jz 0.3.1 → 0.5.0

package/src/optimize.js

@@ -27,7 +27,7 @@
  * @module optimize
  */
 
-import { LAYOUT } from './ctx.js'
+import { LAYOUT, ctx } from './ctx.js'
 import { findBodyStart } from './ir.js'
 import { vectorizeLaneLocal } from './vectorize.js'
 
@@ -45,17 +45,19 @@ const UNDEF_BITS = '0x' + (LAYOUT.NAN_PREFIX_BITS | (2n << BigInt(LAYOUT.AUX_SHI
  *   0 — nothing. Fastest compile, largest output. Useful for live coding.
  *   1 — encoding-compactness only (treeshake + sortLocalsByUse + fusedRewrite-inline).
  *       Cheap, no IR rewrites that perturb V8's tier-up shape.
- *   2 — default. Stable jz passes (every pass with benchmark proof). watr disabled
- *       by default — adds ~2s compile time for identical runtime performance.
- *   3 — aggressive experimental passes in addition to level 2.
+ *   2 — default. All stable jz passes + full watr (treeshake / dedupe / dedupTypes /
+ *       coalesce / propagate / packData / fold / peephole / vacuum / mergeBlocks /
+ *       brif / loopify / inlineOnce / …). `inline` stays off (watr's own default —
+ *       opt-in only; can duplicate bodies).
+ *   3 — level 2 + larger array/hash initial caps + `hoistConstantPool` off
+ *       (inline `f64.const` over mutable globals); trades size for speed.
  *
  * String aliases (the size↔speed tradeoff lives entirely in the unroll/scalar
- * knobs, so the aliases just dial those):
- *   'size'     — level 2 with loop/const unroll + lane vectorization off and tight
- *                scalar-replacement caps. Smallest wasm; still fully optimized.
+ * knobs; watr is on for all three):
+ *   'size'     — loop/const unroll + lane vectorization off, tight scalar-replacement
+ *                caps. Smallest wasm.
  *   'balanced' — the default (= level 2).
- *   'speed'    — level 2 with full nested unroll + lane vectorization on (= level 3
- *                minus the heavy third-party watr pass).
+ *   'speed'    — full nested unroll + lane vectorization (= level 3).
  */
 export const PASS_NAMES = [
   'watr',                     // third-party WAT-level CSE/DCE/inlining (heaviest)
@@ -67,6 +69,7 @@ export const PASS_NAMES = [
   'hoistInvariantCellLoads',
   'cseScalarLoad',
   'csePureExpr',
+  'dropDeadZeroInit',
   'deadStoreElim',
   'promoteGlobals',          // read-only global.get → local for multi-read globals
   'sortLocalsByUse',
@@ -80,6 +83,7 @@ export const PASS_NAMES = [
   'vectorizeLaneLocal',       // SIMD-128 lift for lane-pure typed-array loops
   'arenaRewind',              // per-call heap rewind for no-arg scalar allocator kernels
   'treeshake',
+  'jsstring',                 // boundary opt-in: flip exported string params to externref
 ]
 
