jz 0.3.0 → 0.4.0

package/src/narrow.js

@@ -192,11 +192,20 @@ function enrichCallerValTypesFromPointerParams(callerCtx) {
 function refreshCallerLocals(callerCtx) {
   for (const func of ctx.func.list) {
     if (!func.body || func.raw) continue
+    // Seed pointer-narrowed params' val-kind so analyzeBody recognises e.g.
+    // `n = arr.length` (arr a TYPED/BUFFER pointer param) as an i32 local — without
+    // this, post-G `refreshCallerLocals` still walks bodies with arr untyped, the
+    // length stays f64, and any callee taking that length never gets an i32 param
+    // (heapsort→siftDown's `end`). analyzeFuncForEmit re-seeds + re-invalidates at
+    // emit time, so this transient repByLocal doesn't leak past narrowing.
+    ctx.func.repByLocal = new Map()
+    for (const p of func.sig.params) if (p.ptrKind != null) ctx.func.repByLocal.set(p.name, { val: p.ptrKind })
     invalidateLocalsCache(func.body)
     const fresh = analyzeLocals(func.body)
     for (const p of func.sig.params) if (!fresh.has(p.name)) fresh.set(p.name, p.type)
     callerCtx.get(func).callerLocals = fresh
   }
+  ctx.func.repByLocal = null
 }
 
 function resetParamWasmFacts(paramReps) {
@@ -361,10 +370,24 @@ export default function narrowSignatures(programFacts, ast) {
       },
     },
   ])
+  // Transitive ctor/schema propagation down call chains. A naive single-pass
+  // mergeRule poisons a callee's param on the *first* sweep if the caller's own
+  // param (the very thing that supplies the ctor) hasn't been typed yet — and the
+  // poison is sticky, so later sweeps can't recover. Two-pass was the old patch;
+  // it still loses any chain deeper than `main→f→g→h` (e.g. heapsort's siftDown).
+  // Fix: iterate a *soft* merge — propagate known ctors, treat "can't tell yet"
+  // as skip (no poison) — to a fixpoint, then one *hard* validating sweep that
+  // poisons params whose call sites still can't be proven (genuinely-untyped args).
   const runArrElemFixpoint = (field, inferFn, elemsCtxMap) => {
-    runCallsiteLattice([mergeRule(field, (arg, _k, state) =>
-      inferFn(arg, elemsCtxMap.get(state.callerFunc), state.callerParamFacts(field))
-    )])
+    const infer = (arg, _k, state) => inferFn(arg, elemsCtxMap.get(state.callerFunc), state.callerParamFacts(field))
+    let changed
+    const bump = (r, v) => { if (v == null || r[field] === null) return; const b = r[field]; mergeParamFact(r, field, v); if (r[field] !== b) changed = true }
+    const soft = {
+      missing(r, k, state) { const def = defaultArg(state, k); if (def != null) bump(r, infer(def, k, state)) },
+      apply(r, arg, k, state) { bump(r, infer(arg, k, state)) },
+    }
+    do { changed = false; runCallsiteLattice([soft]) } while (changed)
+    runCallsiteLattice([mergeRule(field, infer)])
   }
   const runArrFixpoint = () => runArrElemFixpoint('arrayElemSchema', inferArgArrElemSchema, phase.callerElems('arrElemSchemas'))
   const runArrValTypeFixpoint = () => runArrElemFixpoint('arrayElemValType', inferArgArrElemValType, phase.callerElems('arrElemValTypes'))
@@ -423,18 +446,22 @@ export default function narrowSignatures(programFacts, ast) {
       if (isBlockBody(body) && hasBareReturn(body)) continue
       const exprs = returnExprs(body)
       if (!exprs.length) continue
-      // Skip narrowing when any return-tail is `>>>` (unsigned uint32). Narrowing to i32
-      // loses the unsigned interpretation: the wrapper rebox via `f64.convert_i32_s` would
-      // sign-flip values with bit 31 set, breaking the canonical `(x >>> 0)` uint32 idiom.
-      // A future pass could track sig.unsignedResult and emit `f64.convert_i32_u` instead.
-      if (exprs.some(e => Array.isArray(e) && e[0] === '>>>')) continue
+      // Narrow result to i32 when every return-tail types as i32 (incl. bitwise ops, `|0`,
+      // and `>>>`). When ANY tail is `>>>` (unsigned uint32 idiom) we still narrow, but tag
+      // `sig.unsignedResult` so the call-site rebox uses `f64.convert_i32_u` — preserving
+      // the [0, 2^32) range that `(x >>> 0)` carries through hash/CRC finalizers.
+      const anyUnsigned = exprs.some(e => Array.isArray(e) && e[0] === '>>>')
       const savedCurrent = ctx.func.current
       ctx.func.current = func.sig
       const locals = isBlockBody(body) ? analyzeLocals(body) : new Map()
       for (const p of func.sig.params) if (!locals.has(p.name)) locals.set(p.name, p.type)
       const allI32 = exprs.every(e => exprTypeWithCalls(e, locals) === 'i32')
       ctx.func.current = savedCurrent
-      if (allI32) { func.sig.results = ['i32']; changed = true }
+      if (allI32) {
+        func.sig.results = ['i32']
+        if (anyUnsigned) func.sig.unsignedResult = true
+        changed = true
+      }
     }
   }
 

