jz 0.7.0 → 0.8.0

package/src/compile/emit.js

@@ -26,6 +26,8 @@ import {
   hasOwnContinue, hasLabeledContinueTo, hasOwnBreakOrContinue, extractParams, classifyParam, JZ_UNDEF, TYPEOF,
 } from '../ast.js'
 import { ctx, err, inc, warnDeopt, PTR } from '../ctx.js'
+import { includeForStringOnly } from '../autoload.js'
+import { FITS_I32_MAX } from '../widen.js'
 import { nonNegIntLiteral, intLiteralValue, staticPropertyKey } from '../static.js'
 import { findFreeVars } from './analyze.js'
 import {
@@ -76,6 +78,29 @@ const stringOps = (node) => {
 // instead route through ToNumber (`toNumF64`), which performs ToPrimitive.
 const isI32Num = (v) => v.type === 'i32' && v.ptrKind == null
 
+// Peel an emitted operand back to its raw i32 value when it carries one: a value already
+// typed i32 (integer literals included — they emit as i32.const), or an integer read wrapped
+// in f64.convert_i32_s/u (typed-array / i32-global reads default to the f64 rep). Else null.
+const peelI32 = (v) =>
+  isI32Num(v) ? v
+    : (Array.isArray(v) && (v[0] === 'f64.convert_i32_s' || v[0] === 'f64.convert_i32_u'))
+      ? (Array.isArray(v[1]) ? typed(v[1], 'i32') : v[1])
+      : null
+
+// Native wrapping i32 arithmetic for `+`/`-`/`*` whose result is consumed as i32. Peels the
+// f64.convert_i32_s/u that integer reads (`DX[i]`, a global Int32Array) wrap their load in, so
+// `ax = ax + DX[i]` (ax and DX[i] both i32) lowers to one i32.add instead of the
+// convert → f64.add → trunc_sat round-trip that doubled hot integer loops (ulam's spiral walk,
+// ring-buffer indexing). Bit-identical for an i32 result: ToInt32(exact) ≡ two's-complement wrap.
+// Gated on exprType(whole expr)==='i32' so an f64-consumed sum — or an unsigned-wide (uint32)
+// operand, which exprType already reports as f64 — still widens. Returns null when inapplicable.
+const tryI32Arith = (wasmOp, astOp, a, b, va, vb) => {
+  const pa = peelI32(va); if (pa == null) return null
+  const pb = peelI32(vb); if (pb == null) return null
+  if (exprType([astOp, a, b], ctx.func.locals) !== 'i32') return null
+  return typed([wasmOp, pa, pb], 'i32')
+}
+
 // f64 arithmetic that can MINT a sign-nondeterministic NaN (0/0, ∞−∞, 0·∞, x%0): on x86
 // these are 0xFFF8…, on arm 0x7FF8…. sqrt/min/max/neg are NOT here — they canon at their
 // own emit (math.js / unary `-`), so they reach canonNum already canonical.
@@ -136,7 +161,27 @@ const widensUnsigned = (v) => v.unsigned && !v.wrapSafe
 // so the inner per-op canon (local.set + select + f64.ne, ~3 ops) is dead on the
 // critical path. This is THE gap that put sqrt-heavy kernels ~23% behind V8
 // (julia/raymarcher/boids); stripping it makes them match native JS.
-const stripCanon = (v) => (v && v.canonOf != null) ? typed(v.canonOf, 'f64') : v
+const stripCanon = (v) => {
+  if (!v) return v
+  if (v.canonOf != null) return typed(v.canonOf, 'f64')
+  // A NaN-canon nested in the VALUE arm of a `select` / `(if result f64)` is equally
+  // dead: the consumer that called stripCanon (f64.add/sub/mul/div, or a math call)
+  // propagates the NaN identically and the outermost escape re-canon-izes. Recurse into
+  // the arms so `(cond ? x : -x) + v` (the Perlin-gradient sign-select, and every other
+  // conditional negation) drops the per-neg select+f64.ne, same as a bare `x + -y`.