 const ALL_ON = Object.freeze(Object.fromEntries(PASS_NAMES.map(n => [n, true])))
@@ -87,16 +91,36 @@ const ALL_OFF = Object.freeze(Object.fromEntries(PASS_NAMES.map(n => [n, false])
 const LEVEL_PRESETS = Object.freeze({
   0: ALL_OFF,
   1: Object.freeze({ ...ALL_OFF, treeshake: true, sortLocalsByUse: true, fusedRewrite: true }),
-  2: Object.freeze({ ...ALL_ON, watr: false, nestedSmallConstForUnroll: 'auto' }),
-  3: ALL_ON,
-  // Named aliases — dial the size↔speed knobs on top of the level-2 base.
-  balanced: Object.freeze({ ...ALL_ON, watr: false, nestedSmallConstForUnroll: 'auto' }),
+  // Default (level 2 / 'balanced'): every stable pass + full watr. Pre-4.6.9 had to
+  // force 'light' mode here (inline / inlineOnce / coalesce all off) to dodge the
+  // W1a/W1b miscompiles; watr 4.6.9 fixes both, and the L2 default now runs the full
+  // watr pipeline. `inline` stays off by watr's own default — opt-in only.
+  2: Object.freeze({ ...ALL_ON, nestedSmallConstForUnroll: 'auto' }),
+  // L3/'speed' trades a bit of heap headroom for fewer __arr_grow / __hash growth
+  // cycles. arrayMinCap=16 means `[]` and `new Array()` skip the first two doublings
+  // (0→2→4→8→16); hashSmallInitCap=8 keeps per-object __dyn_props at the same load
+  // factor as the global __hash_new on first set, avoiding the 2→4→8 grow chain.
+  // Net cost: ~128 B per empty array, ~144 B per per-object hash. Net win on the
+  // watr.compile profile: __arr_grow ~6.7% → ~3%, and lower __ihash_get_local
+  // probe depth from a denser-load global hash.
+  // L3/'speed' also turns hoistConstantPool OFF: pooling repeated `f64.const`
+  // into `(mut f64)` globals is a pure size win (~7 B/reuse) but a speed loss —
+  // a mutable global can't be constant-folded by V8 (any call may mutate it), so
+  // every use becomes a load, and promoteGlobals then snapshots the pool into
+  // `_pg` locals at each hot function's entry (register pressure in the big
+  // closures). Inline `f64.const` is the minimal lowering: V8 CSEs identical
+  // constants for free. Measured −3% on jessie parse for +14% binary — exactly
+  // the size↔speed trade 'speed' exists to make.
+  3: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8 }),
+  // 'balanced' = level 2; 'size' tightens scalar/unroll caps; 'speed' = level 3.
+  balanced: Object.freeze({ ...ALL_ON, nestedSmallConstForUnroll: 'auto' }),
   size: Object.freeze({
-    ...ALL_ON, watr: false,
+    ...ALL_ON,
     smallConstForUnroll: false, nestedSmallConstForUnroll: false, vectorizeLaneLocal: false,
     scalarTypedLoopUnroll: 4, scalarTypedNestedUnroll: 8, scalarTypedArrayLen: 8,
   }),
-  speed: Object.freeze({ ...ALL_ON, watr: false }),
+  // 'speed' === level 3: full watr (inlining on) + L3 cap/hash tuning, pool off.
+  speed: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8 }),
 })
 