package/src/optimize.js

@@ -45,17 +45,19 @@ const UNDEF_BITS = '0x' + (LAYOUT.NAN_PREFIX_BITS | (2n << BigInt(LAYOUT.AUX_SHI
  *   0 — nothing. Fastest compile, largest output. Useful for live coding.
  *   1 — encoding-compactness only (treeshake + sortLocalsByUse + fusedRewrite-inline).
  *       Cheap, no IR rewrites that perturb V8's tier-up shape.
- *   2 — default. Stable jz passes (every pass with benchmark proof). watr disabled
- *       by default — adds ~2s compile time for identical runtime performance.
- *   3 — aggressive experimental passes in addition to level 2.
+ *   2 — default. All stable jz passes + watr in 'light' mode (everything except
+ *       `inline` / `inlineOnce`). 'light' delivers most of the size win
+ *       (treeshake / dedupe / dedupTypes / coalesce / propagate / packData / fold /
+ *       peephole / vacuum / mergeBlocks / brif / loopify / …) at essentially zero
+ *       net compile cost — the smaller wasm makes watrCompile downstream faster.
+ *   3 — level 2 + full watr (adds inlining) + aggressive experimental tunings.
  *
  * String aliases (the size↔speed tradeoff lives entirely in the unroll/scalar
- * knobs, so the aliases just dial those):
- *   'size'     — level 2 with loop/const unroll + lane vectorization off and tight
- *                scalar-replacement caps. Smallest wasm; still fully optimized.
+ * knobs; watr is on for all three):
+ *   'size'     — loop/const unroll + lane vectorization off, tight scalar-replacement
+ *                caps. Smallest wasm.
  *   'balanced' — the default (= level 2).
- *   'speed'    — level 2 with full nested unroll + lane vectorization on (= level 3
- *                minus the heavy third-party watr pass).
+ *   'speed'    — full nested unroll + lane vectorization (= level 3).
  */
 export const PASS_NAMES = [
   'watr',                     // third-party WAT-level CSE/DCE/inlining (heaviest)
@@ -67,6 +69,7 @@ export const PASS_NAMES = [
   'hoistInvariantCellLoads',
   'cseScalarLoad',
   'csePureExpr',
+  'dropDeadZeroInit',
   'deadStoreElim',
   'promoteGlobals',          // read-only global.get → local for multi-read globals
   'sortLocalsByUse',
@@ -87,16 +90,30 @@ const ALL_OFF = Object.freeze(Object.fromEntries(PASS_NAMES.map(n => [n, false])
 const LEVEL_PRESETS = Object.freeze({
   0: ALL_OFF,
   1: Object.freeze({ ...ALL_OFF, treeshake: true, sortLocalsByUse: true, fusedRewrite: true }),
-  2: Object.freeze({ ...ALL_ON, watr: false, nestedSmallConstForUnroll: 'auto' }),
-  3: ALL_ON,
-  // Named aliases — dial the size↔speed knobs on top of the level-2 base.
-  balanced: Object.freeze({ ...ALL_ON, watr: false, nestedSmallConstForUnroll: 'auto' }),
+  // Default (level 2 / 'balanced'): every stable pass + watr in 'light' mode.
+  // 'light' = all watr passes except inlining (`inline` / `inlineOnce`). Inlining is
+  // skipped at L2 because it breaks regex-split semantics (watr 4.6.4) and reshapes
+  // codegen tests that assert on pre-inline function structure. The remaining passes
+  // (treeshake/dedupe/dedupTypes/coalesce/propagate/packData/fold/peephole/...) still
+  // deliver most of watr's size win at essentially zero compile cost.
+  2: Object.freeze({ ...ALL_ON, watr: 'light', nestedSmallConstForUnroll: 'auto' }),
+  // L3/'speed' trades a bit of heap headroom for fewer __arr_grow / __hash growth
+  // cycles. arrayMinCap=16 means `[]` and `new Array()` skip the first two doublings
+  // (0→2→4→8→16); hashSmallInitCap=8 keeps per-object __dyn_props at the same load
+  // factor as the global __hash_new on first set, avoiding the 2→4→8 grow chain.
+  // Net cost: ~128 B per empty array, ~144 B per per-object hash. Net win on the
+  // watr.compile profile: __arr_grow ~6.7% → ~3%, and lower __ihash_get_local
+  // probe depth from a denser-load global hash.
+  3: Object.freeze({ ...ALL_ON, arrayMinCap: 16, hashSmallInitCap: 8 }),
+  // 'balanced' = level 2; 'size' tightens scalar/unroll caps; 'speed' = level 3.
+  balanced: Object.freeze({ ...ALL_ON, watr: 'light', nestedSmallConstForUnroll: 'auto' }),
   size: Object.freeze({
-    ...ALL_ON, watr: false,
+    ...ALL_ON,
     smallConstForUnroll: false, nestedSmallConstForUnroll: false, vectorizeLaneLocal: false,
     scalarTypedLoopUnroll: 4, scalarTypedNestedUnroll: 8, scalarTypedArrayLen: 8,
   }),
-  speed: Object.freeze({ ...ALL_ON, watr: false }),
+  // 'speed' === level 3: full watr (inlining on) + L3 cap/hash tuning.
+  speed: Object.freeze({ ...ALL_ON, arrayMinCap: 16, hashSmallInitCap: 8 }),
 })
 