+  if (Array.isArray(v)) {
+    if (v[0] === 'select' && v.length === 4) {
+      const a = stripCanon(v[1]), b = stripCanon(v[2])
+      if (a !== v[1] || b !== v[2]) return typed(['select', a, b, v[3]], 'f64')
+    } else if (v[0] === 'if' && Array.isArray(v[1]) && v[1][0] === 'result' && v[1][1] === 'f64'
+               && Array.isArray(v[3]) && v[3][0] === 'then' && v[3].length === 2
+               && Array.isArray(v[4]) && v[4][0] === 'else' && v[4].length === 2) {
+      const t = stripCanon(v[3][1]), e = stripCanon(v[4][1])
+      if (t !== v[3][1] || e !== v[4][1]) return typed(['if', v[1], v[2], ['then', t], ['else', e]], 'f64')
+    }
+  }
+  return v
+}
 
 const FIRST_CLASS_UNARY_MATH = {
   'math.abs': 'f64.abs',
@@ -177,10 +222,17 @@ const emitNeg = (a) => {
   // flipped NaN reads as a tagged value (truthy / not-NaN). Fold any NaN result back
   // to canonical — the same invariant math.sqrt/min/max keep via `canon` (module/math.js).
   const t = temp('ng')
-  return typed(['block', ['result', 'f64'],
-    ['local.set', `$${t}`, ['f64.neg', toNumF64(a, v)]],
+  const raw = ['f64.neg', toNumF64(a, v)]
+  const ir = typed(['block', ['result', 'f64'],
+    ['local.set', `$${t}`, raw],
     ['select', ['f64.const', 'nan'], ['local.get', `$${t}`],
       ['f64.ne', ['local.get', `$${t}`], ['local.get', `$${t}`]]]], 'f64')
+  // Tag the un-canon'd `f64.neg` so a NaN-propagating consumer (f64.add/sub/mul/div, which
+  // canon-ize on their OWN escape) strips this redundant inner canon — same contract as the
+  // sqrt/min/max canons in math.js. A bare `x * -y` / `a - -b` then drops the per-neg
+  // select + f64.ne instead of carrying it into the multiply/add.
+  ir.canonOf = raw
+  return ir
 }
 
 /** Try constant-folding binary arith: returns emitNum(result) or null. */
@@ -194,20 +246,38 @@ const foldConst = (va, vb, fn, guard) =>
 
 // JS `*` is an f64 multiply; `i32.mul` yields only the exact product mod 2^32.
 // Those agree under a ToInt32/ToUint32 sink (and as plain numbers) while the
-// exact product stays f64-exact, i.e. |product| <= 2^53. Two i32 operands can
-// reach 2^62, so `i32.mul` is sound only when one side is bounded small enough
-// that, against the full i32 range (2^31) of the other, the product holds within
-// 2^53 — i.e. its magnitude <= 2^22. A literal qualifies directly; so does a
-// masked operand (`x & 63`, `x >>> k`) whose value is provably bounded. Keeps
-// index arithmetic (`i*4`) and bitwise-masked scales (bytebeat's `t*(m&63)`) on
-// `i32.mul` while routing hash-mix-scale products to `f64.mul`.
-const FITS_I32_MAX = 0x400000  // 2^22 — see derivation above
+// exact product stays f64-exact. A literal qualifies directly; so does a masked
+// operand (`x & 63`, `x >>> k`) whose value is provably bounded. Keeps index
+// arithmetic (`i*4`) and bitwise-masked scales (bytebeat's `t*(m&63)`) on
+// `i32.mul` while routing hash-mix-scale products to `f64.mul`. The FITS_I32_MAX
+// threshold (and the soundness contract with type.js exprType) lives in widen.js.
