jz 0.4.0 → 0.5.0

package/src/optimize.js

@@ -27,7 +27,7 @@
  * @module optimize
  */
 
-import { LAYOUT } from './ctx.js'
+import { LAYOUT, ctx } from './ctx.js'
 import { findBodyStart } from './ir.js'
 import { vectorizeLaneLocal } from './vectorize.js'
 
@@ -45,12 +45,12 @@ const UNDEF_BITS = '0x' + (LAYOUT.NAN_PREFIX_BITS | (2n << BigInt(LAYOUT.AUX_SHI
  *   0 — nothing. Fastest compile, largest output. Useful for live coding.
  *   1 — encoding-compactness only (treeshake + sortLocalsByUse + fusedRewrite-inline).
  *       Cheap, no IR rewrites that perturb V8's tier-up shape.
- *   2 — default. All stable jz passes + watr in 'light' mode (everything except
- *       `inline` / `inlineOnce`). 'light' delivers most of the size win
- *       (treeshake / dedupe / dedupTypes / coalesce / propagate / packData / fold /
- *       peephole / vacuum / mergeBlocks / brif / loopify / …) at essentially zero
- *       net compile cost — the smaller wasm makes watrCompile downstream faster.
- *   3 — level 2 + full watr (adds inlining) + aggressive experimental tunings.
+ *   2 — default. All stable jz passes + full watr (treeshake / dedupe / dedupTypes /
+ *       coalesce / propagate / packData / fold / peephole / vacuum / mergeBlocks /
+ *       brif / loopify / inlineOnce / …). `inline` stays off (watr's own default —
+ *       opt-in only; can duplicate bodies).
+ *   3 — level 2 + larger array/hash initial caps + `hoistConstantPool` off
+ *       (inline `f64.const` over mutable globals); trades size for speed.
  *
  * String aliases (the size↔speed tradeoff lives entirely in the unroll/scalar
  * knobs; watr is on for all three):
@@ -83,6 +83,7 @@ export const PASS_NAMES = [
   'vectorizeLaneLocal',       // SIMD-128 lift for lane-pure typed-array loops
   'arenaRewind',              // per-call heap rewind for no-arg scalar allocator kernels
   'treeshake',
+  'jsstring',                 // boundary opt-in: flip exported string params to externref
 ]
 
