jz 0.6.0 → 0.8.0

package/module/string.js

@@ -22,6 +22,38 @@ import { ssoBitI64Hex, sliceBitI64Hex, ptrNanHex, STR_INTERN_BIT } from '../layo
 const SSO_BIT_I64 = ssoBitI64Hex()
 const SLICE_BIT_I64 = sliceBitI64Hex()
 
+// === SSO codec — single source of truth for the inline-string bit layout ===
+// ASCII chars packed at 7 bits each into the NaN-box payload: char i at payload bit
+// i*7  (uniform `(ptr >> i*7) & 0x7f`), length at payload bits 42-44, SSO_BIT at bit 46
+// (SLICE_BIT at 45 stays 0). 6 chars fit (6*7=42, + 3-bit len). ASCII-only — a byte
+// ≥0x80 falls back to a heap string. The 7-bit-uniform layout makes equal short strings
+// content-bit-equal (so `op === 'tag'` is a bare i64.eq) and never touches memory.
+const MAX_SSO = 6
+const SSO_LEN_SHIFT = 10  // length occupies aux bits 10-12 (= payload bits 42-44)
+// JS: ASCII string → { aux, offset }, or null when ineligible (too long / non-ASCII).
+// BigInt-free (i32 ops only) so the self-hosted compiler — which runs this to encode
+// every string literal — stays on jz's numeric core. offset = payload bits 0-31, aux =
+// bits 32-46; char i at bit i*7 (chars 0-3 fit the offset, char 4 straddles, char 5 → aux).
+const ssoEncode = (str) => {
+  if (str.length > MAX_SSO || !/^[\x00-\x7f]*$/.test(str)) return null
+  let offset = 0, auxChars = 0
+  for (let i = 0; i < str.length; i++) {
+    const c = str.charCodeAt(i), bit = i * 7
+    if (bit <= 24) offset |= c << bit                 // chars 0-3 (bits 0-27), wholly in offset
+    else if (bit < 32) { offset |= (c & 0xF) << 28; auxChars |= c >> 4 }  // char 4: bits 28-34 straddle
+    else auxChars |= c << (bit - 32)                  // char 5: bits 35-41 → aux bits 3-9
+  }
+  return { aux: LAYOUT.SSO_BIT | (str.length << SSO_LEN_SHIFT) | auxChars, offset: offset >>> 0 }
+}
+// aux for an SSO string whose chars all fit in the offset (len ≤ 4: 4*7=28 ≤ 32 bits).
+const ssoAux = (len) => LAYOUT.SSO_BIT | (len << SSO_LEN_SHIFT)
+// WAT: char i (i32 expr) of SSO ptr (i64 expr) — 7-bit at payload bit i*7.
+const ssoCharWat = (ptr, i) => `(i32.wrap_i64 (i64.and (i64.shr_u ${ptr} (i64.mul (i64.extend_i32_u ${i}) (i64.const 7))) (i64.const 0x7f)))`
+// WAT: length (i32) of SSO ptr (i64 expr) — payload bits 42-44.
+const ssoLenWat = (ptr) => `(i32.wrap_i64 (i64.and (i64.shr_u ${ptr} (i64.const 42)) (i64.const 7)))`
+// WAT: length (i32) from an already-extracted aux (i32 expr).
+const ssoLenFromAux = (aux) => `(i32.and (i32.shr_u ${aux} (i32.const ${SSO_LEN_SHIFT})) (i32.const 7))`
+
 // WAT (no-locals expression): byte length of a heap STRING given its raw $-local
 // names for the offset and the i64 ptr. A view (SLICE_BIT) carries its length in
 // aux[12:0]; an own heap string reads the i32 header at off-4. Callers must have
@@ -43,26 +75,28 @@ const heapLenExpr = (ptrLocal, offLocal) => `(if (result i32)
 // bit-equal (SSO content IS the bits). Bails to the caller's heap path on a
 // non-ASCII byte (SSO is ASCII-only). Locals: $sb scratch byte, $sp packed.
 const sliceSsoPackWat = () => `
-    (if (i32.le_u (local.get $nlen) (i32.const 4))
+    (if (i32.le_u (local.get $nlen) (i32.const ${MAX_SSO}))
       (then (block $heap8
         (local.set $srcOff (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
         (local.set $isSso (i32.wrap_i64 (i64.shr_u
           (i64.and (local.get $ptr) (i64.const ${SSO_BIT_I64}))
           (i64.const ${LAYOUT.AUX_SHIFT}))))
-        (local.set $i (i32.const 0)) (local.set $sp (i32.const 0))
-        (loop $pk8
+        (local.set $i (i32.const 0)) (local.set $sp64 (i64.const 0))
+        (loop $pk7
           (if (i32.lt_u (local.get $i) (local.get $nlen))
             (then
               (local.set $sb (if (result i32) (local.get $isSso)
-                (then (i32.and
-                  (i32.shr_u (local.get $srcOff) (i32.shl (i32.add (local.get $start) (local.get $i)) (i32.const 3)))
-                  (i32.const 0xFF)))
+                (then ${ssoCharWat('(local.get $ptr)', '(i32.add (local.get $start) (local.get $i))')})
                 (else (i32.load8_u (i32.add (i32.add (local.get $srcOff) (local.get $start)) (local.get $i))))))
               (br_if $heap8 (i32.ge_u (local.get $sb) (i32.const 0x80)))
-              (local.set $sp (i32.or (local.get $sp) (i32.shl (local.get $sb) (i32.shl (local.get $i) (i32.const 3)))))
+              (local.set $sp64 (i64.or (local.get $sp64)
+                (i64.shl (i64.extend_i32_u (local.get $sb)) (i64.mul (i64.extend_i32_u (local.get $i)) (i64.const 7)))))
               (local.set $i (i32.add (local.get $i) (i32.const 1)))
-              (br $pk8))))
-        (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.or (i32.const ${LAYOUT.SSO_BIT}) (local.get $nlen)) (local.get $sp))))))`
+              (br $pk7))))
+        (return (f64.reinterpret_i64 (i64.or (i64.or
+          (i64.const ${ptrNanHex(PTR.STRING, LAYOUT.SSO_BIT)})
+          (i64.shl (i64.extend_i32_u (local.get $nlen)) (i64.const 42)))
+          (local.get $sp64)))))))`
 