 const mulFitsI32 = (va, vb) =>
   (isLit(va) && Math.abs(litVal(va)) <= FITS_I32_MAX) ||
   (isLit(vb) && Math.abs(litVal(vb)) <= FITS_I32_MAX) ||
   (!isLit(va) && maskBound(va) <= FITS_I32_MAX) ||
   (!isLit(vb) && maskBound(vb) <= FITS_I32_MAX)
 
+// Max |value| of an i32-typed operand from a narrowing typed-array load width — the
+// element-read twin of maskBound's `x & 0xff` case (load8_u and `x & 0xff` carry the
+// SAME [0,255] range). Infinity when the magnitude is unbounded. Signed loads reach
+// −2^(w−1), so the magnitude bound is 2^(w−1).
+const I32_LOAD_MAG = { 'i32.load8_s': 128, 'i32.load8_u': 255, 'i32.load16_s': 32768, 'i32.load16_u': 65535 }
+const i32Mag = (v) =>
+  !Array.isArray(v) ? Infinity :
+  v[0] in I32_LOAD_MAG ? I32_LOAD_MAG[v[0]] :
+  (v[0] === 'i32.const' && typeof v[1] === 'number') ? Math.abs(v[1]) :
+  (v[0] === 'i32.and' || v[0] === 'i32.shr_u') ? maskBound(v) :
+  Infinity
+// `int8[i]*int8[j]` and friends: a product of two range-bounded integer typed-array
+// elements whose magnitudes multiply to ≤ 2^31−1 is FAITHFUL as i32.mul — the exact
+// product fits signed i32, so i32.mul == the true value in EVERY consumer context
+// (i32 sink AND f64 value), independent of the widen pass. Covers i8/u8/i16 pairs and
+// i16×u16 (32768·65535 < 2^31); correctly EXCLUDES u16×u16 (65535² > 2^31). JS `*` of
+// two such reads — the int-conv / correlation / quantised-MAC kernel shape — then rides
+// the i32 ABI (one op, no f64 round-trip) on V8 / JSC / wasmtime alike, and the i32
+// product is lane-vectorizable where the f64 form was not.
+const mulBoundedFaithful = (va, vb) => i32Mag(va) * i32Mag(vb) <= 0x7fffffff
+
 /** Emit typeof comparison: typeof x == typeCode → type-aware check. */
 export function emitTypeofCmp(a, b, cmpOp) {
   let typeofExpr, code
@@ -372,6 +442,27 @@ function tryI32Index(e) {
 }
 export const emitIndex = (idx) => tryI32Index(idx) ?? asI32(emit(idx))
 
+/**
+ * True when `e` is a pure integer `+`/`-`/`*` tree whose leaves are all i32-typed
+ * names/globals or integer literals — no calls, member reads, or indexed reads, so
+ * emitting it twice (or in a different rep) is side-effect-free. Used to recognise
+ * an i32-local initializer that `tryI32Index` can lower to native wrapping i32
+ * arithmetic instead of the f64 round-trip (`convert … f64.mul/add … trunc_sat`).
+ * The same residue-mod-2^32 argument as `tryI32Index`: ToInt32 of the exact integer
+ * value equals two's-complement wrapping i32, so for an i32 destination the two are
+ * bit-identical — even when an intermediate product overflows.