 const ALL_ON = Object.freeze(Object.fromEntries(PASS_NAMES.map(n => [n, true])))
@@ -90,13 +91,11 @@ const ALL_OFF = Object.freeze(Object.fromEntries(PASS_NAMES.map(n => [n, false])
 const LEVEL_PRESETS = Object.freeze({
   0: ALL_OFF,
   1: Object.freeze({ ...ALL_OFF, treeshake: true, sortLocalsByUse: true, fusedRewrite: true }),
-  // Default (level 2 / 'balanced'): every stable pass + watr in 'light' mode.
-  // 'light' = all watr passes except inlining (`inline` / `inlineOnce`). Inlining is
-  // skipped at L2 because it breaks regex-split semantics (watr 4.6.4) and reshapes
-  // codegen tests that assert on pre-inline function structure. The remaining passes
-  // (treeshake/dedupe/dedupTypes/coalesce/propagate/packData/fold/peephole/...) still
-  // deliver most of watr's size win at essentially zero compile cost.
-  2: Object.freeze({ ...ALL_ON, watr: 'light', nestedSmallConstForUnroll: 'auto' }),
+  // Default (level 2 / 'balanced'): every stable pass + full watr. Pre-4.6.9 had to
+  // force 'light' mode here (inline / inlineOnce / coalesce all off) to dodge the
+  // W1a/W1b miscompiles; watr 4.6.9 fixes both, and the L2 default now runs the full
+  // watr pipeline. `inline` stays off by watr's own default — opt-in only.
+  2: Object.freeze({ ...ALL_ON, nestedSmallConstForUnroll: 'auto' }),
   // L3/'speed' trades a bit of heap headroom for fewer __arr_grow / __hash growth
   // cycles. arrayMinCap=16 means `[]` and `new Array()` skip the first two doublings
   // (0→2→4→8→16); hashSmallInitCap=8 keeps per-object __dyn_props at the same load
@@ -104,16 +103,24 @@ const LEVEL_PRESETS = Object.freeze({
   // Net cost: ~128 B per empty array, ~144 B per per-object hash. Net win on the
   // watr.compile profile: __arr_grow ~6.7% → ~3%, and lower __ihash_get_local
   // probe depth from a denser-load global hash.
-  3: Object.freeze({ ...ALL_ON, arrayMinCap: 16, hashSmallInitCap: 8 }),
+  // L3/'speed' also turns hoistConstantPool OFF: pooling repeated `f64.const`
+  // into `(mut f64)` globals is a pure size win (~7 B/reuse) but a speed loss —
+  // a mutable global can't be constant-folded by V8 (any call may mutate it), so
+  // every use becomes a load, and promoteGlobals then snapshots the pool into
+  // `_pg` locals at each hot function's entry (register pressure in the big
+  // closures). Inline `f64.const` is the minimal lowering: V8 CSEs identical
+  // constants for free. Measured −3% on jessie parse for +14% binary — exactly
+  // the size↔speed trade 'speed' exists to make.
+  3: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8 }),
   // 'balanced' = level 2; 'size' tightens scalar/unroll caps; 'speed' = level 3.
-  balanced: Object.freeze({ ...ALL_ON, watr: 'light', nestedSmallConstForUnroll: 'auto' }),
+  balanced: Object.freeze({ ...ALL_ON, nestedSmallConstForUnroll: 'auto' }),
   size: Object.freeze({
     ...ALL_ON,
     smallConstForUnroll: false, nestedSmallConstForUnroll: false, vectorizeLaneLocal: false,
     scalarTypedLoopUnroll: 4, scalarTypedNestedUnroll: 8, scalarTypedArrayLen: 8,
   }),
-  // 'speed' === level 3: full watr (inlining on) + L3 cap/hash tuning.
-  speed: Object.freeze({ ...ALL_ON, arrayMinCap: 16, hashSmallInitCap: 8 }),
+  // 'speed' === level 3: full watr (inlining on) + L3 cap/hash tuning, pool off.
+  speed: Object.freeze({ ...ALL_ON, hoistConstantPool: false, arrayMinCap: 16, hashSmallInitCap: 8 }),
 })
 
 /**
@@ -138,11 +145,9 @@ export function resolveOptimize(opt) {
     for (const n of PASS_NAMES) {
       if (!(n in opt)) continue
       const v = opt[n]
-      // Preserve sentinel values that downstream resolution depends on:
-      //   nestedSmallConstForUnroll: 'auto' (heuristic at emit time)
-      //   watr: 'light' (curated subset — see index.js watrOpts)
+      // Preserve sentinel value `nestedSmallConstForUnroll: 'auto'`
+      // (resolved by a heuristic at emit time).
       if (n === 'nestedSmallConstForUnroll' && v === 'auto') out[n] = 'auto'
-      else if (n === 'watr' && v === 'light') out[n] = 'light'
       else out[n] = !!v
     }
     // Preserve non-pass tuning keys (e.g. plan.js thresholds)
@@ -867,44 +872,33 @@ export function hoistInvariantCellLoads(fn) {
  * — emits 6 f64.load on $p (each of x/y/z twice); collapses to 3 unique loads
  * shared via tee'd snap locals.
  *
- * Safety: jz's invariant — distinct unboxed-pointer locals come from distinct
- * fresh allocations (analyzePtrUnboxable refuses to unbox aliased locals).
- * So `(f64.store ADDR ...)` with base `(local.get $Y)` for $Y ≠ $X cannot
- * touch addresses reachable via `$X + K`. Stores to typed-array slots in the
- * loop body don't invalidate row-pointer reads.
+ * Safety: candidacy is the emit-side `cseSafeLoadBases` whitelist (src/analyze.js),
+ * stamped onto the func node as `fn.cseLoadBases`. Every base in it is a
+ * bound-once unboxed pointer used solely as a member-read receiver whose
+ * allocation kind is disjoint from every store the function performs. So
+ * `(f64.store ADDR ...)` anywhere in the body cannot touch addresses reachable
+ * via `$X + K` for a whitelisted $X — the proof is carried from emit, where the
+ * VAL kinds and binding shapes are still known, never re-guessed at WAT level.
  *
  * Region boundaries that flush the table:
  *   - branch (br/br_if/br_table/return/unreachable)
  *   - non-pure call
  *   - loop / if  (control flow)
  *   - local.set/local.tee on a tracked $X (invalidates that X's entries)
- *   - store whose address tree references a tracked $X
+ *   - store whose address tree references a tracked $X (defence-in-depth —
+ *     the whitelist already guarantees this never happens)
  * Blocks are treated as transparent — recurse into children.
  */
 export function cseScalarLoad(fn) {
-  // DISABLED: the safety claim above relies on `analyzePtrUnboxable` having vetted
-  // every i32 local as a non-aliased fresh-allocation pointer. But this pass scans
-  // *all* i32 locals from `(local … i32)` decls — wasm-native i32 scalars (lengths,
-  // indices), narrow-ABI helper returns, and analyze.js's new arrayElemSchema-driven
-  // unboxes share the same declaration form. The metacircular path (jz-compiled
-  // watr.wasm) trips this: CSE'd loads survive across stores that legitimately
-  // mutate the same memory through a different i32 local, returning stale bytes
-  // (manifests as "memory access out of bounds" once a corrupted offset is
-  // dereferenced). Re-enable once candidacy is restricted to vetted pointers
-  // (e.g. emit-side annotation or rep-derived whitelist).
-  return
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
-  const i32Locals = new Set()
-  for (let i = 2; i < fn.length; i++) {
-    const c = fn[i]
-    if (Array.isArray(c) && (c[0] === 'local' || c[0] === 'param') && typeof c[1] === 'string' && c[2] === 'i32') {
-      i32Locals.add(c[1])
-    }
-  }
-  if (!i32Locals.size) return
+  // Soundness gate: only the emit-proven non-aliasing bases. Absent the stamp
+  // (e.g. a post-watrOptimize re-run on rebuilt nodes) the set is empty and the
+  // pass is a strict no-op — never a speculative CSE.
+  const bases = fn.cseLoadBases
+  if (!(bases instanceof Set) || bases.size === 0) return
 