 /**
@@ -118,7 +135,16 @@ export function resolveOptimize(opt) {
     const baseLevel = typeof opt.level === 'number' || typeof opt.level === 'string' ? opt.level : 2
     const base = LEVEL_PRESETS[baseLevel] || ALL_ON
     const out = { ...base }
-    for (const n of PASS_NAMES) if (n in opt) out[n] = n === 'nestedSmallConstForUnroll' && opt[n] === 'auto' ? 'auto' : !!opt[n]
+    for (const n of PASS_NAMES) {
+      if (!(n in opt)) continue
+      const v = opt[n]
+      // Preserve sentinel values that downstream resolution depends on:
+      //   nestedSmallConstForUnroll: 'auto' (heuristic at emit time)
+      //   watr: 'light' (curated subset — see index.js watrOpts)
+      if (n === 'nestedSmallConstForUnroll' && v === 'auto') out[n] = 'auto'
+      else if (n === 'watr' && v === 'light') out[n] = 'light'
+      else out[n] = !!v
+    }
     // Preserve non-pass tuning keys (e.g. plan.js thresholds)
     for (const k of Object.keys(opt)) if (!PASS_NAMES.includes(k)) out[k] = opt[k]
     return out
@@ -1148,6 +1174,72 @@ export function csePureExpr(fn) {
   if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals)
 }
 