+ */
+function isI32ArithTree(e) {
+  if (typeof e === 'number') return Number.isInteger(e)
+  if (typeof e === 'string') return exprType(e, ctx.func.locals) === 'i32'
+  if (!Array.isArray(e)) return false
+  const op = e[0]
+  if (op == null) return isI32ArithTree(e[1])                 // literal wrapper [, v]
+  if ((op === '+' || op === '-' || op === '*') && e[2] != null)
+    return isI32ArithTree(e[1]) && isI32ArithTree(e[2])
+  return false
+}
+
 function emitSingleCharIndexCmp(a, b, negate = false) {
   const leftLit = stringLiteral(a)
   const rightLit = stringLiteral(b)
@@ -1080,6 +1171,12 @@ export function emitDecl(...inits) {
         updateRep(name, { ptrAux: val.closureFuncIdx })
       coerced = val.ptrKind === ptrKind ? val
         : typed(['i32.wrap_i64', ['i64.reinterpret_f64', asF64(val)]], 'i32')
+    } else if (localType === 'i32' && val.type !== 'i32' && isI32ArithTree(init)) {
+      // Integer index feeder (`let idx = py*W + qx`) bound to an i32 local: compute
+      // it in native wrapping i32 instead of the f64 round-trip + trunc_sat. Bit-
+      // identical for an i32 destination (ToInt32 ≡ two's-complement wrap), and the
+      // i32.mul is hoistable when loop-invariant. Falls back to toI32 defensively.
+      coerced = tryI32Index(init) ?? toI32(val)
     } else {
       coerced = localType === 'v128' ? val : localType === 'f64' ? asF64(val) : val.type === 'i32' ? val : toI32(val)
     }
@@ -1136,12 +1233,22 @@ function emitSpreadCopy(dest, posLocal, srcLocal, srcLenLocal, staticVT) {
     const sidx = `${T}sidx${ctx.func.uniq++}`
     ctx.func.locals.set(sidx, 'i32')
     const loopId = ctx.func.uniq++
-    const elem = ctx.module.modules['string']
-      ? ['if', ['result', 'f64'],
+    // When the source is statically known to be a typed array, __typed_idx suffices.
+    // Otherwise (STRING, or unknown type whose runtime value may be a string) dispatch on
+    // ptr_type: STRING→__str_idx, else→__typed_idx.
+    // The old gate (ctx.module.modules['string']) was wrong: for `[...s]` with an untyped
+    // param the string module is never loaded, so __typed_idx was used for strings —
+    // __typed_idx calls __len which returns 0 for strings, making i>=len always true and
+    // storing UNDEF into every element slot. Pull in the string module here so __str_idx
+    // is registered before inc() adds it to the dependency set.
+    const elem = staticVT === VAL.TYPED
+      ? (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])
+      : (includeForStringOnly(),
+        ['if', ['result', 'f64'],
           ['i32.eq', ['call', '$__ptr_type', srcI64()], ['i32.const', PTR.STRING]],
           ['then', (inc('__str_idx'), ['call', '$__str_idx', srcI64(), ['local.get', `$${sidx}`]])],
-          ['else', (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])]]
-      : (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])
+          ['else', (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])]
+        ])
     // Reset the counter on each entry — WASM zeroes locals once at function
     // entry, but this loop re-executes when the spread sits inside a JS loop;
     // a stale `sidx` (= prior srcLen) would skip the copy entirely.
@@ -1243,8 +1350,25 @@ export function buildArrayWithSpreads(items) {
       // emitSpreadCopy resolve its kind at runtime via its one-time __ptr_type branch.
       sec.val = n ? undefined : valTypeOf(srcExpr)
       ir.push(['local.set', `$${sec.local}`, n ? materializeMulti(sec.expr) : asF64(emit(srcExpr))])
-      // Cache __len once per spread; reused below for total-len sum and the copy.
-      ir.push(['local.set', `$${sec.lenLocal}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]]])
+      // Cache the source length once per spread (reused for the total-len sum and the
+      // copy). `__len` is ARRAY/typed length — WRONG for a STRING (returns 0, so `[...str]`
+      // spreads an empty array). Pick the length to MATCH emitSpreadCopy's element decode:
+      // a known string counts chars (__str_len, paired with the __str_idx per-char copy); a
+      // statically-unknown source — `[...x]` / `[...fnParam]`, the compiler's own
+      // `[...key]` — dispatches once at runtime (STRING→__str_len, else→__len), mirroring
+      // emitSpreadCopy's ARRAY-vs-scalar branch. (Not __length: its `off>=8` guard returns
+      // undefined for host/static typed arrays.) Known array/typed/multi keep plain __len.