 // Probe the static intern index (buildInternTable, compile/index.js): a 5..32
 // byte slice whose content equals a static literal returns the CANONICAL
@@ -112,10 +146,15 @@ export default (ctx) => {
     __str_concat_raw: ['__str_byteLen', '__alloc', '__memgrow', '__mkptr', '__str_copy'],
     __str_append_byte: ['__str_byteLen', '__alloc', '__memgrow', '__mkptr', '__str_copy'],
     __str_copy: [],
-    __str_slice: ['__str_byteLen', '__alloc'],
-    __str_slice_view: ['__str_byteLen', '__mkptr', '__str_slice'],
-    __str_indexof: ['__str_byteLen', '__to_str'],
-    __str_lastindexof: ['__str_byteLen', '__to_str'],
+    // __str_slice/_view are FUNCTION templates: resolveIncludes' auto-dep scan realizes the
+    // factory (v()) to discover body calls, but that realization DIVERGES under self-host
+    // (jz.wasm) — so a body-called helper not also listed here is dropped from the kernel
+    // ("Unknown func $__clamp_idx" on `str.slice`). FN templates must declare body deps
+    // manually; pinned by test/selfhost-includes.js.
+    __str_slice: ['__str_byteLen', '__alloc', '__clamp_idx', '__mkptr'],
+    __str_slice_view: ['__str_byteLen', '__mkptr', '__str_slice', '__clamp_idx'],
+    __str_indexof: ['__str_byteLen'],
+    __str_lastindexof: ['__str_byteLen'],
     __wrap1: ['__alloc', '__mkptr'],
     __str_substring: ['__str_slice'],
     __str_startswith: ['__str_byteLen'],
@@ -128,15 +167,15 @@ export default (ctx) => {
     __str_replace: ['__str_indexof', '__str_slice', '__str_concat'],
     __str_replaceall: ['__str_indexof', '__str_slice', '__str_concat'],
     __str_split: ['__str_slice', '__str_byteLen', '__char_at', '__alloc'],
-    __str_idx: [],
+    __str_idx: ['__char1byte'],
     __str_eq: ['__str_eq_cold'],
     __str_eq_cold: ['__char_at', '__str_byteLen'],
     __str_cmp: ['__char_at', '__str_byteLen'],
     __str_range_eq: ['__char_at', '__str_byteLen'],
     __str_substring_eq: ['__str_byteLen', '__str_range_eq'],
-    __str_slice_eq: ['__str_byteLen', '__str_range_eq'],
+    __str_slice_eq: ['__str_byteLen', '__str_range_eq', '__clamp_idx'],  // body-calls __clamp_idx; declare it (self-host auto-scan unreliable — test/selfhost-includes.js)
     __str_pad: ['__str_byteLen', '__str_copy', '__alloc'],
-    __str_join: ['__str_concat', '__to_str', '__str_byteLen', '__len', '__ptr_offset'],
+    __str_join: ['__str_concat', '__to_str', '__str_byteLen', '__len', '__ptr_offset', '__mkptr'],  // FN template: __mkptr body-called, must be manual (self-host auto-scan diverges)
     __str_encode: ['__str_byteLen', '__str_copy'],
     __encodeURIComponent: ['__to_str', '__str_byteLen', '__char_at', '__alloc', '__mkptr'],
     __decodeURIComponent: ['__to_str', '__str_byteLen', '__char_at', '__alloc', '__mkptr', '__uri_hex'],
@@ -145,16 +184,26 @@ export default (ctx) => {
     __str_byteLen: ['__ptr_type', '__ptr_aux', '__str_len'],
   })
 
+  // String *runtime* construction (concat/slice/split/`String(n)`/shared-memory
+  // pools) allocates and boxes pointers, so the module eagerly declares its core
+  // heap deps — same as object.js / typedarray.js / array.js. Several such helpers
+  // (`__str_slice`, `__str_split`, `__str_case`, …) call `$__mkptr`/`$__alloc` only
+  // through nested template thunks (sliceSsoPackWat/internProbeWat); resolveIncludes'
+  // auto-derivation realizes those thunks to recover the dep, but that re-realization
+  // is not reliable under self-host (the jz.wasm kernel re-runs the thunk late, with
+  // intern/heap state the native run never reaches), so a runtime string op would
+  // emit `call $__mkptr` with no definition. Declaring the deps explicitly here makes
+  // inclusion independent of thunk re-realization. Reachability pruning still drops
+  // both for a literals-only module (no `__mkptr`/`__alloc` call site → unreachable),
+  // so a heap-free program stays heap-free — no allocator, no memory, no exports.
   inc('__mkptr', '__alloc')
 
-  // === String literal: "abc" → SSO if ≤4 ASCII, else heap ===
+  // === String literal: "abc" → SSO if ≤4 ASCII, else static data ===
 
   bind('str', (str) => {
-    const MAX_SSO = 4
-    if (ctx.features.sso && str.length <= MAX_SSO && /^[\x00-\x7f]*$/.test(str)) {
-      let packed = 0
-      for (let i = 0; i < str.length; i++) packed |= str.charCodeAt(i) << (i * 8)
-      return mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | str.length, packed)
+    if (ctx.features.sso) {
+      const sso = ssoEncode(str)
+      if (sso) return mkPtrIR(PTR.STRING, sso.aux, sso.offset)
     }
     const bytes = new TextEncoder().encode(str)
     const len = bytes.length
@@ -211,11 +260,7 @@ export default (ctx) => {
   // SSO/STRING ptrs never have forwarding pointers (only ARRAY does), so we extract
   // the raw offset directly instead of paying the __ptr_offset function-call overhead.
   wat('__sso_char', `(func $__sso_char (param $ptr i64) (param $i i32) (result i32)
-    (i32.and
-      (i32.shr_u
-        (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK})))
-        (i32.mul (local.get $i) (i32.const 8)))
-      (i32.const 0xFF)))`)
+    ${ssoCharWat('(local.get $ptr)', '(local.get $i)')})`)
 
