jz 0.7.0 → 0.8.1

package/src/compile/emit.js

@@ -26,6 +26,8 @@ import {
   hasOwnContinue, hasLabeledContinueTo, hasOwnBreakOrContinue, extractParams, classifyParam, JZ_UNDEF, TYPEOF,
 } from '../ast.js'
 import { ctx, err, inc, warnDeopt, PTR } from '../ctx.js'
+import { includeForStringOnly } from '../autoload.js'
+import { FITS_I32_MAX } from '../widen.js'
 import { nonNegIntLiteral, intLiteralValue, staticPropertyKey } from '../static.js'
 import { findFreeVars } from './analyze.js'
 import {
@@ -76,6 +78,29 @@ const stringOps = (node) => {
 // instead route through ToNumber (`toNumF64`), which performs ToPrimitive.
 const isI32Num = (v) => v.type === 'i32' && v.ptrKind == null
 
+// Peel an emitted operand back to its raw i32 value when it carries one: a value already
+// typed i32 (integer literals included — they emit as i32.const), or an integer read wrapped
+// in f64.convert_i32_s/u (typed-array / i32-global reads default to the f64 rep). Else null.
+const peelI32 = (v) =>
+  isI32Num(v) ? v
+    : (Array.isArray(v) && (v[0] === 'f64.convert_i32_s' || v[0] === 'f64.convert_i32_u'))
+      ? (Array.isArray(v[1]) ? typed(v[1], 'i32') : v[1])
+      : null
+
+// Native wrapping i32 arithmetic for `+`/`-`/`*` whose result is consumed as i32. Peels the
+// f64.convert_i32_s/u that integer reads (`DX[i]`, a global Int32Array) wrap their load in, so
+// `ax = ax + DX[i]` (ax and DX[i] both i32) lowers to one i32.add instead of the
+// convert → f64.add → trunc_sat round-trip that doubled hot integer loops (ulam's spiral walk,
+// ring-buffer indexing). Bit-identical for an i32 result: ToInt32(exact) ≡ two's-complement wrap.
+// Gated on exprType(whole expr)==='i32' so an f64-consumed sum — or an unsigned-wide (uint32)
+// operand, which exprType already reports as f64 — still widens. Returns null when inapplicable.
+const tryI32Arith = (wasmOp, astOp, a, b, va, vb) => {
+  const pa = peelI32(va); if (pa == null) return null
+  const pb = peelI32(vb); if (pb == null) return null
+  if (exprType([astOp, a, b], ctx.func.locals) !== 'i32') return null
+  return typed([wasmOp, pa, pb], 'i32')
+}
+
 // f64 arithmetic that can MINT a sign-nondeterministic NaN (0/0, ∞−∞, 0·∞, x%0): on x86
 // these are 0xFFF8…, on arm 0x7FF8…. sqrt/min/max/neg are NOT here — they canon at their
 // own emit (math.js / unary `-`), so they reach canonNum already canonical.
@@ -136,7 +161,27 @@ const widensUnsigned = (v) => v.unsigned && !v.wrapSafe
 // so the inner per-op canon (local.set + select + f64.ne, ~3 ops) is dead on the
 // critical path. This is THE gap that put sqrt-heavy kernels ~23% behind V8
 // (julia/raymarcher/boids); stripping it makes them match native JS.
-const stripCanon = (v) => (v && v.canonOf != null) ? typed(v.canonOf, 'f64') : v
+const stripCanon = (v) => {
+  if (!v) return v
+  if (v.canonOf != null) return typed(v.canonOf, 'f64')
+  // A NaN-canon nested in the VALUE arm of a `select` / `(if result f64)` is equally
+  // dead: the consumer that called stripCanon (f64.add/sub/mul/div, or a math call)
+  // propagates the NaN identically and the outermost escape re-canon-izes. Recurse into
+  // the arms so `(cond ? x : -x) + v` (the Perlin-gradient sign-select, and every other
+  // conditional negation) drops the per-neg select+f64.ne, same as a bare `x + -y`.
+  if (Array.isArray(v)) {
+    if (v[0] === 'select' && v.length === 4) {
+      const a = stripCanon(v[1]), b = stripCanon(v[2])
+      if (a !== v[1] || b !== v[2]) return typed(['select', a, b, v[3]], 'f64')
+    } else if (v[0] === 'if' && Array.isArray(v[1]) && v[1][0] === 'result' && v[1][1] === 'f64'
+               && Array.isArray(v[3]) && v[3][0] === 'then' && v[3].length === 2
+               && Array.isArray(v[4]) && v[4][0] === 'else' && v[4].length === 2) {
+      const t = stripCanon(v[3][1]), e = stripCanon(v[4][1])
+      if (t !== v[3][1] || e !== v[4][1]) return typed(['if', v[1], v[2], ['then', t], ['else', e]], 'f64')
+    }
+  }
+  return v
+}
 