+      const srcI64 = () => ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]
+      const lenIR = sec.val === VAL.STRING
+        ? (inc('__str_len'), ['call', '$__str_len', srcI64()])
+        : (sec.val === VAL.ARRAY || sec.val === VAL.TYPED || n)
+          ? (inc('__len'), ['call', '$__len', srcI64()])
+          : (inc('__str_len', '__len', '__ptr_type'),
+            ['if', ['result', 'i32'],
+              ['i32.eq', ['call', '$__ptr_type', srcI64()], ['i32.const', PTR.STRING]],
+              ['then', ['call', '$__str_len', srcI64()]],
+              ['else', ['call', '$__len', srcI64()]]])
+      ir.push(['local.set', `$${sec.lenLocal}`, lenIR])
     }
   }
 
@@ -1387,6 +1511,48 @@ const STRICT_PRIM = new Set([VAL.NUMBER, VAL.BOOL, VAL.STRING, VAL.BIGINT])
 const nullableOperand = (n) =>
   typeof n === 'string' && !!(repOf(n)?.nullable || repOfGlobal(n)?.nullable)
 
+// An emitted value whose bit pattern is an i32, paired with how it widens to f64: a
+// `f64.convert_i32_s/u(x)` peels to its i32 source `x`; a bare i32 widens signed. Used to compare
+// two integer-backed operands directly in i32 instead of widening both to f64.
+const peelIntCmp = (v) => {
+  if (Array.isArray(v) && (v[0] === 'f64.convert_i32_s' || v[0] === 'f64.convert_i32_u'))
+    return { src: Array.isArray(v[1]) ? typed(v[1], 'i32') : v[1], sign: v[0] === 'f64.convert_i32_u' ? 'u' : 's' }
+  if (v && v.type === 'i32') return { src: v, sign: 's' }
+  return null
+}
+// The value's top bit is provably 0 (so its signed and unsigned readings agree): a u8/u16 load,
+// `>>>` (always clears the sign bit), `& m` with m a non-negative small const, or a small const.
+const i32TopBitClear = (n) => {
+  if (typeof n === 'number') return n >= 0 && n < 0x80000000
+  if (!Array.isArray(n)) return false
+  if (n[0] == null) return typeof n[1] === 'number' && n[1] >= 0 && n[1] < 0x80000000
+  if (n[0] === 'i32.load8_u' || n[0] === 'i32.load16_u') return true
+  if (n[0] === 'i32.const') return typeof n[1] === 'number' ? (n[1] >= 0 && n[1] < 0x80000000) : false
+  if (n[0] === 'i32.shr_u' || n[0] === '>>>') return true
+  if (n[0] === 'i32.and' || n[0] === '&') return i32TopBitClear(n[1]) || i32TopBitClear(n[2])
+  return false
+}
+// i32.eq/ne over the peeled sources equals the f64-widened compare when the signs match, or — for
+// a mixed signed/unsigned pair — when the unsigned-read source is top-bit-clear (then both readings
+// of equal bits agree, and unequal bits stay unequal under both).
+const i32EqSound = (pa, pb) => pa.sign === pb.sign ||
+  i32TopBitClear((pa.sign === 'u' ? pa : pb).src)
+
+// A memory-free, trap-free, side-effect-free expression — safe to evaluate UNCONDITIONALLY (as a
+// `select` arm does) and cheap enough that doing so never loses to a branch. Locals/consts and
+// arithmetic/bitwise/compare/logical over them. Excludes loads (`[]`, may read OOB when the guard
+// was protecting the access), calls, `.`/`?.` (dispatch), `/` `%` (int trap on 0), assignments.