   wat('__str_char', `(func $__str_char (param $ptr i64) (param $i i32) (result i32)
     (i32.load8_u (i32.add
@@ -242,16 +287,9 @@ export default (ctx) => {
       (i64.ne (i64.and (local.get $ptr) (i64.const ${SSO_BIT_I64})) (i64.const 0))
       (then
         (if (result i32)
-          (i32.ge_u (local.get $i)
-            (i32.and
-              (i32.wrap_i64 (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.AUX_SHIFT})))
-              (i32.const ${LAYOUT.SSO_BIT - 1})))
+          (i32.ge_u (local.get $i) ${ssoLenWat('(local.get $ptr)')})
           (then (i32.const 0))
-          (else (i32.and
-            (i32.shr_u
-              (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK})))
-              (i32.mul (local.get $i) (i32.const 8)))
-            (i32.const 0xFF)))))
+          (else ${ssoCharWat('(local.get $ptr)', '(local.get $i)')})))
       (else
         (if (result i32)
           (i32.ge_u (local.get $i)
@@ -289,9 +327,7 @@ export default (ctx) => {
       (i32.const ${LAYOUT.SSO_BIT})))
     (local.set $len
       (if (result i32) (local.get $isSso)
-        (then (i32.and
-          (i32.wrap_i64 (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.AUX_SHIFT})))
-          (i32.const ${LAYOUT.SSO_BIT - 1})))
+        (then ${ssoLenWat('(local.get $ptr)')})
         (else
           (if (result i32)
             (i64.ne (i64.and (local.get $ptr) (i64.const ${SLICE_BIT_I64})) (i64.const 0))
@@ -306,14 +342,15 @@ export default (ctx) => {
       (i32.or (i32.lt_s (local.get $i) (i32.const 0)) (i32.ge_u (local.get $i) (local.get $len)))
       (then (f64.const nan:${UNDEF_NAN}))
       (else
-        (f64.reinterpret_i64
-          (i64.or
-            ;; mkptr(STRING, SSO_BIT|1, 0) = NAN_PREFIX | (STRING<<TAG_SHIFT) | ((SSO_BIT|1)<<AUX_SHIFT)
-            (i64.const ${ptrNanHex(PTR.STRING, LAYOUT.SSO_BIT | 1)})
-            (i64.extend_i32_u
-              (if (result i32) (local.get $isSso)
-                (then (i32.and (i32.shr_u (local.get $off) (i32.mul (local.get $i) (i32.const 8))) (i32.const 0xFF)))
-                (else (i32.load8_u (i32.add (local.get $off) (local.get $i)))))))))))`)
+        (if (result f64) (local.get $isSso)
+          ;; SSO source: chars are ASCII (<0x80) → inline 1-char SSO (hot path, no branch).
+          (then (f64.reinterpret_i64
+            (i64.or
+              (i64.const ${ptrNanHex(PTR.STRING, ssoAux(1))})
+              (i64.extend_i32_u ${ssoCharWat('(local.get $ptr)', '(local.get $i)')}))))
+          ;; Heap source: the byte may be ≥0x80 (non-ASCII), which can't be a 7-bit SSO,
+          ;; so __char1byte routes those to a heap 1-byte string.
+          (else (call $__char1byte (i32.load8_u (i32.add (local.get $off) (local.get $i)))))))))`)
 