 const FIRST_CLASS_UNARY_MATH = {
   'math.abs': 'f64.abs',
@@ -177,10 +222,17 @@ const emitNeg = (a) => {
   // flipped NaN reads as a tagged value (truthy / not-NaN). Fold any NaN result back
   // to canonical — the same invariant math.sqrt/min/max keep via `canon` (module/math.js).
   const t = temp('ng')
-  return typed(['block', ['result', 'f64'],
-    ['local.set', `$${t}`, ['f64.neg', toNumF64(a, v)]],
+  const raw = ['f64.neg', toNumF64(a, v)]
+  const ir = typed(['block', ['result', 'f64'],
+    ['local.set', `$${t}`, raw],
     ['select', ['f64.const', 'nan'], ['local.get', `$${t}`],
       ['f64.ne', ['local.get', `$${t}`], ['local.get', `$${t}`]]]], 'f64')
+  // Tag the un-canon'd `f64.neg` so a NaN-propagating consumer (f64.add/sub/mul/div, which
+  // canon-ize on their OWN escape) strips this redundant inner canon — same contract as the
+  // sqrt/min/max canons in math.js. A bare `x * -y` / `a - -b` then drops the per-neg
+  // select + f64.ne instead of carrying it into the multiply/add.
+  ir.canonOf = raw
+  return ir
 }
 
 /** Try constant-folding binary arith: returns emitNum(result) or null. */
@@ -194,20 +246,38 @@ const foldConst = (va, vb, fn, guard) =>
 
 // JS `*` is an f64 multiply; `i32.mul` yields only the exact product mod 2^32.
 // Those agree under a ToInt32/ToUint32 sink (and as plain numbers) while the
-// exact product stays f64-exact, i.e. |product| <= 2^53. Two i32 operands can
-// reach 2^62, so `i32.mul` is sound only when one side is bounded small enough
-// that, against the full i32 range (2^31) of the other, the product holds within
-// 2^53 — i.e. its magnitude <= 2^22. A literal qualifies directly; so does a
-// masked operand (`x & 63`, `x >>> k`) whose value is provably bounded. Keeps
-// index arithmetic (`i*4`) and bitwise-masked scales (bytebeat's `t*(m&63)`) on
-// `i32.mul` while routing hash-mix-scale products to `f64.mul`.
-const FITS_I32_MAX = 0x400000  // 2^22 — see derivation above
+// exact product stays f64-exact. A literal qualifies directly; so does a masked
+// operand (`x & 63`, `x >>> k`) whose value is provably bounded. Keeps index
+// arithmetic (`i*4`) and bitwise-masked scales (bytebeat's `t*(m&63)`) on
+// `i32.mul` while routing hash-mix-scale products to `f64.mul`. The FITS_I32_MAX
+// threshold (and the soundness contract with type.js exprType) lives in widen.js.
 const mulFitsI32 = (va, vb) =>
   (isLit(va) && Math.abs(litVal(va)) <= FITS_I32_MAX) ||
   (isLit(vb) && Math.abs(litVal(vb)) <= FITS_I32_MAX) ||
   (!isLit(va) && maskBound(va) <= FITS_I32_MAX) ||
   (!isLit(vb) && maskBound(vb) <= FITS_I32_MAX)
 