+const CHEAP_PURE_OPS = new Set(['+', '-', '*', 'u-', 'u+', '&', '|', '^', '<<', '>>', '>>>', '~',
+  '<', '<=', '>', '>=', '==', '!=', '===', '!==', '&&', '||', '!', '?:'])
+const isCheapPureVal = (n) => {
+  if (typeof n === 'string' || typeof n === 'number') return true
+  if (!Array.isArray(n)) return false
+  if (n[0] == null) return true                              // boxed literal [, v]
+  if (n[0] === 'local.get') return true
+  if (CHEAP_PURE_OPS.has(n[0])) { for (let i = 1; i < n.length; i++) if (!isCheapPureVal(n[i])) return false; return true }
+  return false
+}
+
 function emitLooseEq(a, b, negate) {
   const eqOp = negate ? 'ne' : 'eq'
   const sentinel = emitNum(negate ? 1 : 0)
@@ -1405,6 +1571,12 @@ function emitLooseEq(a, b, negate) {
   const tc = emitTypeofCmp(a, b, eqOp); if (tc) return tc
   const va = emit(a), vb = emit(b)
   if (va.type === 'i32' && vb.type === 'i32') return typed([`i32.${eqOp}`, va, vb], 'i32')
+  // Both operands integer-backed (e.g. an i32 local vs a `b[j]` u8 read materialized as f64):
+  // compare the i32 sources directly, skipping the per-op widen to f64. Recovers `intElem ===
+  // intElem` in hot loops (levenshtein's DP cell, where `a[i-1] === b[j-1]` was an f64.eq + 2
+  // converts every iteration). Sound only when the widen can't change the answer (see i32EqSound).
+  const pa = peelIntCmp(va), pb = peelIntCmp(vb)
+  if (pa && pb && i32EqSound(pa, pb)) return typed([`i32.${eqOp}`, pa.src, pb.src], 'i32')
   // Either side known-pure NUMBER (literal or typed) → f64.eq/ne is correct regardless
   // of the other side: jz's `==` is strict (prepare.js:868), and every NaN-boxed pointer
   // reinterprets to a quiet NaN (0x7FF8… prefix) so f64.eq with any normal float is false.
@@ -1425,6 +1597,43 @@ function emitLooseEq(a, b, negate) {
   if (vta && vta === vtb && REF_EQ_KINDS.has(vta)) {
     return typed([`i64.${eqOp}`, ['i64.reinterpret_f64', asF64(va)], ['i64.reinterpret_f64', asF64(vb)]], 'i32')
   }
+  // String-equality specialization — the hot `node[0] === 'literal'` AST-tag dispatch,
+  // the compiler's single most-emitted comparison (5579 of its 6487 __eq sites). When one
+  // side is statically a STRING, skip the generic __eq NaN-box dispatch (the #1 self-host
+  // hot helper). jz's ==/=== never coerce (number-vs-string is false in __eq), so this is
+  // sound for both. Two shapes by what the OTHER side is known to be:
+  //   both STRING        → __str_eq directly (no number/NaN/tag test needed at all).
+  //   STRING vs unknown  → i64.eq fast ? equal : (__is_str_key(u) ? __str_eq : not-equal).
+  // Soundness of the fast path: the known string is a non-NaN STRING NaN-box, so a bit
+  // match can ONLY be that same string (a normal f64 can't alias those bits). On bit
+  // MISMATCH the unknown can still content-match — a heap string from `'i'+'f'` shares
+  // content but not bits — so the fallback __str_eq stays (pure i64.eq is unsound here).
+  // __is_str_key rejects the number-whose-bits-alias-the-STRING-tag case that a bare
+  // __ptr_type would misroute into a wild __str_eq deref (see __eq's own guard).
+  // INLINED (not a helper call): a single $__str_eq_lit helper measured 2.4% slower on
+  // the corpus — V8 keeps the call at the hot miss path; inlining lets the optimizer fold
+  // __is_str_key/__str_eq's prefix in, which is where the tag dispatch spends its time.
+  // Behaviorally identical to __eq when one side is a string — proven by a 4584-case
+  // spec-on/spec-off differential (zero divergence at optimize 0 and 2).
