jz 0.5.1 → 0.7.0

package/src/{assemble.js → wat/assemble.js}

@@ -12,8 +12,8 @@
  * @module assemble
  */
 
-import { parse as parseWat } from 'watr'
-import { ctx, inc, resolveIncludes, err, PTR, LAYOUT } from './ctx.js'
+import parseWat from 'watr/parse'
+import { ctx, inc, resolveIncludes, err, PTR, LAYOUT, HEAP, declGlobal } from '../ctx.js'
 
 // Stdlib WAT templates are fixed text (or feature-keyed text from a factory) —
 // `parseWat` of the same string always yields the same tree. Parsing is the
@@ -33,10 +33,12 @@ const parseTemplate = (str) => {
   if (tmpl === undefined) stdlibParseCache.set(str, tmpl = parseWat(str))
   return cloneTemplate(tmpl)
 }
-import { T, VAL, analyzeValTypes } from './analyze.js'
-import { optimizeFunc, collectVolatileGlobals, hoistConstantPool, specializeMkptr, specializePtrBase, sortStrPoolByFreq, arenaRewindModule } from './optimize.js'
-import { emit } from './emit.js'
-import { mkPtrIR, MAX_CLOSURE_ARITY, MEM_OPS, findBodyStart } from './ir.js'
+import { T } from '../ast.js'
+import { analyzeValTypes, analyzeBody } from '../compile/analyze.js'
+import { VAL } from '../reps.js'
+import { optimizeFunc, collectVolatileGlobals, collectReachableGlobalWrites, hoistGlobalPtrOffset, stablePtrGlobalNames, hoistConstantPool, specializeMkptr, specializePtrBase, sortStrPoolByFreq, arenaRewindModule } from '../optimize/index.js'
+import { emit, emitVoid } from '../compile/emit.js'
+import { mkPtrIR, MAX_CLOSURE_ARITY, MEM_OPS, findBodyStart } from '../ir.js'
 
 // NaN-prefix top-13-bits as BigInt — used by the static-prefix-strip pass
 const NAN_PREFIX = BigInt(LAYOUT.NAN_PREFIX)
@@ -46,16 +48,16 @@ const TAG_SHIFT_BIG = BigInt(LAYOUT.TAG_SHIFT)
 const AUX_SHIFT_BIG = BigInt(LAYOUT.AUX_SHIFT)
 const SSO_BIT_BIG = BigInt(LAYOUT.SSO_BIT)
 
-// memory[1020] holds the heap pointer only for shared memory (wasm globals are
+// memory[HEAP.PTR_ADDR] holds the heap pointer only for shared memory (wasm globals are
 // per-instance — see module/core.js comment). Non-shared memory uses $__heap.
 const heapUsesMem = () => ctx.memory.shared
 
 const heapGetIR = () => heapUsesMem()
-  ? ['i32.load', ['i32.const', 1020]]
+  ? ['i32.load', ['i32.const', HEAP.PTR_ADDR]]
   : ['global.get', '$__heap']
 
 const heapSetIR = value => heapUsesMem()
-  ? ['i32.store', ['i32.const', 1020], value]
+  ? ['i32.store', ['i32.const', HEAP.PTR_ADDR], value]
   : ['global.set', '$__heap', value]
 
 const ARENA_SAFE_CALLS = new Set([
@@ -134,19 +136,44 @@ export function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
   ctx.func.locals = new Map()
   ctx.func.localReps = null
   ctx.func.boxed = new Map()
+  ctx.func.cellTypes = new Set()
   ctx.func.stack = []
   ctx.func.current = { params: [], results: [] }
+  // Reserve prepare-generated temp names (for-of `arrVar`/`idx`/`len`,
+  // destructure scratch, …) in the __start frame so emit's temp()/tempI32()
+  // skip them — the same pre-seed analyzeFuncForEmit gives every function frame.
+  // Only T-sentinel names: they're always __start locals (user module-scope
+  // bindings become globals and can't contain T). Without this, prepare's
+  // `${T}arr${n}` collides with an emit-time tempI32('arr') at the same uniq,
+  // declaring the array pointer's local i32 and corrupting it via convert_i32_s.
+  const seedGeneratedLocals = (body) => {
+    for (const [n, t] of analyzeBody(body).locals)
+      if (n.includes(T) && !ctx.func.locals.has(n)) ctx.func.locals.set(n, t)
+  }
   analyzeValTypes(ast)
   const normalizeIR = ir => !ir?.length ? [] : Array.isArray(ir[0]) ? ir : [ir]
 