   // Hot: ~53M calls in watr self-host. Bit-eq covers identity. SSO/SSO with !bit-eq
   // guarantees content differs (high 32 bits encode type+len; both equal → low 32 differs
@@ -360,9 +397,12 @@ export default (ctx) => {
     (local $ta i32) (local $tb i32)
     (local $offA i32) (local $offB i32)
     (local $ssoA i32) (local $ssoB i32)
-    (local $axA i32) (local $axB i32)
-    (if (i64.eq (local.get $a) (local.get $b))
-      (then (return (i32.const 1))))
+    ;; Sole caller is __str_eq, which already returned for bit-equal pointers, both-SSO
+    ;; (bit-ne ⇒ content-ne), both-canonical-interned (bit-ne ⇒ content-ne) and both-plain-
+    ;; heap length mismatch. Re-testing them here is dead work on every cold call — skip to
+    ;; the byte walk. (__str_eq/__str_eq_cold are ~14% of self-host runtime; this trims the
+    ;; per-call fixed cost.) The heap/mixed paths below still decide every case correctly
+    ;; on their own, so this stays correct even if a future caller skips the prelude.
     (local.set $ta (i32.wrap_i64 (i64.and (i64.shr_u (local.get $a) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
     (local.set $tb (i32.wrap_i64 (i64.and (i64.shr_u (local.get $b) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
     (local.set $offA (i32.wrap_i64 (i64.and (local.get $a) (i64.const ${LAYOUT.OFFSET_MASK}))))
@@ -373,22 +413,6 @@ export default (ctx) => {
     (local.set $ssoB (i32.and
       (i32.wrap_i64 (i64.shr_u (local.get $b) (i64.const ${LAYOUT.AUX_SHIFT})))
       (i32.const ${LAYOUT.SSO_BIT})))
-    ;; Both SSO with !bit-eq ⇒ content differs (high 32 bits hold tag+aux; both equal here).
-    (if (i32.and (local.get $ssoA) (local.get $ssoB))
-      (then (return (i32.const 0))))
-    ;; Both CANONICAL interned heap strings (STR_INTERN_BIT, SSO/SLICE clear):
-    ;; canonicals are deduped, so bit-ne ⇒ content-ne — the V8 pointer-compare
-    ;; equivalent. This is the dominant unequal case in tag-dispatch chains
-    ;; (op === 'literal' ladders over static literals).
-    (local.set $axA (i32.wrap_i64 (i64.shr_u (local.get $a) (i64.const ${LAYOUT.AUX_SHIFT}))))
-    (local.set $axB (i32.wrap_i64 (i64.shr_u (local.get $b) (i64.const ${LAYOUT.AUX_SHIFT}))))
-    (if (i32.and
-          (i32.and (i32.eq (local.get $ta) (i32.const ${PTR.STRING}))
-                   (i32.eq (local.get $tb) (i32.const ${PTR.STRING})))
-          (i32.and
-            (i32.eq (i32.and (local.get $axA) (i32.const ${LAYOUT.SSO_BIT | LAYOUT.SLICE_BIT | STR_INTERN_BIT})) (i32.const ${STR_INTERN_BIT}))
-            (i32.eq (i32.and (local.get $axB) (i32.const ${LAYOUT.SSO_BIT | LAYOUT.SLICE_BIT | STR_INTERN_BIT})) (i32.const ${STR_INTERN_BIT}))))
-      (then (return (i32.const 0))))
     ;; Both heap STRING fast path: inline len from header. Chunk by 4 bytes via unaligned
     ;; i32.load (wasm guarantees unaligned-OK), then byte-tail. Most string comparisons fail
     ;; early on the first 4-byte word, so this collapses the per-byte branch overhead into a
@@ -477,7 +501,7 @@ export default (ctx) => {
           (i32.wrap_i64 (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.AUX_SHIFT})))
           (i32.const ${LAYOUT.AUX_MASK})))
         (if (result i32) (i32.and (local.get $aux) (i32.const ${LAYOUT.SSO_BIT}))
-          (then (i32.and (local.get $aux) (i32.const ${LAYOUT.SSO_BIT - 1})))
+          (then ${ssoLenFromAux('(local.get $aux)')})
           (else
             (if (result i32) (i32.and (local.get $aux) (i32.const ${LAYOUT.SLICE_BIT}))
               ;; view: length lives in aux[12:0], not a header.
@@ -495,21 +519,11 @@ export default (ctx) => {
   // (single bulk op instead of nlen × __char_at).
   wat('__str_slice', () => `(func $__str_slice (param $ptr i64) (param $start i32) (param $end i32) (result f64)
     (local $len i32) (local $nlen i32) (local $off i32) (local $i i32)
-    (local $srcOff i32) (local $isSso i32) (local $sb i32) (local $sp i32)
+    (local $srcOff i32) (local $isSso i32) (local $sb i32) (local $sp i32) (local $sp64 i64)
     (local $ip i32) (local $h i32) (local $j i32) (local $slot i32) (local $cand i32) (local $k i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
-    (if (i32.lt_s (local.get $start) (i32.const 0))
-      (then (local.set $start (i32.add (local.get $len) (local.get $start)))))
-    (if (i32.lt_s (local.get $end) (i32.const 0))
-      (then (local.set $end (i32.add (local.get $len) (local.get $end)))))
-    (if (i32.lt_s (local.get $start) (i32.const 0))
-      (then (local.set $start (i32.const 0))))
-    (if (i32.gt_s (local.get $start) (local.get $len))
-      (then (local.set $start (local.get $len))))
-    (if (i32.lt_s (local.get $end) (i32.const 0))
-      (then (local.set $end (i32.const 0))))
-    (if (i32.gt_s (local.get $end) (local.get $len))
-      (then (local.set $end (local.get $len))))
+    (local.set $start (call $__clamp_idx (local.get $start) (local.get $len)))
+    (local.set $end (call $__clamp_idx (local.get $end) (local.get $len)))
     (if (i32.ge_s (local.get $start) (local.get $end))
       (then (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT}) (i32.const 0)))))
     (local.set $nlen (i32.sub (local.get $end) (local.get $start)))
@@ -548,18 +562,8 @@ export default (ctx) => {
     (local $len i32) (local $nlen i32) (local $srcOff i32) (local $tag i32)
     (local $ip i32) (local $h i32) (local $j i32) (local $slot i32) (local $cand i32) (local $k i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
-    (if (i32.lt_s (local.get $start) (i32.const 0))
-      (then (local.set $start (i32.add (local.get $len) (local.get $start)))))
-    (if (i32.lt_s (local.get $end) (i32.const 0))
-      (then (local.set $end (i32.add (local.get $len) (local.get $end)))))
-    (if (i32.lt_s (local.get $start) (i32.const 0))
-      (then (local.set $start (i32.const 0))))
-    (if (i32.gt_s (local.get $start) (local.get $len))
-      (then (local.set $start (local.get $len))))
-    (if (i32.lt_s (local.get $end) (i32.const 0))
-      (then (local.set $end (i32.const 0))))
-    (if (i32.gt_s (local.get $end) (local.get $len))
-      (then (local.set $end (local.get $len))))
+    (local.set $start (call $__clamp_idx (local.get $start) (local.get $len)))
+    (local.set $end (call $__clamp_idx (local.get $end) (local.get $len)))
     (if (i32.ge_s (local.get $start) (local.get $end))
       (then (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT}) (i32.const 0)))))
     (local.set $nlen (i32.sub (local.get $end) (local.get $start)))
@@ -664,18 +668,8 @@ export default (ctx) => {
   wat('__str_slice_eq', `(func $__str_slice_eq (param $ptr i64) (param $start i32) (param $end i32) (param $other i64) (result i32)
     (local $len i32)
     (local.set $len (call $__str_byteLen (local.get $ptr)))
-    (if (i32.lt_s (local.get $start) (i32.const 0))
-      (then (local.set $start (i32.add (local.get $len) (local.get $start)))))
-    (if (i32.lt_s (local.get $end) (i32.const 0))
-      (then (local.set $end (i32.add (local.get $len) (local.get $end)))))
-    (if (i32.lt_s (local.get $start) (i32.const 0))
-      (then (local.set $start (i32.const 0))))
-    (if (i32.gt_s (local.get $start) (local.get $len))
-      (then (local.set $start (local.get $len))))
-    (if (i32.lt_s (local.get $end) (i32.const 0))
-      (then (local.set $end (i32.const 0))))
-    (if (i32.gt_s (local.get $end) (local.get $len))
-      (then (local.set $end (local.get $len))))
+    (local.set $start (call $__clamp_idx (local.get $start) (local.get $len)))
+    (local.set $end (call $__clamp_idx (local.get $end) (local.get $len)))
     (call $__str_range_eq (local.get $ptr) (local.get $start) (local.get $end) (local.get $other)))`)
 