   let snapId = 0
   while (fn.some(n => Array.isArray(n) && n[0] === 'local' && n[1] === `$__cs${snapId}`)) snapId++
@@ -919,10 +913,10 @@ export function cseScalarLoad(fn) {
     }
   }
 
-  // Scan a node's subtree and return the set of i32 locals referenced via local.get.
+  // Scan a node's subtree and return the set of tracked bases referenced via local.get.
   const collectGets = (node, out) => {
     if (!Array.isArray(node)) return
-    if (node[0] === 'local.get' && typeof node[1] === 'string' && i32Locals.has(node[1])) {
+    if (node[0] === 'local.get' && typeof node[1] === 'string' && bases.has(node[1])) {
       out.add(node[1])
       return
     }
@@ -1009,7 +1003,7 @@ export function cseScalarLoad(fn) {
     const lp = parseLoad(node)
     if (lp) {
       const addr = node[lp.addrIdx]
-      if (Array.isArray(addr) && addr[0] === 'local.get' && typeof addr[1] === 'string' && i32Locals.has(addr[1])) {
+      if (Array.isArray(addr) && addr[0] === 'local.get' && typeof addr[1] === 'string' && bases.has(addr[1])) {
         const X = addr[1]
         const key = `${X}|${lp.K}`
         const entry = table.get(key)
@@ -1068,8 +1062,16 @@ export function csePureExpr(fn) {
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
+  // High-water mark across ALL surviving `$__pe<N>` locals, not the first gap.
+  // A prior csePureExpr run + watr.coalesce can leave non-contiguous numbering
+  // (e.g. $__pe0,$__pe1,$__pe5,$__pe20 — coalesce removed the merged ones); picking
+  // the first gap (2) then allocating sequentially would collide on $__pe5 / $__pe20.
   let snapId = 0
-  while (fn.some(n => Array.isArray(n) && n[0] === 'local' && n[1] === `$__pe${snapId}`)) snapId++
+  for (const n of fn) {
+    if (!Array.isArray(n) || n[0] !== 'local' || typeof n[1] !== 'string') continue
+    const m = /^\$__pe(\d+)$/.exec(n[1])
+    if (m) { const k = +m[1]; if (k >= snapId) snapId = k + 1 }
+  }
   const newLocals = []
 
   const COMMUTATIVE = new Set(['f64.mul', 'f64.add', 'i32.mul', 'i32.add', 'i32.and', 'i32.or', 'i32.xor', 'i64.mul', 'i64.add', 'i64.and', 'i64.or', 'i64.xor'])
@@ -1284,14 +1286,17 @@ export function deadStoreElim(fn) {
       if (!Array.isArray(node)) continue
       const op = node[0]
 