+  // Mark module-scope emission: top-level statements run exactly once, so a constant
+  // array/object literal here is a single instance that can safely live in a static
+  // data segment (no per-call freshness to violate). Function bodies — compiled
+  // separately, and the late closures below — leave this unset and alloc fresh.
+  ctx.func.atModuleScope = true
   const moduleInits = []
   if (ctx.module.moduleInits) {
     for (const mi of ctx.module.moduleInits) {
       analyzeValTypes(mi)
+      seedGeneratedLocals(mi)
       moduleInits.push(...normalizeIR(emit(mi)))
     }
   }
-  const init = emit(ast)
+  seedGeneratedLocals(ast)
+  // __start has no result: emit the top-level program in void context so a stray
+  // value is dropped. `ast` is normally a `;` statement-sequence (each statement
+  // already void-dropped), but jzify unwraps a single-statement program to its
+  // bare expression — emitting that in value context leaves a value on the stack
+  // and the start function fails validation. emitVoid handles both shapes.
+  const init = emitVoid(ast)
+  ctx.func.atModuleScope = false
 
   // Module-scope object literals can create closure bodies while `emit(ast)`
   // runs. Those late closures may pull in stdlib helpers (notably JSON.parse)
@@ -269,6 +296,47 @@ export function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
     sec.funcs.unshift(...closureFuncs.slice(beforeLateClosures))
 }
 
+/**
+ * Hoist constant global initializers out of `__start` into immutable inline decls.
+ *
+ * A top-level `const x = <constant>` for a non-numeric value (atom `true`/`null`/
+ * `undefined`/`NaN`, an SSO or static-string NaN-box, a folded pointer) emits a
+ * `(global.set $x (f64.const …))` into `__start`, because only *numeric* consts are
+ * folded ahead of emit. But the value is a compile-time constant, so it belongs in
+ * the decl itself — `(global $x f64 (f64.const …))` — exactly like the numeric path.
+ * That drops the store, and when it empties `__start` the start function and its
+ * directive go too. Gated to single-assignment user `const`s so we never freeze a
+ * binding something else writes.
+ */
+export function hoistConstGlobalInits(sec) {
+  const startFn = sec.start.find(n => Array.isArray(n) && n[0] === 'func' && n[1] === '$__start')
+  if (!startFn) return
+  const writes = new Map()
+  const scan = (node) => {
+    if (!Array.isArray(node)) return
+    if (node[0] === 'global.set' && typeof node[1] === 'string') writes.set(node[1], (writes.get(node[1]) || 0) + 1)
+    for (const c of node) scan(c)
+  }
+  for (const arr of [sec.funcs, sec.stdlib, sec.start]) for (const fn of arr) scan(fn)
+  for (let i = startFn.length - 1; i >= findBodyStart(startFn); i--) {
+    const stmt = startFn[i]
+    if (!Array.isArray(stmt) || stmt[0] !== 'global.set' || writes.get(stmt[1]) !== 1) continue
+    const name = typeof stmt[1] === 'string' && stmt[1][0] === '$' ? stmt[1].slice(1) : null
+    const g = name && ctx.scope.globals.get(name)
+    const c = stmt[2]
+    if (!g || !g.mut || !ctx.scope.consts?.has(name) || !ctx.scope.userGlobals?.has(name)) continue
+    if (!Array.isArray(c) || c[0] !== `${g.type}.const`) continue
+    ctx.scope.globals.set(name, { ...g, mut: false, init: c[1] })
+    startFn.splice(i, 1)
+  }
+  // Hoisting can empty `__start`. The O2 watr pass prunes a bodyless start, but at
+  // O0/O1 nothing else does — drop it (func + directive) here so a const-only module
+  // carries no start at all.
+  if (findBodyStart(startFn) >= startFn.length)
+    for (let j = sec.start.length - 1; j >= 0; j--)
+      if (Array.isArray(sec.start[j]) && sec.start[j][1] === '$__start') sec.start.splice(j, 1)
+}
+
 /**
  * Phase: closure-body dedup.
  *
@@ -342,8 +410,12 @@ export function finalizeClosureTable(sec) {
   }
   for (const fn of sec.funcs) { scan(fn); if (indirectUsed) break }
   if (!indirectUsed) for (const fn of sec.start) scan(fn)
-  if (!indirectUsed) for (const s of Object.keys(ctx.core.stdlib)) {
-    if (ctx.core.stdlib[s]?.includes?.('call_indirect')) { indirectUsed = true; break }
+  // stdlib values are mixed: WAT-template strings + lazy generator functions.
+  // Only the string templates can carry a literal `call_indirect`; a typeof
+  // guard skips the generators (where `.includes` is meaningless — and on a jz
+  // closure receiver would read the closure pointer as a string, out of bounds).
+  if (!indirectUsed) for (const tpl of Object.values(ctx.core.stdlib)) {
+    if (typeof tpl === 'string' && tpl.includes('call_indirect')) { indirectUsed = true; break }
   }
   if (indirectUsed) {
     if (!ctx.closure.table) ctx.closure.table = []
@@ -400,20 +472,154 @@ export function finalizeClosureTable(sec) {
   for (const fn of sec.start) rewriteCalls(fn)
 }
 