 /**
@@ -118,7 +142,14 @@ export function resolveOptimize(opt) {
     const baseLevel = typeof opt.level === 'number' || typeof opt.level === 'string' ? opt.level : 2
     const base = LEVEL_PRESETS[baseLevel] || ALL_ON
     const out = { ...base }
-    for (const n of PASS_NAMES) if (n in opt) out[n] = n === 'nestedSmallConstForUnroll' && opt[n] === 'auto' ? 'auto' : !!opt[n]
+    for (const n of PASS_NAMES) {
+      if (!(n in opt)) continue
+      const v = opt[n]
+      // Preserve sentinel value `nestedSmallConstForUnroll: 'auto'`
+      // (resolved by a heuristic at emit time).
+      if (n === 'nestedSmallConstForUnroll' && v === 'auto') out[n] = 'auto'
+      else out[n] = !!v
+    }
     // Preserve non-pass tuning keys (e.g. plan.js thresholds)
     for (const k of Object.keys(opt)) if (!PASS_NAMES.includes(k)) out[k] = opt[k]
     return out
@@ -841,44 +872,33 @@ export function hoistInvariantCellLoads(fn) {
  * — emits 6 f64.load on $p (each of x/y/z twice); collapses to 3 unique loads
  * shared via tee'd snap locals.
  *
- * Safety: jz's invariant — distinct unboxed-pointer locals come from distinct
- * fresh allocations (analyzePtrUnboxable refuses to unbox aliased locals).
- * So `(f64.store ADDR ...)` with base `(local.get $Y)` for $Y ≠ $X cannot
- * touch addresses reachable via `$X + K`. Stores to typed-array slots in the
- * loop body don't invalidate row-pointer reads.
+ * Safety: candidacy is the emit-side `cseSafeLoadBases` whitelist (src/analyze.js),
+ * stamped onto the func node as `fn.cseLoadBases`. Every base in it is a
+ * bound-once unboxed pointer used solely as a member-read receiver whose
+ * allocation kind is disjoint from every store the function performs. So
+ * `(f64.store ADDR ...)` anywhere in the body cannot touch addresses reachable
+ * via `$X + K` for a whitelisted $X — the proof is carried from emit, where the
+ * VAL kinds and binding shapes are still known, never re-guessed at WAT level.
  *
  * Region boundaries that flush the table:
  *   - branch (br/br_if/br_table/return/unreachable)
  *   - non-pure call
  *   - loop / if  (control flow)
  *   - local.set/local.tee on a tracked $X (invalidates that X's entries)
- *   - store whose address tree references a tracked $X
+ *   - store whose address tree references a tracked $X (defence-in-depth —
+ *     the whitelist already guarantees this never happens)
  * Blocks are treated as transparent — recurse into children.
  */
 export function cseScalarLoad(fn) {
-  // DISABLED: the safety claim above relies on `analyzePtrUnboxable` having vetted
-  // every i32 local as a non-aliased fresh-allocation pointer. But this pass scans
-  // *all* i32 locals from `(local … i32)` decls — wasm-native i32 scalars (lengths,
-  // indices), narrow-ABI helper returns, and analyze.js's new arrayElemSchema-driven
-  // unboxes share the same declaration form. The metacircular path (jz-compiled
-  // watr.wasm) trips this: CSE'd loads survive across stores that legitimately
-  // mutate the same memory through a different i32 local, returning stale bytes
-  // (manifests as "memory access out of bounds" once a corrupted offset is
-  // dereferenced). Re-enable once candidacy is restricted to vetted pointers
-  // (e.g. emit-side annotation or rep-derived whitelist).
-  return
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
-  const i32Locals = new Set()
-  for (let i = 2; i < fn.length; i++) {
-    const c = fn[i]
-    if (Array.isArray(c) && (c[0] === 'local' || c[0] === 'param') && typeof c[1] === 'string' && c[2] === 'i32') {
-      i32Locals.add(c[1])
-    }
-  }
-  if (!i32Locals.size) return
+  // Soundness gate: only the emit-proven non-aliasing bases. Absent the stamp
+  // (e.g. a post-watrOptimize re-run on rebuilt nodes) the set is empty and the
+  // pass is a strict no-op — never a speculative CSE.
+  const bases = fn.cseLoadBases
+  if (!(bases instanceof Set) || bases.size === 0) return
 
   let snapId = 0
   while (fn.some(n => Array.isArray(n) && n[0] === 'local' && n[1] === `$__cs${snapId}`)) snapId++
@@ -893,10 +913,10 @@ export function cseScalarLoad(fn) {
     }
   }
 
-  // Scan a node's subtree and return the set of i32 locals referenced via local.get.
+  // Scan a node's subtree and return the set of tracked bases referenced via local.get.
   const collectGets = (node, out) => {
     if (!Array.isArray(node)) return
-    if (node[0] === 'local.get' && typeof node[1] === 'string' && i32Locals.has(node[1])) {
+    if (node[0] === 'local.get' && typeof node[1] === 'string' && bases.has(node[1])) {
       out.add(node[1])
       return
     }
@@ -983,7 +1003,7 @@ export function cseScalarLoad(fn) {
     const lp = parseLoad(node)
     if (lp) {
       const addr = node[lp.addrIdx]
-      if (Array.isArray(addr) && addr[0] === 'local.get' && typeof addr[1] === 'string' && i32Locals.has(addr[1])) {
+      if (Array.isArray(addr) && addr[0] === 'local.get' && typeof addr[1] === 'string' && bases.has(addr[1])) {
         const X = addr[1]
         const key = `${X}|${lp.K}`
         const entry = table.get(key)
@@ -1042,8 +1062,16 @@ export function csePureExpr(fn) {
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
+  // High-water mark across ALL surviving `$__pe<N>` locals, not the first gap.
+  // A prior csePureExpr run + watr.coalesce can leave non-contiguous numbering
+  // (e.g. $__pe0,$__pe1,$__pe5,$__pe20 — coalesce removed the merged ones); picking
+  // the first gap (2) then allocating sequentially would collide on $__pe5 / $__pe20.
   let snapId = 0
-  while (fn.some(n => Array.isArray(n) && n[0] === 'local' && n[1] === `$__pe${snapId}`)) snapId++
+  for (const n of fn) {
+    if (!Array.isArray(n) || n[0] !== 'local' || typeof n[1] !== 'string') continue
+    const m = /^\$__pe(\d+)$/.exec(n[1])
+    if (m) { const k = +m[1]; if (k >= snapId) snapId = k + 1 }
+  }
   const newLocals = []
 
   const COMMUTATIVE = new Set(['f64.mul', 'f64.add', 'i32.mul', 'i32.add', 'i32.and', 'i32.or', 'i32.xor', 'i64.mul', 'i64.add', 'i64.and', 'i64.or', 'i64.xor'])
@@ -1148,6 +1176,72 @@ export function csePureExpr(fn) {
   if (newLocals.length) fn.splice(bodyStart, 0, ...newLocals)
 }
 