+// Max |value| of an i32-typed operand from a narrowing typed-array load width — the
+// element-read twin of maskBound's `x & 0xff` case (load8_u and `x & 0xff` carry the
+// SAME [0,255] range). Infinity when the magnitude is unbounded. Signed loads reach
+// −2^(w−1), so the magnitude bound is 2^(w−1).
+const I32_LOAD_MAG = { 'i32.load8_s': 128, 'i32.load8_u': 255, 'i32.load16_s': 32768, 'i32.load16_u': 65535 }
+const i32Mag = (v) =>
+  !Array.isArray(v) ? Infinity :
+  v[0] in I32_LOAD_MAG ? I32_LOAD_MAG[v[0]] :
+  (v[0] === 'i32.const' && typeof v[1] === 'number') ? Math.abs(v[1]) :
+  (v[0] === 'i32.and' || v[0] === 'i32.shr_u') ? maskBound(v) :
+  Infinity
+// `int8[i]*int8[j]` and friends: a product of two range-bounded integer typed-array
+// elements whose magnitudes multiply to ≤ 2^31−1 is FAITHFUL as i32.mul — the exact
+// product fits signed i32, so i32.mul == the true value in EVERY consumer context
+// (i32 sink AND f64 value), independent of the widen pass. Covers i8/u8/i16 pairs and
+// i16×u16 (32768·65535 < 2^31); correctly EXCLUDES u16×u16 (65535² > 2^31). JS `*` of
+// two such reads — the int-conv / correlation / quantised-MAC kernel shape — then rides
+// the i32 ABI (one op, no f64 round-trip) on V8 / JSC / wasmtime alike, and the i32
+// product is lane-vectorizable where the f64 form was not.
+const mulBoundedFaithful = (va, vb) => i32Mag(va) * i32Mag(vb) <= 0x7fffffff
+
 /** Emit typeof comparison: typeof x == typeCode → type-aware check. */
 export function emitTypeofCmp(a, b, cmpOp) {
   let typeofExpr, code
@@ -372,6 +442,27 @@ function tryI32Index(e) {
 }
 export const emitIndex = (idx) => tryI32Index(idx) ?? asI32(emit(idx))
 
+/**
+ * True when `e` is a pure integer `+`/`-`/`*` tree whose leaves are all i32-typed
+ * names/globals or integer literals — no calls, member reads, or indexed reads, so
+ * emitting it twice (or in a different rep) is side-effect-free. Used to recognise
+ * an i32-local initializer that `tryI32Index` can lower to native wrapping i32
+ * arithmetic instead of the f64 round-trip (`convert … f64.mul/add … trunc_sat`).
+ * The same residue-mod-2^32 argument as `tryI32Index`: ToInt32 of the exact integer
+ * value equals two's-complement wrapping i32, so for an i32 destination the two are
+ * bit-identical — even when an intermediate product overflows.
+ */
+function isI32ArithTree(e) {
+  if (typeof e === 'number') return Number.isInteger(e)
+  if (typeof e === 'string') return exprType(e, ctx.func.locals) === 'i32'
+  if (!Array.isArray(e)) return false
+  const op = e[0]
+  if (op == null) return isI32ArithTree(e[1])                 // literal wrapper [, v]
+  if ((op === '+' || op === '-' || op === '*') && e[2] != null)
+    return isI32ArithTree(e[1]) && isI32ArithTree(e[2])
+  return false
+}
+
 function emitSingleCharIndexCmp(a, b, negate = false) {
   const leftLit = stringLiteral(a)
   const rightLit = stringLiteral(b)
@@ -1080,6 +1171,12 @@ export function emitDecl(...inits) {
         updateRep(name, { ptrAux: val.closureFuncIdx })
       coerced = val.ptrKind === ptrKind ? val
         : typed(['i32.wrap_i64', ['i64.reinterpret_f64', asF64(val)]], 'i32')
+    } else if (localType === 'i32' && val.type !== 'i32' && isI32ArithTree(init)) {
+      // Integer index feeder (`let idx = py*W + qx`) bound to an i32 local: compute
+      // it in native wrapping i32 instead of the f64 round-trip + trunc_sat. Bit-
+      // identical for an i32 destination (ToInt32 ≡ two's-complement wrap), and the
+      // i32.mul is hoistable when loop-invariant. Falls back to toI32 defensively.
+      coerced = tryI32Index(init) ?? toI32(val)
     } else {
       coerced = localType === 'v128' ? val : localType === 'f64' ? asF64(val) : val.type === 'i32' ? val : toI32(val)