+  const strEqResult = (r) => negate ? typed(['i32.eqz', r], 'i32') : r
+  const aStr = rawA === VAL.STRING, bStr = rawB === VAL.STRING
+  if (aStr && bStr) {
+    inc('__str_eq')
+    return strEqResult(typed(['call', '$__str_eq', asI64(va), asI64(vb)], 'i32'))
+  }
+  if ((bStr && rawA == null) || (aStr && rawB == null)) {
+    const uVal = bStr ? va : vb, lVal = bStr ? vb : va   // u: unknown side, l: known string
+    inc('__is_str_key', '__str_eq')
+    const u = tempI64('seq'), l = tempI64('seq'), uG = ['local.get', `$${u}`], lG = ['local.get', `$${l}`]
+    return strEqResult(typed(['block', ['result', 'i32'],
+      ['local.set', `$${u}`, asI64(uVal)],
+      ['local.set', `$${l}`, asI64(lVal)],
+      ['if', ['result', 'i32'], ['i64.eq', uG, lG],
+        ['then', ['i32.const', 1]],
+        ['else', ['if', ['result', 'i32'], ['call', '$__is_str_key', uG],
+          ['then', ['call', '$__str_eq', uG, lG]],
+          ['else', ['i32.const', 0]]]]]], 'i32'))
+  }
   inc('__eq')
   const call = typed(['call', '$__eq', asI64(va), asI64(vb)], 'i32')
   return negate ? typed(['i32.eqz', call], 'i32') : call
@@ -1696,6 +1905,13 @@ function emitSpreadElementLoop(spreadExpr, bodyFn, { reverse = false } = {}) {
   ]
 }
 
+function emitAsValue(fn) {
+  const prev = ctx.func._expect
+  ctx.func._expect = null
+  try { return fn() }
+  finally { ctx.func._expect = prev }
+}
+
 function emitSingleSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   const inPlace = SPREAD_MUTATORS.has(method)
   // unshift prepends each arg to the front — forward iteration reverses intent.
@@ -1704,11 +1920,11 @@ function emitSingleSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   ctx.func.locals.set(acc, 'f64')
   const ir = [['local.set', `$${acc}`, asF64(emit(objArg))]]
   if (parsed.normal.length > 0) {
-    const r = asF64(methodEmitter(objArg, ...parsed.normal))
+    const r = asF64(emitAsValue(() => methodEmitter(objArg, ...parsed.normal)))
     ir.push(inPlace ? ['drop', r] : ['local.set', `$${acc}`, r])
   }
   ir.push(...emitSpreadElementLoop(parsed.spreads[0].expr, (arr, idx) => {
-    const body = asF64(methodEmitter(inPlace ? objArg : acc, ['[]', arr, idx]))
+    const body = asF64(emitAsValue(() => methodEmitter(inPlace ? objArg : acc, ['[]', arr, idx])))
     return [inPlace ? ['drop', body] : ['local.set', `$${acc}`, body]]
   }, { reverse }))
   ir.push(inPlace ? asF64(emit(objArg)) : ['local.get', `$${acc}`])
@@ -1730,7 +1946,7 @@ function emitMultiSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   let batch = []
   const flushBatch = () => {
     if (!batch.length) return
-    const r = asF64(methodEmitter(recv, ...batch))
+    const r = asF64(emitAsValue(() => methodEmitter(recv, ...batch)))
     ir.push(inPlace ? ['drop', r] : ['local.set', `$${acc}`, r])
     batch = []
   }
@@ -1738,7 +1954,7 @@ function emitMultiSpreadMethodCall(objArg, parsed, method, methodEmitter) {
     if (Array.isArray(item) && item[0] === '__spread') {
       flushBatch()
       ir.push(...emitSpreadElementLoop(item[1], (arr, idx) => {
-        const body = asF64(methodEmitter(recv, ['[]', arr, idx]))
+        const body = asF64(emitAsValue(() => methodEmitter(recv, ['[]', arr, idx])))
         return [inPlace ? ['drop', body] : ['local.set', `$${acc}`, body]]
       }))
     } else {
@@ -1815,7 +2031,7 @@ function tryCharCodeAtFast(callee, obj, method, parsed) {
       return typed(['call', '$__jss_charCodeAt', recv, asI32(emit(parsed.normal[0]))], 'i32')
     }
     return typed(stringOps(obj).charCodeAt(
-      asF64(recv), asI32(emit(parsed.normal[0])), ctx, false), 'i32')
+      asF64(recv), asI32(emit(parsed.normal[0])), ctx, false, true), 'i32')
   }
 }
 
@@ -2661,6 +2877,7 @@ export const emitter = {
     // op whose result can exceed i32, so `i32.add` would wrap (4294967295+1→0).