+/**
+ * Drop redundant zero-initialisation of fresh function-scope locals.
+ *
+ * WASM zero-initialises every local on entry (0 / 0.0 / null). jz lowers source
+ * `let x = 0` to `(local $x …)` + `(local.set $x (<zero const>))` at the top of
+ * the function body — the explicit set is a no-op when nothing has touched `$x`
+ * yet. `wasm-opt -Oz` elides these; do the same so jz's own output is minimal.
+ *
+ * Only removes a `(local.set $L (i32|i64|f64|f32.const 0))` when:
+ *   - `$L` is a non-param local (a param's "default" is the incoming arg, not 0),
+ *   - it is a *top-level* body statement (never descend into block/loop/if — a
+ *     nested zero-set inside a loop genuinely re-initialises across iterations),
+ *   - `$L` has not been referenced by any earlier top-level statement (so the
+ *     local still holds its entry-time zero at this point),
+ *   - `$L` is read (`local.get`) somewhere in the function (otherwise leave the
+ *     store for deadStoreElim and avoid orphaning the `(local $L …)` decl),
+ *   - the constant is +0 / +0.0 (a `-0.0` f64 set is *not* redundant — locals
+ *     default to +0.0, which differs in bits from -0.0).
+ */
+export function dropDeadZeroInit(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+
+  const seen = new Set()           // params + locals referenced by an earlier stmt
+  const reads = new Set()          // locals read by `local.get` anywhere
+  for (const c of fn) if (Array.isArray(c) && c[0] === 'param' && typeof c[1] === 'string') seen.add(c[1])
+
+  const collectGets = (node) => {
+    if (!Array.isArray(node)) return
+    if (node[0] === 'local.get' && typeof node[1] === 'string') reads.add(node[1])
+    for (let i = 1; i < node.length; i++) collectGets(node[i])
+  }
+  for (let i = bodyStart; i < fn.length; i++) collectGets(fn[i])
+
+  const collectRefs = (node) => {
+    if (!Array.isArray(node)) return
+    const op = node[0]
+    if ((op === 'local.get' || op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string') seen.add(node[1])
+    for (let i = 1; i < node.length; i++) collectRefs(node[i])
+  }
+  const isPlusZeroConst = (e) => {
+    if (!Array.isArray(e) || e.length !== 2) return false
+    if (e[0] !== 'i32.const' && e[0] !== 'i64.const' && e[0] !== 'f64.const' && e[0] !== 'f32.const') return false
+    const v = e[1]
+    if (typeof v === 'bigint') return v === 0n
+    if (typeof v === 'number') return v === 0 && !Object.is(v, -0)
+    if (typeof v === 'string') { const t = v.trim(); return t === '0' || t === '0.0' || t === '+0' || t === '+0.0' }
+    return false
+  }
+
+  const drop = []
+  for (let i = bodyStart; i < fn.length; i++) {
+    const node = fn[i]
+    if (!Array.isArray(node)) continue
+    if (node[0] === 'local.set' && node.length === 3 && typeof node[1] === 'string' &&
+        !seen.has(node[1]) && reads.has(node[1]) && isPlusZeroConst(node[2])) {
+      drop.push(i)
+      seen.add(node[1])
+      continue
+    }
+    collectRefs(node)
+  }
+  for (let i = drop.length - 1; i >= 0; i--) fn.splice(drop[i], 1)
+}
+
 /**
  * Dead-store elimination: remove `local.set` / `local.tee` and `drop` of pure
  * expressions whose values are never consumed.
@@ -1192,21 +1286,31 @@ export function deadStoreElim(fn) {
       if (!Array.isArray(node)) continue
       const op = node[0]
 