     }
@@ -1136,12 +1233,22 @@ function emitSpreadCopy(dest, posLocal, srcLocal, srcLenLocal, staticVT) {
     const sidx = `${T}sidx${ctx.func.uniq++}`
     ctx.func.locals.set(sidx, 'i32')
     const loopId = ctx.func.uniq++
-    const elem = ctx.module.modules['string']
-      ? ['if', ['result', 'f64'],
+    // When the source is statically known to be a typed array, __typed_idx suffices.
+    // Otherwise (STRING, or unknown type whose runtime value may be a string) dispatch on
+    // ptr_type: STRING→__str_idx, else→__typed_idx.
+    // The old gate (ctx.module.modules['string']) was wrong: for `[...s]` with an untyped
+    // param the string module is never loaded, so __typed_idx was used for strings —
+    // __typed_idx calls __len which returns 0 for strings, making i>=len always true and
+    // storing UNDEF into every element slot. Pull in the string module here so __str_idx
+    // is registered before inc() adds it to the dependency set.
+    const elem = staticVT === VAL.TYPED
+      ? (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])
+      : (includeForStringOnly(),
+        ['if', ['result', 'f64'],
           ['i32.eq', ['call', '$__ptr_type', srcI64()], ['i32.const', PTR.STRING]],
           ['then', (inc('__str_idx'), ['call', '$__str_idx', srcI64(), ['local.get', `$${sidx}`]])],
-          ['else', (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])]]
-      : (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])
+          ['else', (inc('__typed_idx'), ['call', '$__typed_idx', srcI64(), ['local.get', `$${sidx}`]])]
+        ])
     // Reset the counter on each entry — WASM zeroes locals once at function
     // entry, but this loop re-executes when the spread sits inside a JS loop;
     // a stale `sidx` (= prior srcLen) would skip the copy entirely.
@@ -1243,8 +1350,25 @@ export function buildArrayWithSpreads(items) {
       // emitSpreadCopy resolve its kind at runtime via its one-time __ptr_type branch.
       sec.val = n ? undefined : valTypeOf(srcExpr)
       ir.push(['local.set', `$${sec.local}`, n ? materializeMulti(sec.expr) : asF64(emit(srcExpr))])
-      // Cache __len once per spread; reused below for total-len sum and the copy.
-      ir.push(['local.set', `$${sec.lenLocal}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]]])
+      // Cache the source length once per spread (reused for the total-len sum and the
+      // copy). `__len` is ARRAY/typed length — WRONG for a STRING (returns 0, so `[...str]`
+      // spreads an empty array). Pick the length to MATCH emitSpreadCopy's element decode:
+      // a known string counts chars (__str_len, paired with the __str_idx per-char copy); a
+      // statically-unknown source — `[...x]` / `[...fnParam]`, the compiler's own
+      // `[...key]` — dispatches once at runtime (STRING→__str_len, else→__len), mirroring
+      // emitSpreadCopy's ARRAY-vs-scalar branch. (Not __length: its `off>=8` guard returns
+      // undefined for host/static typed arrays.) Known array/typed/multi keep plain __len.
+      const srcI64 = () => ['i64.reinterpret_f64', ['local.get', `$${sec.local}`]]
+      const lenIR = sec.val === VAL.STRING
+        ? (inc('__str_len'), ['call', '$__str_len', srcI64()])
+        : (sec.val === VAL.ARRAY || sec.val === VAL.TYPED || n)
+          ? (inc('__len'), ['call', '$__len', srcI64()])
+          : (inc('__str_len', '__len', '__ptr_type'),
+            ['if', ['result', 'i32'],
+              ['i32.eq', ['call', '$__ptr_type', srcI64()], ['i32.const', PTR.STRING]],
+              ['then', ['call', '$__str_len', srcI64()]],
+              ['else', ['call', '$__len', srcI64()]]])
+      ir.push(['local.set', `$${sec.lenLocal}`, lenIR])
     }
   }
 