+/**
+ * Stdlib funcs actually reachable from the emitted program. Seeds from real
+ * `call`/`return_call`/`ref.func` sites in the user funcs, `__start`, and the elem
+ * table, then closes transitively over the stdlib call graph (each reached helper's
+ * template references). Conservative by construction — a template `$__foo` in a
+ * feature-dead branch is kept, never dropped — so it's safe to gate inclusion and the
+ * memory/allocator decision on it. An eagerly-`inc`'d helper that nothing calls is
+ * absent, which is the whole point.
+ */
+function reachableStdlib(sec) {
+  const stdlib = ctx.core.stdlib
+  const reach = new Set(), stack = []
+  // Track every reached name (module-namespace `math.sin` included), but only follow
+  // those with a stdlib template. Names match `$foo`, `$__foo`, `$math.sin_core` — the
+  // dotted module funcs are the ones the `$__`-only regex used to miss, pruning live code.
+  const add = (name) => { if (!reach.has(name)) { reach.add(name); if (stdlib[name] != null) stack.push(name) } }
+  const scanIR = (node) => {
+    if (!Array.isArray(node)) return
+    if ((node[0] === 'call' || node[0] === 'return_call' || node[0] === 'ref.func') &&
+        typeof node[1] === 'string' && node[1][0] === '$') add(node[1].slice(1))
+    for (const c of node) scanIR(c)
+  }
+  for (const fn of sec.funcs) scanIR(fn)
+  for (const fn of sec.start) scanIR(fn)
+  for (const e of sec.elem)               // closure table: bare `$fn` func refs
+    if (Array.isArray(e)) for (const c of e) if (typeof c === 'string' && c[0] === '$') add(c.slice(1))
+  // A stdlib func that self-exports (`(export "__invoke_closure")`) is a host-facing
+  // entry point — the JS host calls it directly, so it's a root even when nothing in
+  // the wasm calls it. Mirrors treeshake's inline-export rooting.
+  for (const n of ctx.core.includes) {
+    const v = stdlib[n]
+    let t = ''
+    try { t = typeof v === 'function' ? v() : v } catch { t = '' }
+    if (typeof t === 'string' && t.includes('(export "')) add(n)
+  }
+  while (stack.length) {
+    const v = stdlib[stack.pop()]
+    let text = ''
+    try { text = typeof v === 'function' ? v() : v } catch { text = '' }
+    if (typeof text === 'string') for (const m of text.matchAll(/\$([A-Za-z_][A-Za-z0-9_.]*)/g)) add(m[1])
+  }
+  return reach
+}
+
+// The f64x2 stdlib mirrors the lane vectorizer (optimize/vectorize.js) injects in the LATE 'post'
+// pass — after the stdlib was pulled + treeshaken. Keep in sync with that pass's call-rewrite map
+// (PPC_CALL2). These are the ONLY helpers appendLateStdlib may add; restricting to them avoids
+// touching helpers that live in other module sections (ext-stdlib, imports) where a blind
+// referenced-but-absent scan would wrongly re-append and duplicate them.
+const LATE_VEC_HELPERS = new Set(['math.sin2', 'math.cos2', 'math.pow2', 'math.atan2_2', 'math.hypot_2', 'math.log_v', 'math.exp_v', 'math.exp2_v'])
+
+// A late pass can reference one of the f64x2 mirrors that wasn't present when the stdlib was first
+// assembled. Append any referenced-but-missing mirror body (fixpoint over their own calls, though
+// the trig mirrors call nothing). moduleArr is mutated in place; non-mirror references are left for
+// watr to resolve (a genuine missing helper is the kernel's own pull, already satisfied).
+export function appendLateStdlib(moduleArr) {
+  const stdlib = ctx.core.stdlib
+  const have = new Set()
+  for (const n of moduleArr) if (Array.isArray(n) && n[0] === 'func' && typeof n[1] === 'string') have.add(n[1])
+  let added = true
+  while (added) {
+    added = false
+    const refs = new Set()
+    const scan = (n) => { if (!Array.isArray(n)) return; if ((n[0] === 'call' || n[0] === 'return_call' || n[0] === 'ref.func') && typeof n[1] === 'string' && n[1][0] === '$') refs.add(n[1]); for (const c of n) scan(c) }
+    for (const n of moduleArr) scan(n)
+    for (const ref of refs) {
+      const name = ref.slice(1)
+      if (have.has(ref) || !LATE_VEC_HELPERS.has(name) || stdlib[name] == null) continue
+      const node = parseTemplate(typeof stdlib[name] === 'function' ? stdlib[name]() : stdlib[name])
+      moduleArr.push(node[0] === 'module' ? node[1] : node)
+      have.add(ref)
+      added = true
+    }
+  }
+}
+
 /**
  * Phase: pull stdlib + memory.
  */
 export function pullStdlib(sec) {
   resolveIncludes()
 