-      // Reads invalidate pending dead writes
+      // Reads invalidate pending dead writes. For local.tee/local.set, the RHS reads
+      // happen BEFORE the write — so a `local.get $x` inside `(local.tee $x ...)` is a
+      // real read of the OLD $x and must invalidate any pending dead-write of $x.
       const reads = new Set()
       collectGets(node, reads)
-      if (op === 'local.tee') reads.delete(node[1])
       for (const name of reads) lastWrite.delete(name)
 
-      // Drop of pure expr → dead
-      if (op === 'drop' && isPure(node[1])) {
+      // Drop of pure expr → dead. Only `(drop EXPR)`: a bare `(drop)` consumes
+      // an implicit stack value (e.g. a `try_table` catch payload) — removing it
+      // would unbalance the stack.
+      if (op === 'drop' && node.length === 2 && isPure(node[1])) {
         dead.push({ parent: items, idx: i, drop: true })
       }
 
       // Local write tracking
       if ((op === 'local.set' || op === 'local.tee') && typeof node[1] === 'string') {
         const prev = lastWrite.get(node[1])
-        if (prev) dead.push(prev)
+        if (prev) {
+          // The store-to-local is dead, but a `local.set` is only *removable*
+          // if its RHS is pure — `local.set $x (call f …)` where `f` mutates
+          // memory must still run. (A `local.tee` is always safe: removal demotes
+          // it to its value expression, so any side effects there are preserved.)
+          const pn = prev.parent[prev.idx]
+          if (pn[0] === 'local.tee' || isPure(pn[2])) dead.push(prev)
+        }
         lastWrite.set(node[1], { parent: items, idx: i })
       }
 
@@ -1250,6 +1354,36 @@ export function deadStoreElim(fn) {
   }
 }
 
+/**
+ * Module-wide scan for "volatile" globals — those mutated (`global.set`) in any
+ * function other than `$__start`. Globals written only in `$__start` are
+ * init-once: `$__start` runs to completion before any other function, so they
+ * are effectively read-only afterwards and stay promotable.
+ *
+ * promoteGlobals uses this to avoid caching a callee-mutable global into a
+ * function-entry local across a call (which would leave the local stale).
+ *
+ * @param {Array<Array>} funcs - all module function IR nodes
+ * @returns {Set<string>} volatile global names (with leading `$`)
+ */
+export function collectVolatileGlobals(funcs) {
+  const volatile = new Set()
+  const scan = (node) => {
+    if (!Array.isArray(node)) return
+    if (node[0] === 'global.set') {
+      if (typeof node[1] === 'string') volatile.add(node[1])
+      for (let i = 2; i < node.length; i++) scan(node[i])
+      return
+    }
+    for (let i = 1; i < node.length; i++) scan(node[i])
+  }
+  for (const fn of funcs) {
+    if (!Array.isArray(fn) || fn[0] !== 'func' || fn[1] === '$__start') continue
+    for (let i = 2; i < fn.length; i++) scan(fn[i])
+  }
+  return volatile
+}
+
 /**
  * Promote read-only globals to locals within each function.
  *
@@ -1264,17 +1398,26 @@ export function deadStoreElim(fn) {
  * also written (global.set) are left untouched — the promotion would be unsound if
  * the global changes between reads.
  *
+ * A within-function read-only check is NOT sufficient: a callee can mutate the
+ * global between two reads in this function. `volatileGlobals` (globals written
+ * anywhere outside `$__start`) gates that case — a volatile global is not
+ * promoted in any function that makes a call. Init-once globals (written only in
+ * `$__start`) stay promotable everywhere.
+ *
  * @param {Array} fn - Function IR (WAT-as-array)
  * @param {Map<string,string>} [globalTypes] - Optional: global name → wasm type ('i32'|'f64'|'i64'|'funcref')
+ * @param {Set<string>} [volatileGlobals] - Optional: globals mutated outside `$__start` (see collectVolatileGlobals)
  */
-export function promoteGlobals(fn, globalTypes) {
+export function promoteGlobals(fn, globalTypes, volatileGlobals) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
-  // Collect global.get counts and detect any global.set
+  // Collect global.get counts, detect any global.set, and note whether the
+  // function makes a call (a callee may mutate a volatile global between reads).
   const getCounts = new Map()  // globalName → count
   const written = new Set()
+  let hasCall = false
 
   const scan = (node) => {
     if (!Array.isArray(node)) return
@@ -1288,6 +1431,7 @@ export function promoteGlobals(fn, globalTypes) {
       if (node[2]) scan(node[2])
       return
     }
+    if (op === 'call' || op === 'call_indirect') hasCall = true
     for (let i = 1; i < node.length; i++) scan(node[i])
   }
 