   // Hoist SSO/heap dispatch for hay and ndl out of the inner byte loop. Inner
@@ -684,8 +678,8 @@ export default (ctx) => {
     (local $hlen i32) (local $nlen i32) (local $i i32) (local $j i32) (local $match i32)
     (local $hoff i32) (local $noff i32)
     (local $hsso i32) (local $nsso i32) (local $hb i32) (local $nb i32) (local $k i32)
-    ;; ToString the search value (21.1.3.9 step 4) — coerces undefined/null/number/etc.
-    (local.set $ndl (call $__to_str (local.get $ndl)))
+    ;; The search value is ToString'd at the call site (searchArg) per 21.1.3.9 step 4 —
+    ;; a known-string needle passes raw, so this helper carries no float-pulling __to_str.
     (local.set $hlen (call $__str_byteLen (local.get $hay)))
     (local.set $nlen (call $__str_byteLen (local.get $ndl)))
     (if (i32.eqz (local.get $nlen)) (then (return (local.get $from))))
@@ -707,10 +701,10 @@ export default (ctx) => {
         (br_if $nomatch (i32.ge_s (local.get $j) (local.get $nlen)))
         (local.set $k (i32.add (local.get $i) (local.get $j)))
         (local.set $hb (if (result i32) (local.get $hsso)
-          (then (i32.and (i32.shr_u (local.get $hoff) (i32.shl (local.get $k) (i32.const 3))) (i32.const 0xFF)))
+          (then ${ssoCharWat('(local.get $hay)', '(local.get $k)')})
           (else (i32.load8_u (i32.add (local.get $hoff) (local.get $k))))))
         (local.set $nb (if (result i32) (local.get $nsso)
-          (then (i32.and (i32.shr_u (local.get $noff) (i32.shl (local.get $j) (i32.const 3))) (i32.const 0xFF)))
+          (then ${ssoCharWat('(local.get $ndl)', '(local.get $j)')})
           (else (i32.load8_u (i32.add (local.get $noff) (local.get $j))))))
         (if (i32.ne (local.get $hb) (local.get $nb))
           (then (local.set $match (i32.const 0)) (br $nomatch)))
@@ -729,8 +723,7 @@ export default (ctx) => {
     (local $hlen i32) (local $nlen i32) (local $i i32) (local $j i32) (local $match i32)
     (local $hoff i32) (local $noff i32)
     (local $hsso i32) (local $nsso i32) (local $hb i32) (local $nb i32) (local $k i32)
-    ;; ToString the search value (21.1.3.10 step 4)
-    (local.set $ndl (call $__to_str (local.get $ndl)))
+    ;; The search value is ToString'd at the call site (searchArg) per 21.1.3.10 step 4.
     (local.set $hlen (call $__str_byteLen (local.get $hay)))
     (local.set $nlen (call $__str_byteLen (local.get $ndl)))
     ;; Empty needle always matches at the clamp(from,0,hlen) position
@@ -760,10 +753,10 @@ export default (ctx) => {
         (br_if $nomatch (i32.ge_s (local.get $j) (local.get $nlen)))
         (local.set $k (i32.add (local.get $i) (local.get $j)))
         (local.set $hb (if (result i32) (local.get $hsso)
-          (then (i32.and (i32.shr_u (local.get $hoff) (i32.shl (local.get $k) (i32.const 3))) (i32.const 0xFF)))
+          (then ${ssoCharWat('(local.get $hay)', '(local.get $k)')})
           (else (i32.load8_u (i32.add (local.get $hoff) (local.get $k))))))
         (local.set $nb (if (result i32) (local.get $nsso)
-          (then (i32.and (i32.shr_u (local.get $noff) (i32.shl (local.get $j) (i32.const 3))) (i32.const 0xFF)))
+          (then ${ssoCharWat('(local.get $ndl)', '(local.get $j)')})
           (else (i32.load8_u (i32.add (local.get $noff) (local.get $j))))))
         (if (i32.ne (local.get $hb) (local.get $nb))
           (then (local.set $match (i32.const 0)) (br $nomatch)))
@@ -793,10 +786,10 @@ export default (ctx) => {
       (br_if $done (i32.ge_s (local.get $i) (local.get $plen)))
       (if (i32.ne
             (if (result i32) (local.get $ssso)
-              (then (i32.and (i32.shr_u (local.get $soff) (i32.shl (local.get $i) (i32.const 3))) (i32.const 0xFF)))
+              (then ${ssoCharWat('(local.get $str)', '(local.get $i)')})
               (else (i32.load8_u (i32.add (local.get $soff) (local.get $i)))))
             (if (result i32) (local.get $psso)
-              (then (i32.and (i32.shr_u (local.get $poff) (i32.shl (local.get $i) (i32.const 3))) (i32.const 0xFF)))
+              (then ${ssoCharWat('(local.get $pfx)', '(local.get $i)')})
               (else (i32.load8_u (i32.add (local.get $poff) (local.get $i))))))
         (then (return (i32.const 0))))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
@@ -824,10 +817,10 @@ export default (ctx) => {
       (local.set $k (i32.add (local.get $off) (local.get $i)))
       (if (i32.ne
             (if (result i32) (local.get $ssso)
-              (then (i32.and (i32.shr_u (local.get $soff) (i32.shl (local.get $k) (i32.const 3))) (i32.const 0xFF)))
+              (then ${ssoCharWat('(local.get $str)', '(local.get $k)')})
               (else (i32.load8_u (i32.add (local.get $soff) (local.get $k)))))
             (if (result i32) (local.get $fsso)
-              (then (i32.and (i32.shr_u (local.get $foff) (i32.shl (local.get $i) (i32.const 3))) (i32.const 0xFF)))
+              (then ${ssoCharWat('(local.get $sfx)', '(local.get $i)')})
               (else (i32.load8_u (i32.add (local.get $foff) (local.get $i))))))
         (then (return (i32.const 0))))
       (local.set $i (i32.add (local.get $i) (i32.const 1)))
@@ -849,9 +842,7 @@ export default (ctx) => {
       (then
         (block $dsso (loop $lsso
           (br_if $dsso (i32.ge_s (local.get $i) (local.get $len)))
-          (local.set $c (i32.and
-            (i32.shr_u (local.get $srcOff) (i32.shl (local.get $i) (i32.const 3)))
-            (i32.const 0xFF)))
+          (local.set $c ${ssoCharWat('(local.get $ptr)', '(local.get $i)')})
           (if (i32.and (i32.ge_u (local.get $c) (local.get $lo)) (i32.le_u (local.get $c) (local.get $hi)))
             (then (local.set $c (i32.add (local.get $c) (local.get $delta)))))
           (i32.store8 (i32.add (local.get $off) (local.get $i)) (local.get $c))
@@ -953,7 +944,7 @@ export default (ctx) => {
     ;; Array (type=1) → join(",") like JS Array.toString()
     (if (i32.eq (local.get $type) (i32.const ${PTR.ARRAY}))
       (then (return (i64.reinterpret_f64 (call $__str_join (local.get $val)
-        (i64.reinterpret_f64 (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT | 1}) (i32.const 44))))))))
+        (i64.reinterpret_f64 (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${ssoAux(1)}) (i32.const 44))))))))
     (local.get $val))`)
 