-  const needsMemory = [...ctx.core.includes].some(n => ctx.core.stdlib[n] && MEM_OPS.test(ctx.core.stdlib[n]))
-  if (!needsMemory) ctx.scope.globals.delete('__heap')
+  // Reachability, not inclusion, decides what the output needs. `ctx.core.includes`
+  // accumulates everything a module *might* use (eager module-load `inc`s + transitive
+  // deps), but a const array / static string literal calls none of it. So we seed from
+  // the actual call sites in the emitted funcs + __start (+ elem table) and close
+  // transitively over the stdlib call graph. An eagerly-included helper that nothing
+  // calls never enters this set — so allocator, memory, and exports reflect real use.
+  const reachable = reachableStdlib(sec)
+  const realize = (n) => { const v = ctx.core.stdlib[n]; try { return typeof v === 'function' ? v() : v } catch { return '' } }
+
+  // Two distinct needs, kept separate:
+  //  · needsAlloc — the program allocates at runtime: an allocator func is reachable,
+  //    or shared-mem string literals seed a pool __start allocs. Drives the bump
+  //    allocator (`__alloc`/`__alloc_hdr`/`__clear`), the `__heap` pointer, and the
+  //    `_alloc`/`_clear` marshalling exports.
+  //  · needsMemory — linear memory must merely *exist*: we allocate, OR a literal lives
+  //    in a static data segment (a const pointer, no allocator behind it), OR a reached
+  //    helper / inline body does a load/store, OR `__ptr_type` is reached (the module
+  //    discriminates heap tags — an `instanceof`/`typeof x==='object'` whose argument the
+  //    host marshals across the boundary). A data segment with no memory is invalid wasm,
+  //    so memory can't be gated on allocation alone.
+  const ALLOC_FUNCS = ['__alloc', '__alloc_hdr', '__alloc_hdr_n']
+  const needsAlloc = !!ctx.runtime.strPool || ALLOC_FUNCS.some(a => reachable.has(a))
+  // Memory ops can be emitted *inline* into user/start funcs (a heap-path char read
+  // loads without calling a stdlib helper), so scan the emitted bodies too.
+  const hasMemOp = (node) => Array.isArray(node) &&
+    ((typeof node[0] === 'string' && MEM_OPS.test(node[0])) || node.some(hasMemOp))
+  // `ctx.runtime.data` is never empty here — the number module seeds a static stringify
+  // prefix (`NaNInfinity…`) at offset 0; stripStaticDataPrefix removes it when unused, so
+  // the real question is whether any data lives *beyond* that strippable prefix.
+  // An explicit `{ memory: pages }` / shared-memory option is a caller request to own
+  // linear memory (e.g. to marshal host values in), independent of what the wasm itself
+  // reaches — honour it even for an otherwise-memoryless program.
+  const explicitMemory = ctx.memory.pages > 0 || !!ctx.memory.shared
+  const needsMemory = needsAlloc || explicitMemory ||
+    (ctx.runtime.data?.length || 0) > (ctx.runtime.staticDataLen || 0) ||