@@ -1307,6 +1451,8 @@ export function promoteGlobals(fn, globalTypes) {
   const replacements = new Map()
   for (const [gName, count] of getCounts) {
     if (count < 3 || written.has(gName)) continue
+    // Unsound to cache a callee-mutable global across a call in this function.
+    if (hasCall && volatileGlobals && volatileGlobals.has(gName)) continue
     // Determine type: use provided map, or infer from context
     const type = globalTypes?.get(gName) || inferTypeFromContext(fn, gName, bodyStart)
     if (!type) continue  // can't determine type, skip
@@ -1472,7 +1618,8 @@ export function specializeMkptr(funcs, addFunc, parseWat) {
   // Any target not listed here is left untouched. Order matters only for readability.
   const SPECS = {
     '$__mkptr':     { params: ['i32', 'i32', 'i32'], result: 'f64', inline: true },
-    '$__alloc_hdr': { params: ['i32', 'i32', 'i32'], result: 'i32' },
+    '$__alloc_hdr':   { params: ['i32', 'i32'],        result: 'i32' },
+    '$__alloc_hdr_n': { params: ['i32', 'i32', 'i32'], result: 'i32' },
     '$__typed_idx': { params: ['i64', 'i32'],        result: 'f64' },
     '$__str_idx':   { params: ['i64', 'i32'],        result: 'f64' },
   }
@@ -1772,8 +1919,10 @@ export function sortStrPoolByFreq(funcs, strPoolRef, strDedupMap) {
  *
  * @param fn  func IR node
  * @param cfg optional resolved config from resolveOptimize() — when omitted, all on.
+ * @param globalTypes optional global name → wasm type map (for promoteGlobals)
+ * @param volatileGlobals optional set of callee-mutable globals (see collectVolatileGlobals)
  */
-export function optimizeFunc(fn, cfg, globalTypes) {
+export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals) {
   if (cfg && cfg.hoistPtrType === false &&
       cfg.hoistInvariantPtrOffset === false &&
       cfg.hoistInvariantPtrOffsetLoop === false &&
@@ -1782,6 +1931,7 @@ export function optimizeFunc(fn, cfg, globalTypes) {
       cfg.hoistInvariantCellLoads === false &&
       cfg.cseScalarLoad === false &&
       cfg.csePureExpr === false &&
+      cfg.dropDeadZeroInit === false &&
       cfg.deadStoreElim === false &&
       cfg.promoteGlobals === false &&
       cfg.sortLocalsByUse === false &&
@@ -1795,12 +1945,17 @@ export function optimizeFunc(fn, cfg, globalTypes) {
   if (!cfg || cfg.hoistInvariantCellLoads !== false) hoistInvariantCellLoads(fn)
   if (!cfg || cfg.cseScalarLoad !== false) cseScalarLoad(fn)
   if (!cfg || cfg.csePureExpr !== false) csePureExpr(fn)
+  if (!cfg || cfg.dropDeadZeroInit !== false) dropDeadZeroInit(fn)
   if (!cfg || cfg.deadStoreElim !== false) deadStoreElim(fn)
-  if (!cfg || cfg.promoteGlobals !== false) promoteGlobals(fn, globalTypes)
-  // Vectorizer runs in POST-watr when watr is enabled, or in PRE when watr is
-  // disabled (there is no post pass then). This keeps single-pass semantics.
+  if (!cfg || cfg.promoteGlobals !== false) promoteGlobals(fn, globalTypes, volatileGlobals)
+  // Vectorizer runs PRE-watr unless full watr is enabled (`watr: true`). For full watr,
+  // defer to post — full passes (notably `inlineOnce` + the post-inline `propagate`
+  // sweep) reshape the IR so much that pre-watr SIMD patterns get scrambled. Light
+  // watr (or no watr) leaves the lane locals intact for vectorize to pattern-match,
+  // and lets a non-trivial chunk of SIMD survive the propagate+fold pipeline.
   if (cfg && cfg.vectorizeLaneLocal === true) {
-    const runVectorizer = cfg.__phase === 'post' || (cfg.__phase !== 'post' && cfg.watr === false)
+    const fullWatr = cfg.watr === true
+    const runVectorizer = (fullWatr && cfg.__phase === 'post') || (!fullWatr && cfg.__phase !== 'post')
     if (runVectorizer) vectorizeLaneLocal(fn)
   }
   if (!cfg || cfg.sortLocalsByUse !== false) sortLocalsByUse(fn, cfg && cfg.fusedRewrite !== false ? counts : null)
@@ -1860,11 +2015,18 @@ function walkRewrite(node, doInline, counts) {