   // Copy bytes of a string (SSO or heap) into memory at dst. Uses memory.copy for
@@ -962,18 +953,15 @@ export default (ctx) => {
     (local $w i32)
     (if (i64.ne (i64.and (local.get $src) (i64.const ${SSO_BIT_I64})) (i64.const 0))
       (then
-        ;; SSO: up to 4 chars packed in low 32 bits (LE byte order). Unroll: write 1/2/3/4 bytes
-        ;; depending on len. (len > 4 is rare/disallowed in practice — fallback handles up to 4.)
-        (local.set $w (i32.wrap_i64 (local.get $src)))
-        (if (i32.ge_u (local.get $len) (i32.const 4))
-          (then (i32.store (local.get $dst) (local.get $w)))
-          (else
-            (if (i32.eq (local.get $len) (i32.const 0)) (then (return)))
-            (i32.store8 (local.get $dst) (local.get $w))
-            (if (i32.eq (local.get $len) (i32.const 1)) (then (return)))
-            (i32.store8 offset=1 (local.get $dst) (i32.shr_u (local.get $w) (i32.const 8)))
-            (if (i32.eq (local.get $len) (i32.const 2)) (then (return)))
-            (i32.store8 offset=2 (local.get $dst) (i32.shr_u (local.get $w) (i32.const 16))))))
+        ;; SSO: write $len ASCII chars, each 7-bit-packed at payload bit i*7 (chars 4-5
+        ;; span into aux, so read via the 7-bit codec, not the low 32 bits). $w = index.
+        (local.set $w (i32.const 0))
+        (loop $ssocp
+          (if (i32.lt_u (local.get $w) (local.get $len))
+            (then
+              (i32.store8 (i32.add (local.get $dst) (local.get $w)) ${ssoCharWat('(local.get $src)', '(local.get $w)')})
+              (local.set $w (i32.add (local.get $w) (i32.const 1)))
+              (br $ssocp)))))
       (else
         ;; Heap STRING: memory.copy directly from string data
         (memory.copy (local.get $dst)
@@ -1005,12 +993,12 @@ export default (ctx) => {
       (then
         (return (call $__mkptr
           (i32.const ${PTR.STRING})
-          (i32.or (i32.const ${LAYOUT.SSO_BIT}) (local.get $total))
+          (i32.or (i32.const ${LAYOUT.SSO_BIT}) (i32.shl (local.get $total) (i32.const ${SSO_LEN_SHIFT})))
           (i32.or
             (i32.wrap_i64 (i64.and (local.get $a) (i64.const 0xFFFFFFFF)))
             (i32.shl
               (i32.wrap_i64 (i64.and (local.get $b) (i64.const 0xFFFFFFFF)))
-              (i32.shl (local.get $alen) (i32.const 3))))))))`
+              (i32.mul (local.get $alen) (i32.const 7))))))))`
 
   const concatFast = !ctx.memory.shared && ctx.transform.alloc !== false ? `
     (local.set $ta (i32.wrap_i64 (i64.and (i64.shr_u (local.get $a) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
@@ -1075,19 +1063,17 @@ export default (ctx) => {
             (i32.wrap_i64 (i64.shr_u (local.get $a) (i64.const ${LAYOUT.AUX_SHIFT})))
             (i32.const ${LAYOUT.SSO_BIT})))
       (then
-        (local.set $alen (i32.and
-          (i32.wrap_i64 (i64.shr_u (local.get $a) (i64.const ${LAYOUT.AUX_SHIFT})))
-          (i32.const ${LAYOUT.SSO_BIT - 1})))
+        (local.set $alen ${ssoLenWat('(local.get $a)')})
         (if (i32.and
               (i32.lt_u (local.get $alen) (i32.const 4))
               (i32.lt_u (local.get $byte) (i32.const 0x80)))
           (then
             (return (call $__mkptr
               (i32.const ${PTR.STRING})
-              (i32.or (i32.const ${LAYOUT.SSO_BIT}) (i32.add (local.get $alen) (i32.const 1)))
+              (i32.or (i32.const ${LAYOUT.SSO_BIT}) (i32.shl (i32.add (local.get $alen) (i32.const 1)) (i32.const ${SSO_LEN_SHIFT})))
               (i32.or
                 (local.get $aoff)
-                (i32.shl (local.get $byte) (i32.shl (local.get $alen) (i32.const 3))))))))))
+                (i32.shl (local.get $byte) (i32.mul (local.get $alen) (i32.const 7))))))))))
     ;; Slow path: allocate new heap STRING with original bytes + 1 new byte
     (local.set $alen (call $__str_byteLen (local.get $a)))
     (local.set $total (i32.add (local.get $alen) (i32.const 1)))
@@ -1368,11 +1354,11 @@ export default (ctx) => {
               (then
                 (local.set $sb (i32.load8_u (i32.add (local.get $off) (local.get $i))))
                 (br_if $heap (i32.ge_u (local.get $sb) (i32.const 0x80)))
-                (local.set $sp (i32.or (local.get $sp) (i32.shl (local.get $sb) (i32.shl (local.get $i) (i32.const 3)))))
+                (local.set $sp (i32.or (local.get $sp) (i32.shl (local.get $sb) (i32.mul (local.get $i) (i32.const 7)))))
                 (local.set $i (i32.add (local.get $i) (i32.const 1)))
                 (br $pk))))
           (global.set $__heap (i32.sub (local.get $off) (i32.const 4)))
-          (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.or (i32.const ${LAYOUT.SSO_BIT}) (local.get $target)) (local.get $sp))))))` : ''}
+          (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.or (i32.const ${LAYOUT.SSO_BIT}) (i32.shl (local.get $target) (i32.const 10))) (local.get $sp))))))` : ''}
     (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (local.get $off)))`)
 