-      // Reads invalidate pending dead writes
+      // Reads invalidate pending dead writes. For local.tee/local.set, the RHS reads
+      // happen BEFORE the write — so a `local.get $x` inside `(local.tee $x ...)` is a
+      // real read of the OLD $x and must invalidate any pending dead-write of $x.
       const reads = new Set()
       collectGets(node, reads)
-      if (op === 'local.tee') reads.delete(node[1])
       for (const name of reads) lastWrite.delete(name)
 
-      // Drop of pure expr → dead
-      if (op === 'drop' && isPure(node[1])) {
+      // Drop of pure expr → dead. Only `(drop EXPR)`: a bare `(drop)` consumes
+      // an implicit stack value (e.g. a `try_table` catch payload) — removing it
+      // would unbalance the stack.
+      if (op === 'drop' && node.length === 2 && isPure(node[1])) {
         dead.push({ parent: items, idx: i, drop: true })
       }
 
@@ -1349,6 +1354,36 @@ export function deadStoreElim(fn) {
   }
 }
 
+/**
+ * Module-wide scan for "volatile" globals — those mutated (`global.set`) in any
+ * function other than `$__start`. Globals written only in `$__start` are
+ * init-once: `$__start` runs to completion before any other function, so they
+ * are effectively read-only afterwards and stay promotable.
+ *
+ * promoteGlobals uses this to avoid caching a callee-mutable global into a
+ * function-entry local across a call (which would leave the local stale).
+ *
+ * @param {Array<Array>} funcs - all module function IR nodes
+ * @returns {Set<string>} volatile global names (with leading `$`)
+ */
+export function collectVolatileGlobals(funcs) {
+  const volatile = new Set()
+  const scan = (node) => {
+    if (!Array.isArray(node)) return
+    if (node[0] === 'global.set') {
+      if (typeof node[1] === 'string') volatile.add(node[1])
+      for (let i = 2; i < node.length; i++) scan(node[i])
+      return
+    }
+    for (let i = 1; i < node.length; i++) scan(node[i])
+  }
+  for (const fn of funcs) {
+    if (!Array.isArray(fn) || fn[0] !== 'func' || fn[1] === '$__start') continue
+    for (let i = 2; i < fn.length; i++) scan(fn[i])
+  }
+  return volatile
+}
+
 /**
  * Promote read-only globals to locals within each function.
  *
@@ -1363,17 +1398,26 @@ export function deadStoreElim(fn) {
  * also written (global.set) are left untouched — the promotion would be unsound if
  * the global changes between reads.
  *
+ * A within-function read-only check is NOT sufficient: a callee can mutate the
+ * global between two reads in this function. `volatileGlobals` (globals written
+ * anywhere outside `$__start`) gates that case — a volatile global is not
+ * promoted in any function that makes a call. Init-once globals (written only in
+ * `$__start`) stay promotable everywhere.
+ *
  * @param {Array} fn - Function IR (WAT-as-array)
  * @param {Map<string,string>} [globalTypes] - Optional: global name → wasm type ('i32'|'f64'|'i64'|'funcref')
+ * @param {Set<string>} [volatileGlobals] - Optional: globals mutated outside `$__start` (see collectVolatileGlobals)
  */
-export function promoteGlobals(fn, globalTypes) {
+export function promoteGlobals(fn, globalTypes, volatileGlobals) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
   if (bodyStart < 0) return
 
-  // Collect global.get counts and detect any global.set
+  // Collect global.get counts, detect any global.set, and note whether the
+  // function makes a call (a callee may mutate a volatile global between reads).
   const getCounts = new Map()  // globalName → count
   const written = new Set()
+  let hasCall = false
 
   const scan = (node) => {
     if (!Array.isArray(node)) return
@@ -1387,6 +1431,7 @@ export function promoteGlobals(fn, globalTypes) {
       if (node[2]) scan(node[2])
       return
     }
+    if (op === 'call' || op === 'call_indirect') hasCall = true
     for (let i = 1; i < node.length; i++) scan(node[i])
   }
 