       ['i64.eq', node[2], ['i64.const', NULL_BITS]],
       ['i64.eq', node[2], ['i64.const', UNDEF_BITS]]]
     if (fname === '$__is_truthy' && Array.isArray(node[2]) && node[2][0] === 'i64.reinterpret_f64'
-        && Array.isArray(node[2][1]) && node[2][1][0] === 'local.get') {
-      const lget = node[2][1]
-      const bits = node[2]
+        && Array.isArray(node[2][1]) && (node[2][1][0] === 'local.get' || node[2][1][0] === 'local.tee')) {
+      // `local.tee $x SRC` evaluates SRC once, stores to $x, returns the value —
+      // hot for `a || b` lowering (`__is_truthy(local.tee $t …)`). Keep the tee
+      // as the first use (the `if` condition runs before then/else, and f64.eq's
+      // left operand runs first), so $x is set before every `local.get` repeat.
+      const ref = node[2][1]
+      const lname = ref[1]
+      const lget = ['local.get', lname]
+      const first = ref[0] === 'local.tee' ? ref : lget
+      const bits = ['i64.reinterpret_f64', lget]
       return ['if', ['result', 'i32'],
-        ['f64.eq', lget, lget],
+        ['f64.eq', first, lget],
         ['then', ['f64.ne', lget, ['f64.const', 0]]],
         ['else', ['i32.and',
           ['i32.and',
@@ -1902,46 +2064,18 @@ function walkRewrite(node, doInline, counts) {
     if (Array.isArray(a) && a[0] === 'f64.convert_i32_s' && a.length === 2) return ['i64.extend_i32_s', a[1]]
     if (Array.isArray(a) && a[0] === 'f64.convert_i32_u' && a.length === 2) return ['i64.extend_i32_u', a[1]]
   }
-  if (op === 'i64.reinterpret_f64' && node.length === 2) {
-    const a = node[1]
-    if (Array.isArray(a) && a[0] === 'f64.reinterpret_i64' && a.length === 2) return a[1]
-  }
-  if (op === 'f64.reinterpret_i64' && node.length === 2) {
-    const a = node[1]
-    if (Array.isArray(a) && a[0] === 'i64.reinterpret_f64' && a.length === 2) return a[1]
+  // Rep-specific folds (NaN-box layout-aware reinterpret/wrap simplifications under
+  // the nanbox preset). See abi/number/<rep>.js — each rep owns the rules that
+  // depend on its own carrier layout. The universal `i32.wrap_i64 (i64.extend_i32_*)`
+  // fold below stays here because it's pure WASM bit-pattern, ABI-agnostic.
+  if (op === 'i64.reinterpret_f64' || op === 'f64.reinterpret_i64' || op === 'i32.wrap_i64') {
+    const repFold = ctx.abi?.number?.peephole(node)
+    if (repFold != null) return repFold
   }
   if (op === 'i32.wrap_i64' && node.length === 2) {
     const a = node[1]
     if (Array.isArray(a) && (a[0] === 'i64.extend_i32_u' || a[0] === 'i64.extend_i32_s') && a.length === 2)
       return a[1]
-    // (i32.wrap_i64 (i64.reinterpret_f64 (f64.load ADDR ?offset))) → (i32.load ADDR ?offset).
-    // Wasm is little-endian; the low 32 bits of the f64 at ADDR are exactly
-    // i32.load(ADDR). Saves two ops on every NaN-box pointer extraction from
-    // an array slot or struct field.
-    if (Array.isArray(a) && a[0] === 'i64.reinterpret_f64' && a.length === 2) {
-      const inner = a[1]
-      if (Array.isArray(inner) && inner[0] === 'f64.load') {
-        const out = ['i32.load']
-        for (let i = 1; i < inner.length; i++) out.push(inner[i])
-        return out
-      }
-    }
-    if (Array.isArray(a) && a[0] === 'i64.or' && a.length === 3) {
-      const l = a[1], r = a[2]
-      const isHighOnly = (n) => {
-        if (!Array.isArray(n) || n[0] !== 'i64.const') return false
-        const v = n[1]
-        let bi
-        if (typeof v === 'number') bi = BigInt(v)
-        else if (typeof v === 'string') {
-          try { bi = v.startsWith('-') ? -BigInt(v.slice(1)) : BigInt(v) } catch { return false }
-        } else return false
-        return (bi & 0xFFFFFFFFn) === 0n
-      }
-      const isExtend = (n) => Array.isArray(n) && (n[0] === 'i64.extend_i32_u' || n[0] === 'i64.extend_i32_s') && n.length === 2
-      if (isHighOnly(l) && isExtend(r)) return r[1]
-      if (isHighOnly(r) && isExtend(l)) return l[1]
-    }
   }
 
