC_INTS + R_OWNER)
+    const mapped = index.get(o)
+    if (mapped === undefined) throw new Error(`jit snapshot: record ${r} is de-duplicated against record ${o}, which is not in this generation`)
+    recs[nb + R_OWNER] = mapped
+    if (o !== r) recs[nb + R_LOG_OFF] = recs[mapped * REC_INTS + R_LOG_OFF]
+  }
+  return { gen, nslots: Atomics.load(hdr, H_NSLOTS), slot0: Atomics.load(hdr, H_SLOT0), nrec, recs, log }
+}
+
+/** D-514: records saved with an older, narrower layout (14 cells before D-514) widened to REC_INTS. */
+export function widenRecs(recs, nrec) {
+  if (!nrec || recs.length === nrec * REC_INTS || recs.length % nrec) return recs
+  const w = recs.length / nrec
+  if (w > REC_INTS) return recs
+  const out = new Int32Array(nrec * REC_INTS)
+  for (let r = 0; r < nrec; r++) out.set(recs.subarray(r * w, r * w + w), r * REC_INTS)
+  return out
+}
+
+/** A fresh store holding a captured slot list (no Module yet: replay() makes those). */
+export function restoreStore(snap, opts = {}) {
+  const logMax = Math.max(opts.logMax ?? 1 << 30, snap.log.length)
+  const store = createJitStore({ ...opts, logMax, logInitial: Math.min(logMax, Math.max(opts.logInitial ?? 1 << 20, snap.log.length)), recInitial: Math.max(opts.recInitial ?? 4096, snap.nrec) })
+  const hdr = new Int32Array(store.ctl, 0, HDR_INTS)
+  const R = new Int32Array(store.recs)
+  const L = new Uint8Array(store.log)
+  R.set(snap.recs)
+  L.set(snap.log)
+  Atomics.store(hdr, H_GEN, snap.gen)
+  Atomics.store(hdr, H_MOD_START, 0)
+  Atomics.store(hdr, H_NMOD, snap.nrec)
+  Atomics.store(hdr, H_NSLOTS, snap.nslots)
+  // W34: the generation's first slot (slots are never rewound) and the KiB its modules hold
+  // against the budget (each owner record counted once, as jit_load adds it). A snapshot from
+  // before W34 has no slot0: its generation starts at its lowest slot base.
+  let slot0 = snap.nslots
+  let liveKiB = 0
+  for (let r = 0; r < snap.nrec; r++) {
+    const b = r * REC_INTS
+    slot0 = Math.min(slot0, snap.recs[b + R_SLOT_BASE])
+    if (snap.recs[b + R_OWNER] === r) liveKiB += Math.ceil(snap.recs[b + R_LEN] / 1024)
+  }
+  Atomics.store(hdr, H_SLOT0, snap.slot0 ?? slot0)
+  Atomics.store(hdr, H_LIVE_KIB, liveKiB)
+  Atomics.store(hdr, H_LOG_USED, snap.log.length)
+  return store
+}
+
+/** The owner records of a captured snapshot with their bytes: [{owner, bytes}]. */
+export function modulesOf(snap) {
+  const out = []
+  for (let r = 0; r < snap.nrec; r++) {
+    const b = r * REC_INTS
+    if (snap.recs[b + R_OWNER] !== r) continue
+    const lo = snap.recs[b + R_LOG_OFF]
+    out.push({ owner: r, bytes: snap.log.subarray(lo, lo + snap.recs[b + R_LEN]), nfuncs: snap.recs[b + R_NFUNCS], slotBase: snap.recs[b + R_SLOT_BASE] })
+  }
+  return out
+}
+
+/**
+ * Compiles every module of a snapshot (WebAssembly.compile: the engine uses its background
+ * threads) and gives each to post({t:'mod', logOff: owner, gen, module, bytes}), the message a
+ * loading door sends the hub. Resolves when all are posted. concurrency bounds the compiles
+ * in flight (memory: a Module's code is held from here on).
+ */
+export async function replayModules(snap, post, { concurrency = 16, onProgress } = {}) {
+  return replayModuleList(modulesOf(snap), snap.gen, post, { concurrency, onProgress })
+}
+
+/** A module's identity by content: its length and a 64-bit hash of its bytes (W57: a restore's Modules found by content). */
+export function moduleKey(bytes) {
+  const [a, b] = hash64(bytes)
+  return `${bytes.length}:${a >>> 0}:${b >>> 0}`
+}
+
+export function sameBytes(a, b) {
+  if (a.length !== b.length) return false
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false
+  return true
+}
+
+/**
+ * replayModules for a list of {owner, bytes} of generation gen (the hub's replay: W57). reuse(bytes) may return a
+ * Module already compiled from the same bytes (the machine a restore replaces), which is posted instead of a compile.
+ */
+export async function replayModuleList(mods, gen, post, { concurrency = 16, onProgress, reuse } = {}) {
+  let next = 0
+  let done = 0
+  async function lane() {
+    for (;;) {
+      const i = next++
+      if (i >= mods.length) return
+      const m = mods[i]
+      const module = reuse?.(m.bytes) || (await WebAssembly.compile(m.bytes))
+      post({ t: 'mod', logOff: m.owner, gen, module, bytes: m.bytes.slice() })
+      onProgress?.(++done, mods.length)
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, mods.length) }, lane))
+  return mods.length
+}
+
+export const jitSnapStats = snap => ({ records: snap.nrec, slots: snap.nslots, modules: modulesOf(snap).length, logBytes: snap.log.length, recBytes: snap.recs.byteLength })
+
+
+/**
+ * Refuses a snapshot whose records do not describe its own log: a checkpoint is read from a file, and a record that points
+ * outside the log, at an owner that is not an owner or past the slot count would make the replay read garbage.
+ */
+export function validateSnap(snap) {
+  const bad = why => {
+    throw new Error(`jit snapshot is damaged: ${why}`)
+  }
+  if (snap.recs.length !== snap.nrec * REC_INTS) bad(`${snap.recs.length} record cells for ${snap.nrec} records`)
+  if (!Number.isInteger(snap.nslots) || snap.nslots < 0 || snap.nslots > 0x7fffffff) bad(`slot count ${snap.nslots}`)
+  for (let r = 0; r < snap.nrec; r++) {
+    const b = r * REC_INTS
+    const owner = snap.recs[b + R_OWNER]
+    const off = snap.recs[b + R_LOG_OFF]
+    const len = snap.recs[b + R_LEN]
+    const base = snap.recs[b + R_SLOT_BASE]
+    const nf = snap.recs[b + R_NFUNCS]
+    if (owner < 0 || owner > r || snap.recs[owner * REC_INTS + R_OWNER] !== owner) bad(`record ${r} names owner ${owner}`)
+    if (off < 0 || len <= 0 || off + len > snap.log.length) bad(`record ${r} lies outside the ${snap.log.length}-byte log (${off}+${len})`)
+    if (base < 0 || nf < 0 || base + nf > snap.nslots) bad(`record ${r} has slots ${base}..${base + nf} past the slot count ${snap.nslots}`)
+  }
+}