+    reachable.has('__ptr_type') ||
+    [...reachable].some(n => MEM_OPS.test(realize(n))) ||
+    sec.funcs.some(hasMemOp) || sec.start.some(hasMemOp)
+  // Emit only what's reachable: drop every eagerly-`inc`'d *internal* helper the program
+  // never calls. This is what lets a const-array / static-string / atom module shed the
+  // allocator, pointer dispatchers, and length helpers that an array/object module load
+  // pulled in wholesale — and it keeps the dead allocator from dangling on the `$__heap`
+  // we delete below. Scoped to `__`-prefixed names: module-namespace funcs (`math.sin`)
+  // are pulled in on demand, never eagerly, so they're already minimal and never pruned
+  // here (guarding against any reachability blind spot in a dotted-name template).
+  for (const n of [...ctx.core.includes]) if (n.startsWith('__') && !reachable.has(n)) ctx.core.includes.delete(n)
+  if (!needsAlloc) ctx.scope.globals.delete('__heap')
   if (needsMemory && ctx.module.modules.core) {
-    for (const fn of ['__alloc', '__alloc_hdr', '__clear']) if (!ctx.core.includes.has(fn)) ctx.core.includes.add(fn)
-    const pages = ctx.memory.pages || 1
-    if (ctx.memory.shared) sec.imports.push(['import', '"env"', '"memory"', ['memory', pages]])
-    else sec.memory.push(['memory', ['export', '"memory"'], pages])
-    if (ctx.transform.alloc !== false && ctx.core._allocRawFuncs)
+    if (needsAlloc) {
+      for (const fn of ['__alloc', '__alloc_hdr', '__clear']) ctx.core.includes.add(fn)
+      // Late-add of allocators may pull in transitive deps (__alloc → __memgrow,
+      // etc.) that the initial resolveIncludes did not yet see; re-resolve.
+      // No-op when the alloc trio was already present.
+      resolveIncludes()
+    }
+    // Initial pages must cover the static data segment (it loads at instantiation), not
+    // just the default 1 — otherwise a module whose constants exceed 64 KiB emits a data
+    // segment that overflows its own memory. The heap grows past this on demand via
+    // __memgrow. (Shared memory loads literals via memory.init into allocated space, so
+    // its initial size isn't pinned by the data length.)
+    const dataPages = ctx.memory.shared ? 0 : Math.ceil((ctx.runtime.data?.length || 0) / 65536)
+    const pages = Math.max(ctx.memory.pages || 1, dataPages)
+    const max = ctx.memory.max || 0   // 0 = no maximum (unbounded growth)
+    if (ctx.memory.shared) sec.imports.push(['import', '"env"', '"memory"', max ? ['memory', pages, max] : ['memory', pages]])
+    else sec.memory.push(max ? ['memory', ['export', '"memory"'], pages, max] : ['memory', ['export', '"memory"'], pages])
+    if (needsAlloc && ctx.transform.alloc !== false && ctx.core._allocRawFuncs)
       sec.funcs.push(...ctx.core._allocRawFuncs.map(parseTemplate))
   }
 