   // shl-distribute-over-add: (i32.shl (i32.add x (i32.const K)) (i32.const S))
@@ -2081,6 +2215,36 @@ export function treeshake(funcSections, allModuleNodes, opts) {
       }
     }
   }
+
+  // Dead-global elimination: after dead funcs are gone, drop `(global $g …)` decls
+  // that nothing references (a `global.get`/`global.set` in a remaining func, a kept
+  // global's init expr, a data/elem offset, or an `(export … (global $g))`). Imported
+  // globals live in `allModuleNodes`, not in `opts.globals`, so they're never touched.
+  // Fixpoint: a kept global's init may reference another global.
+  const globals = removeDead && opts && Array.isArray(opts.globals) ? opts.globals : null
+  if (globals) {
+    const collectGlobalRefs = (node, refd) => {
+      if (!Array.isArray(node)) return
+      if ((node[0] === 'global.get' || node[0] === 'global.set') && typeof node[1] === 'string') refd.add(node[1])
+      else if (node[0] === 'export' && Array.isArray(node[2]) && node[2][0] === 'global' && typeof node[2][1] === 'string') refd.add(node[2][1])
+      for (const c of node) collectGlobalRefs(c, refd)
+    }
+    let changed = true
+    while (changed) {
+      changed = false
+      const refd = new Set()
+      for (const { arr } of funcSections) for (const n of arr) collectGlobalRefs(n, refd)
+      for (const n of allModuleNodes) collectGlobalRefs(n, refd)
+      for (const g of globals) collectGlobalRefs(g, refd)
+      for (let i = globals.length - 1; i >= 0; i--) {
+        const g = globals[i]
+        if (Array.isArray(g) && g[0] === 'global' && typeof g[1] === 'string' && !refd.has(g[1])) {
+          globals.splice(i, 1); changed = true
+        }
+      }
+    }
+  }
+
   return { removed, callCount }
 }
 
@@ -2146,7 +2310,7 @@ export function sortLocalsByUse(fn, precomputedCounts) {
  */
 export function arenaRewindModule(fns) {
   const BUILTIN_SAFE = new Set([
-    '$__alloc', '$__alloc_hdr', '$__mkptr',
+    '$__alloc', '$__alloc_hdr', '$__alloc_hdr_n', '$__mkptr',
     '$__ptr_offset', '$__ptr_type', '$__ptr_aux',
     '$__len', '$__cap', '$__typed_shift', '$__typed_data',
   ])
@@ -2179,7 +2343,7 @@ export function arenaRewindModule(fns) {
       else if (op === 'call_ref') hasCallRef = true
       else if (op === 'call') {
         const callee = node[1]
-        if (callee === '$__alloc' || callee === '$__alloc_hdr') hasAlloc = true
+        if (callee === '$__alloc' || callee === '$__alloc_hdr' || callee === '$__alloc_hdr_n') hasAlloc = true
         if (typeof callee === 'string' && !BUILTIN_SAFE.has(callee)) calls.add(callee)
       }
       for (let i = 1; i < node.length; i++) scan(node[i])