+/**
+ * Drop redundant zero-initialisation of fresh function-scope locals.
+ *
+ * WASM zero-initialises every local on entry (0 / 0.0 / null). jz lowers source
+ * `let x = 0` to `(local $x …)` + `(local.set $x (<zero const>))` at the top of
+ * the function body — the explicit set is a no-op when nothing has touched `$x`
+ * yet. `wasm-opt -Oz` elides these; do the same so jz's own output is minimal.
+ *
+ * Only removes a `(local.set $L (i32|i64|f64|f32.const 0))` when:
+ *   - `$L` is a non-param local (a param's "default" is the incoming arg, not 0),
+ *   - it is a *top-level* body statement (never descend into block/loop/if — a
+ *     nested zero-set inside a loop genuinely re-initialises across iterations),
+ *   - `$L` has not been referenced by any earlier top-level statement (so the
+ *     local still holds its entry-time zero at this point),
+ *   - `$L` is read (`local.get`) somewhere in the function (otherwise leave the
+ *     store for deadStoreElim and avoid orphaning the `(local $L …)` decl),
+ *   - the constant is +0 / +0.0 (a `-0.0` f64 set is *not* redundant — locals
+ *     default to +0.0, which differs in bits from -0.0).
+ */
+export function dropDeadZeroInit(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+
+  const seen = new Set()           // params + locals referenced by an earlier stmt
+  const reads = new Set()          // locals read by `local.get` anywhere
+  for (const c of fn) if (Array.isArray(c) && c[0] === 'param' && typeof c[1] === 'string') seen.add(c[1])
+
+  const collectGets = (node) => {
+    if (!Array.isArray(node)) return
+    if (node[0] === 'local.get' && typeof node[1] === 'string') reads.add(node[1])
+    for (let i = 1; i < node.length; i++) collectGets(node[i])
+  }
+  for (let i = bodyStart; i < fn.length; i++) collectGets(fn[i])
+
+  const collectRefs = (node) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if ((op === 'local.get' || op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string') seen.add(node[1])
+    for (let i = 1; i < node.length; i++) collectRefs(node[i])
+  }
+  const isPlusZeroConst = (e) => {
+    if (!Array.isArray(e) || e.length !== 2) return false
+    if (e[0] !== 'i32.const' && e[0] !== 'i64.const' && e[0] !== 'f64.const' && e[0] !== 'f32.const') return false
+    const v = e[1]
+    if (typeof v === 'bigint') return v === 0n
+    if (typeof v === 'number') return v === 0 && !Object.is(v, -0)
+    if (typeof v === 'string') { const t = v.trim(); return t === '0' || t === '0.0' || t === '+0' || t === '+0.0' }
+    return false
+  }
+
+  const drop = []
+  for (let i = bodyStart; i < fn.length; i++) {
+    const node = fn[i]
+    if (!Array.isArray(node)) continue
+    if (node[0] === 'local.set' && node.length === 3 && typeof node[1] === 'string' &&
+        !seen.has(node[1]) && reads.has(node[1]) && isPlusZeroConst(node[2])) {
+      drop.push(i)
+      seen.add(node[1])
+      continue
+    }
+    collectRefs(node)
+  }
+  for (let i = drop.length - 1; i >= 0; i--) fn.splice(drop[i], 1)
+}
+
 /**
  * Dead-store elimination: remove `local.set` / `local.tee` and `drop` of pure
  * expressions whose values are never consumed.
@@ -1206,7 +1298,14 @@ export function deadStoreElim(fn) {
       // Local write tracking
       if ((op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string') {
         const prev = lastWrite.get(node[1])
-        if (prev) dead.push(prev)
+        if (prev) {
+          // The store-to-local is dead, but a `local.set` is only *removable*
+          // if its RHS is pure — `local.set $x (call f …)` where `f` mutates
+          // memory must still run. (A `local.tee` is always safe: removal demotes
+          // it to its value expression, so any side effects there are preserved.)
+          const pn = prev.parent[prev.idx]
+          if (pn[0] === 'local.tee' || isPure(pn[2])) dead.push(prev)
+        }
         lastWrite.set(node[1], { parent: items, idx: i })
       }
 