   // Base helpers (__sso_char/__str_char/__char_at/__str_byteLen) are referenced
@@ -1430,9 +1416,22 @@ export default (ctx) => {
   // covers string/number/null/undefined needles, but two cases need help here:
   // a BOOL rides the 0/1 carrier (→ "0"/"1" not "true"/"false"), and an OBJECT
   // needs compile-time ToPrimitive(string) (__to_str can't invoke user toString).
-  const searchArg = (search) =>
-    valTypeOf(search) === VAL.BOOL ? asI64(bool(search)) :
-    valTypeOf(search) === VAL.OBJECT ? toStrI64(search, emit(search)) : asI64(emit(search))
+  // Coerce the search operand to a string AT THE CALL SITE (21.1.3.x ToString step),
+  // so the `__str_indexof` family carries no embedded `__to_str`. A known-STRING arg
+  // (the overwhelmingly common `s.indexOf("x")` / `s.indexOf(t)` shape) passes raw —
+  // dropping the whole ToString → float-formatter dep tree (~4 KB) that an internal,
+  // unconditional coercion forced into every search-method program. Mirrors
+  // `stringSearchMethod` (startsWith/endsWith), which has always coerced here.
+  const searchArg = (search) => {
+    const vt = valTypeOf(search)
+    if (vt === VAL.STRING) return asI64(emit(search))
+    if (vt === VAL.BOOL) return asI64(bool(search))
+    if (vt === VAL.OBJECT) return toStrI64(search, emit(search))
+    inc('__to_str')
+    return ['call', '$__to_str', asI64(emit(search))]
+  }
+  // Replacement operand of .replace/.replaceAll — same call-site ToString as searchArg.
+  const strReplArg = searchArg
 
   bind('.string:indexOf', (str, search, from) => {
     inc('__str_indexof')
@@ -1573,9 +1572,14 @@ export default (ctx) => {
             asI64(tail)], 'f64')]]], 'f64')
     }
     inc('__str_replace')
-    return typed(['call', '$__str_replace', asI64(emit(str)), asI64(emit(search)), asI64(emit(repl))], 'f64')
+    // search/repl ToString'd at the call site (searchArg) — __str_replace's __str_indexof
+    // no longer coerces internally, so a non-string search must be stringified here.
+    return typed(['call', '$__str_replace', asI64(emit(str)), searchArg(search), strReplArg(repl)], 'f64')
+  })
+  bind('.replaceAll', (str, search, repl) => {
+    inc('__str_replaceall')
+    return typed(['call', '$__str_replaceall', asI64(emit(str)), searchArg(search), strReplArg(repl)], 'f64')
   })
-  bind('.replaceAll', method('__str_replaceall', 'III'))
 
   const caseMethod = (lo, hi, delta) => (str) => {
     inc('__str_case')
@@ -1592,7 +1596,7 @@ export default (ctx) => {
 
   const padMethod = (start) => (str, len, pad) => {
     inc('__str_pad')
-    const vpad = pad != null ? asI64(emit(pad)) : ['i64.reinterpret_f64', mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1, 32)]
+    const vpad = pad != null ? asI64(emit(pad)) : ['i64.reinterpret_f64', mkPtrIR(PTR.STRING, ssoAux(1), 32)]
     return typed(['call', '$__str_pad', asI64(emit(str)), asI32(emit(len)), vpad, ['i32.const', start]], 'f64')
   }
   bind('.padStart', padMethod(1))
@@ -1659,14 +1663,17 @@ export default (ctx) => {
   // index; otherwise `oobIR`. Without the bounds check `__char_at` returns 0 for an
   // out-of-range index, which would wrap to a bogus `"\x00"` string (charAt → "",
   // at → undefined). `sLocal` is the receiver as an f64 local.
-  const charAtOr = (sLocal, iLocal, lenIR, oobIR) =>
+  const charAtOr = (sLocal, iLocal, lenIR, oobIR) => (
+    inc('__char1byte'),
     ['if', ['result', 'f64'],
       ['i32.and',
         ['i32.ge_s', ['local.get', iLocal], ['i32.const', 0]],
         ['i32.lt_s', ['local.get', iLocal], lenIR]],
-      ['then', mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1,
-        ['call', '$__char_at', ['i64.reinterpret_f64', ['local.get', sLocal]], ['local.get', iLocal]])],
-      ['else', oobIR]]
+      // __char_at yields a raw byte (≥0x80 for non-ASCII heap strings) → __char1byte
+      // builds an SSO byte when ASCII, else a heap 1-byte string.
+      ['then', ['call', '$__char1byte',
+        ['call', '$__char_at', ['i64.reinterpret_f64', ['local.get', sLocal]], ['local.get', iLocal]]]],
+      ['else', oobIR]])
   const emptyStr = mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT, 0)
 
   // .charAt(i) → 1-char string at index i, or "" when out of range (JS spec: no
@@ -1713,13 +1720,27 @@ export default (ctx) => {
     return typed(['f64.reinterpret_i64', toStrI64(value, emit(value))], 'f64')
   })
 