     // Widen to f64 — never wrap — matching spec. Only `>>>0`/`|0`/imul wrap.
     if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.add', va, vb], 'i32')
+    const i32add = tryI32Arith('i32.add', '+', a, b, va, vb); if (i32add) return i32add
     return typed(['f64.add', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '-': (a, b) => {
@@ -2676,6 +2893,7 @@ export const emitter = {
     // Unsigned uint32 operand: JS `-` is float (can go negative / exceed i32),
     // so avoid the wrapping i32.sub fast-path. See `+` above.
     if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.sub', va, vb], 'i32')
+    const i32sub = tryI32Arith('i32.sub', '-', a, b, va, vb); if (i32sub) return i32sub
     return typed(['f64.sub', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   'u+': a => {
@@ -2705,7 +2923,8 @@ export const emitter = {
     if (isLit(va) && litVal(va) === 0 && finiteFactor(vb)) return isLit(vb) ? va : typed(['block', ['result', va.type], vb, 'drop', va], va.type)
     // `.unsigned` operand is a uint32 ([0, 2^32)); its product can exceed i32, so
     // `i32.mul` would wrap ((2^32-1)*2 → -2). Widen to f64 — see `+` above.
-    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb) && mulFitsI32(va, vb)) return typed(['i32.mul', va, vb], 'i32')
+    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb) && (mulFitsI32(va, vb) || mulBoundedFaithful(va, vb))) return typed(['i32.mul', va, vb], 'i32')
+    const i32mul = tryI32Arith('i32.mul', '*', a, b, va, vb); if (i32mul) return i32mul
     return typed(['f64.mul', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '/': (a, b) => {
@@ -3075,6 +3294,17 @@ export const emitter = {
       if (els != null) return emitVoid(els)
       return null
     }
+    // If-conversion (speed tier): `if (cond) x = <cheap pure value>` (no else) → `x = cond ? value
+    // : x`, which lowers to a branchless `select`. Removes the data-dependent branch (and its
+    // misprediction) from min/max/clamp reductions — e.g. levenshtein's `if (ins < m) m = ins`,
+    // ~27% faster. Gated to the same speed tier as boolConvertToSelect (the select latency/size
+    // trade). Restricted to a plain assignment of a memory-/trap-free expr to a simple local, so
+    // the unconditional false-case eval is free and identical in effect.
+    if (els == null && ctx.transform.optimize?.boolConvertToSelect && isCheapPureVal(cond)) {
+      const asg = Array.isArray(then) && then[0] === ';' && then.length === 2 ? then[1] : then
+      if (Array.isArray(asg) && asg[0] === '=' && typeof asg[1] === 'string' && isCheapPureVal(asg[2]))
+        return emitVoid(['=', asg[1], ['?:', cond, asg[2], asg[1]]])   // cond cheap-pure → re-emit is free
+    }
     const c = ce.type === 'i32' ? ce : toBoolFromEmitted(ce)
     // Flow-sensitive type refinement: narrow types within each branch based on the guard.
     const thenRefs = extractRefinements(cond, new Map(), true)