@@ -1472,7 +1571,8 @@ export function specializeMkptr(funcs, addFunc, parseWat) {
   // Any target not listed here is left untouched. Order matters only for readability.
   const SPECS = {
     '$__mkptr':     { params: ['i32', 'i32', 'i32'], result: 'f64', inline: true },
-    '$__alloc_hdr': { params: ['i32', 'i32', 'i32'], result: 'i32' },
+    '$__alloc_hdr':   { params: ['i32', 'i32'],        result: 'i32' },
+    '$__alloc_hdr_n': { params: ['i32', 'i32', 'i32'], result: 'i32' },
     '$__typed_idx': { params: ['i64', 'i32'],        result: 'f64' },
     '$__str_idx':   { params: ['i64', 'i32'],        result: 'f64' },
   }
@@ -1782,6 +1882,7 @@ export function optimizeFunc(fn, cfg, globalTypes) {
       cfg.hoistInvariantCellLoads === false &&
       cfg.cseScalarLoad === false &&
       cfg.csePureExpr === false &&
+      cfg.dropDeadZeroInit === false &&
       cfg.deadStoreElim === false &&
       cfg.promoteGlobals === false &&
       cfg.sortLocalsByUse === false &&
@@ -1795,12 +1896,17 @@ export function optimizeFunc(fn, cfg, globalTypes) {
   if (!cfg || cfg.hoistInvariantCellLoads !== false) hoistInvariantCellLoads(fn)
   if (!cfg || cfg.cseScalarLoad !== false) cseScalarLoad(fn)
   if (!cfg || cfg.csePureExpr !== false) csePureExpr(fn)
+  if (!cfg || cfg.dropDeadZeroInit !== false) dropDeadZeroInit(fn)
   if (!cfg || cfg.deadStoreElim !== false) deadStoreElim(fn)
   if (!cfg || cfg.promoteGlobals !== false) promoteGlobals(fn, globalTypes)
-  // Vectorizer runs in POST-watr when watr is enabled, or in PRE when watr is
-  // disabled (there is no post pass then). This keeps single-pass semantics.
+  // Vectorizer runs PRE-watr unless full watr is enabled (`watr: true`). For full watr,
+  // defer to post — full passes (notably `inlineOnce` + the post-inline `propagate`
+  // sweep) reshape the IR so much that pre-watr SIMD patterns get scrambled. Light
+  // watr (or no watr) leaves the lane locals intact for vectorize to pattern-match,
+  // and lets a non-trivial chunk of SIMD survive the propagate+fold pipeline.
   if (cfg && cfg.vectorizeLaneLocal === true) {
-    const runVectorizer = cfg.__phase === 'post' || (cfg.__phase !== 'post' && cfg.watr === false)
+    const fullWatr = cfg.watr === true
+    const runVectorizer = (fullWatr && cfg.__phase === 'post') || (!fullWatr && cfg.__phase !== 'post')
     if (runVectorizer) vectorizeLaneLocal(fn)
   }
   if (!cfg || cfg.sortLocalsByUse !== false) sortLocalsByUse(fn, cfg && cfg.fusedRewrite !== false ? counts : null)
@@ -1925,6 +2031,30 @@ function walkRewrite(node, doInline, counts) {
         for (let i = 1; i < inner.length; i++) out.push(inner[i])
         return out
       }
+      // (i32.wrap_i64 (i64.reinterpret_f64 (call $__mkptr* … offset))) → offset.
+      // A NaN-boxed pointer keeps type/aux in the high bits and the i32 offset in
+      // the low 32, so the round-trip through f64 is pure overhead whenever the
+      // consumer only wants the offset (typical when the pointer feeds an unboxed
+      // i32 local). Covers the generic 3-arg `$__mkptr` and the specialized
+      // single-arg `$__mkptr_T_A_d` trampolines alike — offset is the last arg.
+      const isMkptr = n => Array.isArray(n) && n[0] === 'call' && typeof n[1] === 'string'
+        && (n[1] === '$__mkptr' || n[1].startsWith('$__mkptr_'))
+      if (isMkptr(inner)) return inner[inner.length - 1]
+      // …and reach through a `(block (result f64) …stmts (call $__mkptr …))` —
+      // `new TypedArray(n)` lowers to exactly this shape — by retyping the block
+      // to i32 and dropping the box on its tail.
+      if (Array.isArray(inner) && inner[0] === 'block' && isMkptr(inner[inner.length - 1])) {
+        let ri = -1
+        for (let i = 1; i <= 2 && i < inner.length; i++)
+          if (Array.isArray(inner[i]) && inner[i][0] === 'result') { ri = i; break }
+        if (ri >= 0 && inner[ri][1] === 'f64') {
+          const tail = inner[inner.length - 1]
+          const nb = inner.slice()
+          nb[ri] = ['result', 'i32']
+          nb[nb.length - 1] = tail[tail.length - 1]
+          return nb
+        }
+      }
     }
     if (Array.isArray(a) && a[0] === 'i64.or' && a.length === 3) {
       const l = a[1], r = a[2]
@@ -2081,6 +2211,36 @@ export function treeshake(funcSections, allModuleNodes, opts) {
       }
     }
   }
+
+  // Dead-global elimination: after dead funcs are gone, drop `(global $g …)` decls
+  // that nothing references (a `global.get`/`global.set` in a remaining func, a kept
+  // global's init expr, a data/elem offset, or an `(export … (global $g))`). Imported
+  // globals live in `allModuleNodes`, not in `opts.globals`, so they're never touched.
+  // Fixpoint: a kept global's init may reference another global.
+  const globals = removeDead && opts && Array.isArray(opts.globals) ? opts.globals : null
+  if (globals) {
+    const collectGlobalRefs = (node, refd) => {
+      if (!Array.isArray(node)) return
+      if ((node[0] === 'global.get' || node[0] === 'global.set') && typeof node[1] === 'string') refd.add(node[1])
+      else if (node[0] === 'export' && Array.isArray(node[2]) && node[2][0] === 'global' && typeof node[2][1] === 'string') refd.add(node[2][1])
+      for (const c of node) collectGlobalRefs(c, refd)
+    }
+    let changed = true
+    while (changed) {
+      changed = false
+      const refd = new Set()
+      for (const { arr } of funcSections) for (const n of arr) collectGlobalRefs(n, refd)
+      for (const n of allModuleNodes) collectGlobalRefs(n, refd)
+      for (const g of globals) collectGlobalRefs(g, refd)
+      for (let i = globals.length - 1; i >= 0; i--) {
+        const g = globals[i]
+        if (Array.isArray(g) && g[0] === 'global' && typeof g[1] === 'string' && !refd.has(g[1])) {
+          globals.splice(i, 1); changed = true
+        }
+      }
+    }
+  }
+
   return { removed, callCount }
 }
 