@@ -1406,6 +1451,8 @@ export function promoteGlobals(fn, globalTypes) {
   const replacements = new Map()
   for (const [gName, count] of getCounts) {
     if (count < 3 || written.has(gName)) continue
+    // Unsound to cache a callee-mutable global across a call in this function.
+    if (hasCall && volatileGlobals && volatileGlobals.has(gName)) continue
     // Determine type: use provided map, or infer from context
     const type = globalTypes?.get(gName) || inferTypeFromContext(fn, gName, bodyStart)
     if (!type) continue  // can't determine type, skip
@@ -1872,8 +1919,10 @@ export function sortStrPoolByFreq(funcs, strPoolRef, strDedupMap) {
  *
  * @param fn  func IR node
  * @param cfg optional resolved config from resolveOptimize() — when omitted, all on.
+ * @param globalTypes optional global name → wasm type map (for promoteGlobals)
+ * @param volatileGlobals optional set of callee-mutable globals (see collectVolatileGlobals)
  */
-export function optimizeFunc(fn, cfg, globalTypes) {
+export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals) {
   if (cfg && cfg.hoistPtrType === false &&
       cfg.hoistInvariantPtrOffset === false &&
       cfg.hoistInvariantPtrOffsetLoop === false &&
@@ -1898,7 +1947,7 @@ export function optimizeFunc(fn, cfg, globalTypes) {
   if (!cfg || cfg.csePureExpr !== false) csePureExpr(fn)
   if (!cfg || cfg.dropDeadZeroInit !== false) dropDeadZeroInit(fn)
   if (!cfg || cfg.deadStoreElim !== false) deadStoreElim(fn)
-  if (!cfg || cfg.promoteGlobals !== false) promoteGlobals(fn, globalTypes)
+  if (!cfg || cfg.promoteGlobals !== false) promoteGlobals(fn, globalTypes, volatileGlobals)
   // Vectorizer runs PRE-watr unless full watr is enabled (`watr: true`). For full watr,
   // defer to post — full passes (notably `inlineOnce` + the post-inline `propagate`
   // sweep) reshape the IR so much that pre-watr SIMD patterns get scrambled. Light
@@ -1966,11 +2015,18 @@ function walkRewrite(node, doInline, counts) {
       ['i64.eq', node[2], ['i64.const', NULL_BITS]],
       ['i64.eq', node[2], ['i64.const', UNDEF_BITS]]]
     if (fname === '$__is_truthy' && Array.isArray(node[2]) && node[2][0] === 'i64.reinterpret_f64'
-        && Array.isArray(node[2][1]) && node[2][1][0] === 'local.get') {
-      const lget = node[2][1]
-      const bits = node[2]
+        && Array.isArray(node[2][1]) && (node[2][1][0] === 'local.get' || node[2][1][0] === 'local.tee')) {
+      // `local.tee $x SRC` evaluates SRC once, stores to $x, returns the value —
+      // hot for `a || b` lowering (`__is_truthy(local.tee $t …)`). Keep the tee
+      // as the first use (the `if` condition runs before then/else, and f64.eq's
+      // left operand runs first), so $x is set before every `local.get` repeat.
+      const ref = node[2][1]
+      const lname = ref[1]
+      const lget = ['local.get', lname]
+      const first = ref[0] === 'local.tee' ? ref : lget
+      const bits = ['i64.reinterpret_f64', lget]
       return ['if', ['result', 'i32'],
-        ['f64.eq', lget, lget],
+        ['f64.eq', first, lget],
         ['then', ['f64.ne', lget, ['f64.const', 0]]],
         ['else', ['i32.and',
           ['i32.and',
@@ -2008,70 +2064,18 @@ function walkRewrite(node, doInline, counts) {
     if (Array.isArray(a) && a[0] === 'f64.convert_i32_s' && a.length === 2) return ['i64.extend_i32_s', a[1]]
     if (Array.isArray(a) && a[0] === 'f64.convert_i32_u' && a.length === 2) return ['i64.extend_i32_u', a[1]]
   }
-  if (op === 'i64.reinterpret_f64' && node.length === 2) {
-    const a = node[1]
-    if (Array.isArray(a) && a[0] === 'f64.reinterpret_i64' && a.length === 2) return a[1]
-  }
-  if (op === 'f64.reinterpret_i64' && node.length === 2) {