@@ -443,31 +649,34 @@ export function syncImports(sec) {
 /**
  * Phase: whole-module + per-function optimization passes.
  */
-export function optimizeModule(sec) {
+export function optimizeModule(sec, profiler) {
+  const t = profiler?.time ? (name, fn) => profiler.time(`optMod:${name}`, fn) : (_, fn) => fn()
   const cfg = ctx.transform.optimize
-  if (!cfg || cfg.specializeMkptr !== false)
-    specializeMkptr([...sec.funcs, ...sec.stdlib, ...sec.start], wat => sec.stdlib.push(parseWat(wat)), parseWat)
-  if (!cfg || cfg.specializePtrBase !== false)
-    specializePtrBase([...sec.funcs, ...sec.stdlib, ...sec.start], wat => sec.stdlib.push(parseWat(wat)), parseWat)
-  if (ctx.runtime.strPool && (!cfg || cfg.sortStrPoolByFreq !== false)) {
+  if (!cfg || cfg.specializeMkptr !== false) t('specializeMkptr', () =>
+    specializeMkptr([...sec.funcs, ...sec.stdlib, ...sec.start], wat => sec.stdlib.push(parseWat(wat)), parseWat))
+  if (!cfg || cfg.specializePtrBase !== false) t('specializePtrBase', () =>
+    specializePtrBase([...sec.funcs, ...sec.stdlib, ...sec.start], wat => sec.stdlib.push(parseWat(wat)), parseWat))
+  if (ctx.runtime.strPool && (!cfg || cfg.sortStrPoolByFreq !== false)) t('sortStrPool', () => {
     const poolRef = { pool: ctx.runtime.strPool }
     sortStrPoolByFreq([...sec.funcs, ...sec.stdlib, ...sec.start], poolRef, ctx.runtime.strPoolDedup)
     ctx.runtime.strPool = poolRef.pool
-  }
-  // Backfill globalTypes for runtime globals declared only in ctx.scope.globals
-  // (e.g., __schema_tbl, __strBase). Parses the WAT string to infer i32/f64/i64.
-  if (ctx.scope.globals) {
-    for (const [name, wat] of ctx.scope.globals) {
-      if (!wat || ctx.scope.globalTypes.has(name)) continue
-      const m = wat.match(/\(global\s+\$?\S+\s+(?:\(mut\s+)?(i32|i64|f64|f32)/)
-      if (m) ctx.scope.globalTypes.set(name, m[1])
-    }
-  }
+  })
+  // (globalTypes backfill gone: declGlobal sets the type at declaration.)
   // Build global name→type map from ctx.scope.globalTypes (keys without $) for promoteGlobals
   const globalTypesMap = ctx.scope.globalTypes ? new Map([...ctx.scope.globalTypes].map(([k, v]) => [`$${k}`, v])) : null
   const allFuncs = [...sec.funcs, ...sec.stdlib, ...sec.start]
-  const volatileGlobals = collectVolatileGlobals(allFuncs)
-  for (const s of allFuncs) optimizeFunc(s, cfg, globalTypesMap, volatileGlobals)
+  const volatileGlobals = t('volatileGlobals', () => collectVolatileGlobals(allFuncs))
+  const reachableWrites = t('reachableWrites', () => collectReachableGlobalWrites(allFuncs))
+  // Offset-hoist BEFORE promoteGlobals (inside optimizeFunc): value-promoting a
+  // stable-pointee global to a $_pg local would destroy the global.get pattern
+  // this pass matches, reverting rfft/diffusion to per-iteration resolves. After
+  // the hoist, the surviving global.get count is 1 (the entry snap) — naturally
+  // below promoteGlobals' threshold, so the two passes compose either way.
+  if (!cfg || cfg.hoistGlobalPtrOffset !== false) t('hoistGlobalPtr', () => {
+    const stable = stablePtrGlobalNames()
+    if (stable.size) for (const s of allFuncs) hoistGlobalPtrOffset(s, stable, reachableWrites)
+  })
+  t('optimizeFuncs', () => { for (const s of allFuncs) optimizeFunc(s, cfg, globalTypesMap, volatileGlobals, 'pre', reachableWrites) })
   if (!cfg || cfg.arenaRewind !== false) {
     const safeCallees = arenaRewindModule([...sec.funcs, ...sec.stdlib, ...sec.start])
     const fnByName = new Map()
@@ -481,11 +690,7 @@ export function optimizeModule(sec) {
     }
   }
   if (!cfg || cfg.hoistConstantPool !== false)
-    hoistConstantPool([...sec.funcs, ...sec.stdlib, ...sec.start], (name, wat) => {
-      ctx.scope.globals.set(name, wat)
-      const m = wat.match(/\(global\s+\$?\S+\s+(?:\(mut\s+)?(i32|i64|f64|f32)/)
-      if (m) ctx.scope.globalTypes.set(name, m[1])
-    })
+    hoistConstantPool([...sec.funcs, ...sec.stdlib, ...sec.start], (name, lit) => declGlobal(name, 'f64', lit))
 