@@ -2146,7 +2306,7 @@ export function sortLocalsByUse(fn, precomputedCounts) {
  */
 export function arenaRewindModule(fns) {
   const BUILTIN_SAFE = new Set([
-    '$__alloc', '$__alloc_hdr', '$__mkptr',
+    '$__alloc', '$__alloc_hdr', '$__alloc_hdr_n', '$__mkptr',
     '$__ptr_offset', '$__ptr_type', '$__ptr_aux',
     '$__len', '$__cap', '$__typed_shift', '$__typed_data',
   ])
@@ -2179,7 +2339,7 @@ export function arenaRewindModule(fns) {
       else if (op === 'call_ref') hasCallRef = true
       else if (op === 'call') {
         const callee = node[1]
-        if (callee === '$__alloc' || callee === '$__alloc_hdr') hasAlloc = true
+        if (callee === '$__alloc' || callee === '$__alloc_hdr' || callee === '$__alloc_hdr_n') hasAlloc = true
         if (typeof callee === 'string' && !BUILTIN_SAFE.has(callee)) calls.add(callee)
       }
       for (let i = 1; i < node.length; i++) scan(node[i])

package/src/plan.js

@@ -935,7 +935,12 @@ const inlineInStmt = (stmt, candidates) => {
   }
   if (op === '{}') {
     const r = inlineInStmt(stmt[1], candidates)
-    return r.changed ? { node: ['{}', r.node], changed: true } : { node: stmt, changed: false }
+    if (!r.changed) return { node: stmt, changed: false }
+    // If the child was itself a candidate call (or a let/assign-of-call), it
+    // already returned a `['{}', [';', ...prefix]]` shape. Re-wrapping here
+    // would yield `['{}', ['{}', …]]`, which codegen rejects ("Unknown op: {}").
+    if (Array.isArray(r.node) && r.node[0] === '{}') return { node: r.node, changed: true }
+    return { node: ['{}', r.node], changed: true }
   }
   if (op === 'for') {
     const r = inlineInStmt(stmt[4], candidates)
@@ -1433,6 +1438,10 @@ export default function plan(ast) {
   unboxConstTypedGlobals()
 
   let programFacts = collectProgramFacts(ast)
+  // The call-inlining family (`inlineHotInternalCalls` self-gates on `sourceInline`)
+  // is a pure speed optimization — the un-inlined calls emit correctly. Scalar
+  // replacement (`scalarize*`) is *not* gated on `sourceInline`: callers turn it on
+  // independently via `optimize: { sourceInline: false }` to test heap elision alone.
   if (inlineHotInternalCalls(programFacts, ast)) programFacts = collectProgramFacts(ast)
   if (inlineLocalLambdas()) programFacts = collectProgramFacts(ast)
   if (specializeFixedRestCalls(programFacts)) programFacts = collectProgramFacts(ast)

package/src/prepare.js

@@ -26,6 +26,7 @@ import { parse } from 'subscript/feature/jessie'
 import { ctx, err, derive } from './ctx.js'
 import { T, STMT_OPS, VAL, valTypeOf, typedElemCtor, extractParams, collectParamNames, classifyParam, observeNodeFacts, staticPropertyKey } from './analyze.js'
 import { isFuncRef } from './ir.js'
+import { fuseSparseMapReads } from './fuse.js'
 import {
   CTORS, TIMER_NAMES,
   hasModule, includeModule,
@@ -184,7 +185,7 @@ export default function prepare(node) {
   funcLocalNames = [new Set()]
   includeModule('core')
   normalizeIdents(node)
-  fuseSparseMapReads(node)
+  fuseSparseMapReads(node)  // AST-level fusion; needs pre-resolution shape — see src/fuse.js
   const ast = prep(node)
   // Top-level functions referenced as first-class values (e.g. `let o = { fn: g }`,
   // `arr.push(g)`, `return g`) need trampoline emission, which depends on the fn
@@ -340,154 +341,6 @@ const cloneNode = (node) => {
   return copy
 }
 