+  // 1-byte string from a raw byte: SSO when ASCII (<0x80, fits the 7-bit codec),
+  // else a heap 1-byte string (the 7-bit SSO can't represent bytes ≥0x80).
+  wat('__char1byte', `(func $__char1byte (param $b i32) (result f64)
+    (local $off i32)
+    (local.set $b (i32.and (local.get $b) (i32.const 0xFF)))
+    (if (result f64) (i32.lt_u (local.get $b) (i32.const 0x80))
+      (then (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${ssoAux(1)}) (local.get $b)))
+      (else
+        (local.set $off (call $__alloc (i32.const 8)))
+        (i32.store (local.get $off) (i32.const 1))
+        (i32.store8 (i32.add (local.get $off) (i32.const 4)) (local.get $b))
+        (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (i32.add (local.get $off) (i32.const 4))))))`)
+
   // String.fromCharCode(...codes) — variadic; each arg is ToUint16(ToNumber(code))
   // → a 1-byte string, concatenated left to right (mirrors String.fromCodePoint).
   bind('String.fromCharCode', (...codes) => {
     if (codes.length === 0) return emit(['str', ''])
     // ToUint16(ToNumber(code)): `toNumF64` performs ToPrimitive on an object
-    // argument, so a throwing valueOf/toString propagates per spec.
-    const one = (node) => mkPtrIR(PTR.STRING, LAYOUT.SSO_BIT | 1, asI32(toNumF64(node, emit(node))))
+    // argument, so a throwing valueOf/toString propagates per spec. A byte ≥0x80
+    // can't be a 7-bit-ASCII SSO, so __char1byte routes it to a heap 1-byte string.
+    const one = (node) => { inc('__char1byte'); return typed(['call', '$__char1byte', asI32(toNumF64(node, emit(node)))], 'f64') }
     let r = one(codes[0])
     for (let i = 1; i < codes.length; i++) {
       inc('__str_concat_raw')
@@ -1742,27 +1763,41 @@ export default (ctx) => {
     (local.set $cp (i32.trunc_sat_f64_s (local.get $cpf)))
     ;; ASCII: 1 byte SSO
     (if (i32.lt_u (local.get $cp) (i32.const 128))
-      (then (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT | 1}) (local.get $cp)))))
-    ;; 2-byte: 0x80-0x7FF → SSO
+      (then (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${ssoAux(1)}) (local.get $cp)))))
+    ;; multi-byte (cp ≥ 0x80): UTF-8 bytes are ≥0x80 → can't be 7-bit ASCII SSO, so
+    ;; build a heap STRING (len header at $off, bytes at $off+4). Over-alloc to 8 so the
+    ;; i32.store of the packed bytes never runs past the buffer; the len word bounds reads.
+    ;; 2-byte: 0x80-0x7FF
     (if (i32.lt_u (local.get $cp) (i32.const 0x800))
-      (then (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT | 2})
-        (i32.or
-          (i32.or (i32.const 0xC0) (i32.shr_u (local.get $cp) (i32.const 6)))
-          (i32.shl (i32.or (i32.const 0x80) (i32.and (local.get $cp) (i32.const 0x3F))) (i32.const 8)))))))
-    ;; 3-byte: 0x800-0xFFFF → SSO (3 bytes fits)
+      (then
+        (local.set $off (call $__alloc (i32.const 8)))
+        (i32.store (local.get $off) (i32.const 2))
+        (i32.store (i32.add (local.get $off) (i32.const 4))
+          (i32.or
+            (i32.or (i32.const 0xC0) (i32.shr_u (local.get $cp) (i32.const 6)))
+            (i32.shl (i32.or (i32.const 0x80) (i32.and (local.get $cp) (i32.const 0x3F))) (i32.const 8))))
+        (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (i32.add (local.get $off) (i32.const 4))))))
+    ;; 3-byte: 0x800-0xFFFF
     (if (i32.lt_u (local.get $cp) (i32.const 0x10000))
-      (then (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT | 3})
-        (i32.or (i32.or
-          (i32.or (i32.const 0xE0) (i32.shr_u (local.get $cp) (i32.const 12)))
-          (i32.shl (i32.or (i32.const 0x80) (i32.and (i32.shr_u (local.get $cp) (i32.const 6)) (i32.const 0x3F))) (i32.const 8)))
-          (i32.shl (i32.or (i32.const 0x80) (i32.and (local.get $cp) (i32.const 0x3F))) (i32.const 16)))))))
-    ;; 4-byte: 0x10000-0x10FFFF → SSO (4 bytes fits)
-    (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const ${LAYOUT.SSO_BIT | 4})
+      (then
+        (local.set $off (call $__alloc (i32.const 8)))
+        (i32.store (local.get $off) (i32.const 3))
+        (i32.store (i32.add (local.get $off) (i32.const 4))
+          (i32.or (i32.or
+            (i32.or (i32.const 0xE0) (i32.shr_u (local.get $cp) (i32.const 12)))
+            (i32.shl (i32.or (i32.const 0x80) (i32.and (i32.shr_u (local.get $cp) (i32.const 6)) (i32.const 0x3F))) (i32.const 8)))
+            (i32.shl (i32.or (i32.const 0x80) (i32.and (local.get $cp) (i32.const 0x3F))) (i32.const 16))))
+        (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (i32.add (local.get $off) (i32.const 4))))))
+    ;; 4-byte: 0x10000-0x10FFFF
+    (local.set $off (call $__alloc (i32.const 8)))
+    (i32.store (local.get $off) (i32.const 4))
+    (i32.store (i32.add (local.get $off) (i32.const 4))
       (i32.or (i32.or (i32.or
         (i32.or (i32.const 0xF0) (i32.shr_u (local.get $cp) (i32.const 18)))
         (i32.shl (i32.or (i32.const 0x80) (i32.and (i32.shr_u (local.get $cp) (i32.const 12)) (i32.const 0x3F))) (i32.const 8)))
         (i32.shl (i32.or (i32.const 0x80) (i32.and (i32.shr_u (local.get $cp) (i32.const 6)) (i32.const 0x3F))) (i32.const 16)))
-        (i32.shl (i32.or (i32.const 0x80) (i32.and (local.get $cp) (i32.const 0x3F))) (i32.const 24))))))`)
+        (i32.shl (i32.or (i32.const 0x80) (i32.and (local.get $cp) (i32.const 0x3F))) (i32.const 24))))
+    (return (call $__mkptr (i32.const ${PTR.STRING}) (i32.const 0) (i32.add (local.get $off) (i32.const 4)))))`)
 
   // String.fromCodePoint(...codePoints) — variadic; each arg is ToNumber-coerced
   // then validated/encoded by __fromCodePoint, results concatenated left to right.