   // Second promoteGlobals pass disabled: promoting hoistConstantPool's __fc*
   // globals regressed the watr perf micro-pin (WASM compile time increased).
@@ -502,12 +707,8 @@ export function optimizeModule(sec) {
     const heapBase = (dataLen + 7) & ~7
     // Non-shared memory always carries a $__heap global — start it past the
     // static data so the bump allocator never overwrites a literal.
-    ctx.scope.globals.set('__heap', `(global $__heap (export "__heap") (mut i32) (i32.const ${heapBase}))`)
-    ctx.scope.globalTypes.set('__heap', 'i32')
-    if (ctx.scope.globals.has('__heap_start')) {
-      ctx.scope.globals.set('__heap_start', `(global $__heap_start (mut i32) (i32.const ${heapBase}))`)
-      ctx.scope.globalTypes.set('__heap_start', 'i32')
-    }
+    declGlobal('__heap', 'i32', heapBase, { export: '__heap' })
+    if (ctx.scope.globals.has('__heap_start')) declGlobal('__heap_start', 'i32', heapBase)
     for (const s of sec.stdlib)
       if (s[0] === 'func' && s[1] === '$__clear')
         for (let i = 2; i < s.length; i++)
@@ -528,18 +729,33 @@ export function stripStaticDataPrefix(sec) {
   for (let i = 0; i < data.length; i++) buf[i] = data.charCodeAt(i)
   const dv = new DataView(buf.buffer)
   if (ctx.runtime.staticPtrSlots) {
+    // u32-half reads/writes — DataView's BigInt accessors are unfaithful in the
+    // self-host kernel; the offset lives entirely in the LE low word and the
+    // tag/aux fields entirely in the high word, so plain number math suffices.
     for (const slotOff of ctx.runtime.staticPtrSlots) {
       if (slotOff < prefix) continue
-      const bits = dv.getBigUint64(slotOff, true)
-      if (((bits >> 48n) & 0xFFF8n) !== NAN_PREFIX) continue
-      const ty = Number((bits >> TAG_SHIFT_BIG) & TAG_MASK_BIG)
+      const hi = dv.getUint32(slotOff + 4, true)
+      if (((hi >>> 16) & 0xFFF8) !== LAYOUT.NAN_PREFIX) continue
+      const ty = (hi >>> 15) & 15
       if (!SHIFTABLE.has(ty)) continue
-      if (ty === PTR.STRING && ((bits >> AUX_SHIFT_BIG) & SSO_BIT_BIG)) continue
-      const off = Number(bits & OFFSET_MASK_BIG)
+      if (ty === PTR.STRING && ((hi >>> (LAYOUT.AUX_SHIFT - 32)) & LAYOUT.SSO_BIT)) continue
+      const off = dv.getUint32(slotOff, true)
       if (off < prefix) continue
-      const hi = bits & ~OFFSET_MASK_BIG
-      dv.setBigUint64(slotOff, hi | BigInt(off - prefix), true)
+      dv.setUint32(slotOff, off - prefix, true)
+    }
+  }
+  // The intern index (buildInternTable) stores raw static-string ptrs as u32
+  // slots — shift each occupied slot like every other static reference, and
+  // re-declare the (already-declared) base global at its post-strip position.
+  if (ctx.runtime.internTable) {
+    const { base, size } = ctx.runtime.internTable
+    for (let i = 0; i < size; i++) {
+      const slot = base + i * 8 + 4
+      const off = dv.getUint32(slot, true)
+      if (off >= prefix) dv.setUint32(slot, off - prefix, true)
     }
+    ctx.runtime.internTable.base = base - prefix
+    declGlobal('__internBase', 'i32', base - prefix, { mut: false })
   }
   let s = ''
   for (let i = prefix; i < buf.length; i++) s += String.fromCharCode(buf[i])
@@ -559,6 +775,10 @@ export function stripStaticDataPrefix(sec) {
           Array.isArray(child[3]) && child[3][0] === 'i32.const' &&
           typeof child[3][1] === 'number' && (child[3][1] & LAYOUT.SSO_BIT)
         if (!isSsoString) child[4][1] -= prefix
+      } else if (typeof child[0] === 'string' && child[0].endsWith('.store') &&
+        Array.isArray(child[1]) && child[1][0] === 'i32.const' &&
+        typeof child[1][1] === 'number' && child[1][1] >= prefix) {
+        child[1][1] -= prefix
       } else if (child[0] === 'f64.const' &&
         typeof child[1] === 'string' && child[1].startsWith('nan:0x')) {
         const bits = BigInt(child[1].slice(4)) | 0x7FF0000000000000n