-/** Sparse-read .map fusion: rewrite `const b = a.map(arrow); for(...; j<b.length; ...) USE(b[j])`
- *  into a fused for-loop that inlines `arrow(a[j])` at the read site, eliminating the materialized
- *  intermediate array. Pre-prep AST mutation; only fires on shapes where every use of `b` is a
- *  numeric `b[idx]` read or a `b.length` read, the arrow is pure with a single named param, and
- *  `b` is not referenced after the consumer for-loop. Preserves observable behavior because the
- *  arrow's pure-expression body has no order-dependent effects. */
-function fuseSparseMapReads(root) {
-  walkSparse(root)
-}
-function walkSparse(node) {
-  if (!Array.isArray(node)) return
-  for (let i = 1; i < node.length; i++) walkSparse(node[i])
-  if (node[0] === ';') tryFuseInBlock(node)
-}
-function tryFuseInBlock(seq) {
-  for (let i = 1; i < seq.length - 1; i++) {
-    const fused = tryFusePair(seq[i], seq[i + 1], seq, i)
-    if (fused) {
-      seq.splice(i, 2, ...fused)
-      i--  // re-examine same position (chained fusions)
-    }
-  }
-}
-function tryFusePair(decl, forNode, seq, declIdx) {
-  if (!Array.isArray(decl) || (decl[0] !== 'const' && decl[0] !== 'let')) return null
-  if (decl.length !== 2) return null  // single binding only
-  const bind = decl[1]
-  if (!Array.isArray(bind) || bind[0] !== '=' || typeof bind[1] !== 'string') return null
-  const NAME = bind[1], rhs = bind[2]
-  if (!Array.isArray(rhs) || rhs[0] !== '()') return null
-  const callee = rhs[1]
-  if (!Array.isArray(callee) || callee[0] !== '.' || callee[2] !== 'map') return null
-  const RECV = callee[1]
-  if (typeof RECV !== 'string' || RECV === NAME) return null
-  const arrow = rhs[2]
-  if (!Array.isArray(arrow) || arrow[0] !== '=>') return null
-  // Single-name param only: `x => …` or `(x) => …`
-  const ap = arrow[1]
-  const PARAM = typeof ap === 'string' ? ap :
-    (Array.isArray(ap) && ap[0] === '()' && typeof ap[1] === 'string' ? ap[1] : null)
-  if (!PARAM || PARAM === NAME || PARAM === RECV) return null
-  // Body: single-expression arrow only (block bodies skipped — could extend later).
-  const aBody = arrow[2]
-  if (Array.isArray(aBody) && aBody[0] === '{}') return null
-  if (!isPureSparseArrowBody(aBody, PARAM)) return null
-  // For-loop: ['for', [';', initStmt, cond, inc], body]
-  if (!Array.isArray(forNode) || forNode[0] !== 'for' || forNode.length !== 3) return null
-  const head = forNode[1]
-  if (!Array.isArray(head) || head[0] !== ';' || head.length !== 4) return null
-  const cond = head[2], forBody = forNode[2]
-  // Verify `NAME` is used only as `NAME[idx]` or `NAME.length` inside cond+forBody.
-  if (!hasOnlySparseUses(cond, NAME)) return null
-  if (!hasOnlySparseUses(forBody, NAME)) return null
-  if (!hasAnyIndexedRead(forBody, NAME) && !hasAnyIndexedRead(cond, NAME)) return null
-  // `NAME` must not be read after the for-loop in the same block.
-  for (let k = declIdx + 2; k < seq.length; k++) {
-    if (refsName(seq[k], NAME)) return null
-  }
-  // RECV must not be reassigned inside the for-loop (would invalidate substitution).
-  if (assignsName(forNode, RECV) || assignsName(forNode, NAME)) return null
-  // PARAM must not collide with any binding inside forBody (otherwise substitution shadows wrongly).
-  if (bindsName(forNode, PARAM)) return null
-  // Apply substitution: NAME.length → RECV.length; NAME[idx] → arrowBody[PARAM ← RECV[idx]].
-  const newCond = substSparse(cond, NAME, RECV, PARAM, aBody)
-  const newBody = substSparse(forBody, NAME, RECV, PARAM, aBody)
-  const newHead = [';', head[1], newCond, head[3]]
-  return [['for', newHead, newBody]]