-    const a = node[1]
-    if (Array.isArray(a) && a[0] === 'i64.reinterpret_f64' && a.length === 2) return a[1]
+  // Rep-specific folds (NaN-box layout-aware reinterpret/wrap simplifications under
+  // the nanbox preset). See abi/number/<rep>.js — each rep owns the rules that
+  // depend on its own carrier layout. The universal `i32.wrap_i64 (i64.extend_i32_*)`
+  // fold below stays here because it's pure WASM bit-pattern, ABI-agnostic.
+  if (op === 'i64.reinterpret_f64' || op === 'f64.reinterpret_i64' || op === 'i32.wrap_i64') {
+    const repFold = ctx.abi?.number?.peephole(node)
+    if (repFold != null) return repFold
   }
   if (op === 'i32.wrap_i64' && node.length === 2) {
     const a = node[1]
     if (Array.isArray(a) && (a[0] === 'i64.extend_i32_u' || a[0] === 'i64.extend_i32_s') && a.length === 2)
       return a[1]
-    // (i32.wrap_i64 (i64.reinterpret_f64 (f64.load ADDR ?offset))) → (i32.load ADDR ?offset).
-    // Wasm is little-endian; the low 32 bits of the f64 at ADDR are exactly
-    // i32.load(ADDR). Saves two ops on every NaN-box pointer extraction from
-    // an array slot or struct field.
-    if (Array.isArray(a) && a[0] === 'i64.reinterpret_f64' && a.length === 2) {
-      const inner = a[1]
-      if (Array.isArray(inner) && inner[0] === 'f64.load') {
-        const out = ['i32.load']
-        for (let i = 1; i < inner.length; i++) out.push(inner[i])
-        return out
-      }
-      // (i32.wrap_i64 (i64.reinterpret_f64 (call $__mkptr* … offset))) → offset.
-      // A NaN-boxed pointer keeps type/aux in the high bits and the i32 offset in
-      // the low 32, so the round-trip through f64 is pure overhead whenever the
-      // consumer only wants the offset (typical when the pointer feeds an unboxed
-      // i32 local). Covers the generic 3-arg `$__mkptr` and the specialized
-      // single-arg `$__mkptr_T_A_d` trampolines alike — offset is the last arg.
-      const isMkptr = n => Array.isArray(n) && n[0] === 'call' && typeof n[1] === 'string'
-        && (n[1] === '$__mkptr' || n[1].startsWith('$__mkptr_'))
-      if (isMkptr(inner)) return inner[inner.length - 1]
-      // …and reach through a `(block (result f64) …stmts (call $__mkptr …))` —
-      // `new TypedArray(n)` lowers to exactly this shape — by retyping the block
-      // to i32 and dropping the box on its tail.
-      if (Array.isArray(inner) && inner[0] === 'block' && isMkptr(inner[inner.length - 1])) {
-        let ri = -1
-        for (let i = 1; i <= 2 && i < inner.length; i++)
-          if (Array.isArray(inner[i]) && inner[i][0] === 'result') { ri = i; break }
-        if (ri >= 0 && inner[ri][1] === 'f64') {
-          const tail = inner[inner.length - 1]
-          const nb = inner.slice()
-          nb[ri] = ['result', 'i32']
-          nb[nb.length - 1] = tail[tail.length - 1]
-          return nb
-        }
-      }
-    }
-    if (Array.isArray(a) && a[0] === 'i64.or' && a.length === 3) {
-      const l = a[1], r = a[2]
-      const isHighOnly = (n) => {
-        if (!Array.isArray(n) || n[0] !== 'i64.const') return false
-        const v = n[1]
-        let bi
-        if (typeof v === 'number') bi = BigInt(v)
-        else if (typeof v === 'string') {
-          try { bi = v.startsWith('-') ? -BigInt(v.slice(1)) : BigInt(v) } catch { return false }
-        } else return false
-        return (bi & 0xFFFFFFFFn) === 0n
-      }
-      const isExtend = (n) => Array.isArray(n) && (n[0] === 'i64.extend_i32_u' || n[0] === 'i64.extend_i32_s') && n.length === 2
-      if (isHighOnly(l) && isExtend(r)) return r[1]
-      if (isHighOnly(r) && isExtend(l)) return l[1]
-    }
   }
 
   // shl-distribute-over-add: (i32.shl (i32.add x (i32.const K)) (i32.const S))