-}
-function isPureSparseArrowBody(n, PARAM) {
-  if (typeof n === 'string') return true
-  if (!Array.isArray(n)) return true
-  const op = n[0]
-  // Calls / new / assignments / increments are unsafe for repeated-substitution semantics.
-  if (op === '()' || op === '?.()' || op === 'new' || op === '++' || op === '--') return false
-  if (op === '=>') return false  // nested closure is opaque
-  if (typeof op === 'string' && op !== '=>' && op !== '===' && op !== '!==' && op !== '==' && op !== '!=' && op !== '<=' && op !== '>=' && op.endsWith('=') && op !== '=') return false
-  if (op === '=') return false
-  for (let i = 1; i < n.length; i++) if (!isPureSparseArrowBody(n[i], PARAM)) return false
-  return true
-}
-function hasOnlySparseUses(n, NAME) {
-  if (typeof n === 'string') return n !== NAME
-  if (!Array.isArray(n)) return true
-  const op = n[0]
-  if (op === '[]' && n.length === 3 && n[1] === NAME) return hasOnlySparseUses(n[2], NAME)  // NAME[idx] — idx must not reference NAME
-  if (op === '.' && n[1] === NAME) {
-    if (n[2] === 'length') return true
-    return false  // any other property access on NAME is opaque
-  }
-  for (let i = 1; i < n.length; i++) if (!hasOnlySparseUses(n[i], NAME)) return false
-  return true
-}
-function hasAnyIndexedRead(n, NAME) {
-  if (!Array.isArray(n)) return false
-  if (n[0] === '[]' && n.length === 3 && n[1] === NAME) return true
-  for (let i = 1; i < n.length; i++) if (hasAnyIndexedRead(n[i], NAME)) return true
-  return false
-}
-function refsName(n, NAME) {
-  if (typeof n === 'string') return n === NAME
-  if (!Array.isArray(n)) return false
-  for (let i = 1; i < n.length; i++) if (refsName(n[i], NAME)) return true
-  return false
-}
-function assignsName(n, NAME) {
-  if (!Array.isArray(n)) return false
-  const op = n[0]
-  if ((op === '=' || op === '++' || op === '--' ||
-       (typeof op === 'string' && op.endsWith('=') && op !== '==' && op !== '===' && op !== '!=' && op !== '!==' && op !== '<=' && op !== '>='))
-      && n[1] === NAME) return true
-  for (let i = 1; i < n.length; i++) if (assignsName(n[i], NAME)) return true
-  return false
-}
-function bindsName(n, NAME) {
-  if (!Array.isArray(n)) return false
-  const op = n[0]
-  if ((op === 'let' || op === 'const')) {
-    for (let i = 1; i < n.length; i++) {
-      const bind = n[i]
-      if (Array.isArray(bind) && bind[0] === '=' && bind[1] === NAME) return true
-    }
-  }
-  if (op === '=>') {
-    const p = n[1]
-    if (p === NAME) return true
-    if (Array.isArray(p)) {
-      if (p[0] === '()' && p[1] === NAME) return true
-      // skip deeper destructuring forms — conservative
-    }
-  }
-  for (let i = 1; i < n.length; i++) if (bindsName(n[i], NAME)) return true
-  return false
-}
-function substSparse(n, NAME, RECV, PARAM, arrowBody) {
-  if (typeof n !== 'object' || n === null || !Array.isArray(n)) return n
-  if (n[0] === '.' && n[1] === NAME && n[2] === 'length') return ['.', RECV, 'length']
-  if (n[0] === '[]' && n.length === 3 && n[1] === NAME) {
-    const idx = substSparse(n[2], NAME, RECV, PARAM, arrowBody)
-    return cloneAndBind(arrowBody, PARAM, ['[]', RECV, idx])
-  }
-  return n.map((c, i) => i === 0 ? c : substSparse(c, NAME, RECV, PARAM, arrowBody))
-}
-function cloneAndBind(node, PARAM, replacement) {
-  if (node === PARAM) return replacement
-  if (!Array.isArray(node)) return node
-  return node.map((c, i) => i === 0 ? c : cloneAndBind(c, PARAM, replacement))
-}
-
 function prep(node) {
   if (Array.isArray(node)) includeForOp(node[0])
   if (Array.isArray(node) && node.loc != null) ctx.error.loc = node.loc