@@ -1387,6 +1511,83 @@ const STRICT_PRIM = new Set([VAL.NUMBER, VAL.BOOL, VAL.STRING, VAL.BIGINT])
 const nullableOperand = (n) =>
   typeof n === 'string' && !!(repOf(n)?.nullable || repOfGlobal(n)?.nullable)
 
+// An emitted value whose bit pattern is an i32, paired with how it widens to f64: a
+// `f64.convert_i32_s/u(x)` peels to its i32 source `x`; a bare i32 widens signed. Used to compare
+// two integer-backed operands directly in i32 instead of widening both to f64.
+const peelIntCmp = (v) => {
+  if (Array.isArray(v) && (v[0] === 'f64.convert_i32_s' || v[0] === 'f64.convert_i32_u'))
+    return { src: Array.isArray(v[1]) ? typed(v[1], 'i32') : v[1], sign: v[0] === 'f64.convert_i32_u' ? 'u' : 's' }
+  if (v && v.type === 'i32') return { src: v, sign: 's' }
+  return null
+}
+// The value's top bit is provably 0 (so its signed and unsigned readings agree): a u8/u16 load,
+// `>>>` (always clears the sign bit), `& m` with m a non-negative small const, or a small const.
+const i32TopBitClear = (n) => {
+  if (typeof n === 'number') return n >= 0 && n < 0x80000000
+  if (!Array.isArray(n)) return false
+  if (n[0] == null) return typeof n[1] === 'number' && n[1] >= 0 && n[1] < 0x80000000
+  if (n[0] === 'i32.load8_u' || n[0] === 'i32.load16_u') return true
+  if (n[0] === 'i32.const') return typeof n[1] === 'number' ? (n[1] >= 0 && n[1] < 0x80000000) : false
+  if (n[0] === 'i32.shr_u' || n[0] === '>>>') return true
+  if (n[0] === 'i32.and' || n[0] === '&') return i32TopBitClear(n[1]) || i32TopBitClear(n[2])
+  return false
+}
+// i32.eq/ne over the peeled sources equals the f64-widened compare when the signs match, or — for
+// a mixed signed/unsigned pair — when the unsigned-read source is top-bit-clear (then both readings
+// of equal bits agree, and unequal bits stay unequal under both).
+const i32EqSound = (pa, pb) => pa.sign === pb.sign ||
+  i32TopBitClear((pa.sign === 'u' ? pa : pb).src)
+
+// A memory-free, trap-free, side-effect-free expression — safe to evaluate UNCONDITIONALLY (as a
+// `select` arm does) and cheap enough that doing so never loses to a branch. Locals/consts and
+// arithmetic/bitwise/compare/logical over them. Excludes loads (`[]`, may read OOB when the guard
+// was protecting the access), calls, `.`/`?.` (dispatch), `/` `%` (int trap on 0), assignments.
+const CHEAP_PURE_OPS = new Set(['+', '-', '*', 'u-', 'u+', '&', '|', '^', '<<', '>>', '>>>', '~',
+  '<', '<=', '>', '>=', '==', '!=', '===', '!==', '&&', '||', '!', '?:'])
+const isCheapPureVal = (n) => {
+  if (typeof n === 'string' || typeof n === 'number') return true
+  if (!Array.isArray(n)) return false
+  if (n[0] == null) return true                              // boxed literal [, v]
+  if (n[0] === 'local.get') return true
+  if (CHEAP_PURE_OPS.has(n[0])) { for (let i = 1; i < n.length; i++) if (!isCheapPureVal(n[i])) return false; return true }
+  return false
+}
+
+// Side-effect-free: no writes (assignment / ++ / --), no calls, no closures, no throw. UNLIKE
+// `isCheapPureVal` this ALLOWS loads, member reads, and `/` `%` — a side-effect-free expr may read
+// memory or trap. It is the right gate for an `if` CONDITION promoted to a `select` condition: the
+// condition is evaluated exactly once whether the lowering branches or selects (any trap fires the
+// same in both, the read order vs the pure value arm is immaterial), so it need only avoid MUTATING
+// state the value arm could read — i.e. be side-effect-free, not unconditionally-evaluable.
+const SIDE_EFFECT_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '>>=', '<<=',
+  '>>>=', '||=', '&&=', '??=', '++', '--', '()', '=>', 'throw', 'new', 'await', 'yield'])
+const isSideEffectFree = (n) => {
+  if (!Array.isArray(n)) return true
+  if (typeof n[0] === 'string' && SIDE_EFFECT_OPS.has(n[0])) return false
+  for (let i = 1; i < n.length; i++) if (!isSideEffectFree(n[i])) return false
+  return true
+}
+
+const isLit1 = (n) => Array.isArray(n) && n[0] == null && n[1] === 1
+// A void statement whose whole effect is `x = <cheap pure value>` for a simple local `x` — the
+// shape if→select can lower to `x = cond ? value : x`. Recognizes the plain assignment plus the
+// increment forms `++x`/`--x` and their postfix lowerings `(++x) - 1` / `(--x) + 1` (prepare turns
+// `x++` in statement position into the latter; the discarded ∓1 is dead in void context, so the
+// net effect is the increment). Returns `{ lhs, val }` or null.
+function matchVoidLocalStore(s) {
+  if (!Array.isArray(s)) return null
+  if (s[0] === '=' && typeof s[1] === 'string' && isCheapPureVal(s[2])) return { lhs: s[1], val: s[2] }
+  if ((s[0] === '++' || s[0] === '--') && typeof s[1] === 'string')
+    return { lhs: s[1], val: [s[0] === '++' ? '+' : '-', s[1], [, 1]] }
+  // postfix: `x++` → `(++x) - 1`, `x--` → `(--x) + 1`
+  if ((s[0] === '-' || s[0] === '+') && isLit1(s[2]) && Array.isArray(s[1])
+      && (s[1][0] === '++' || s[1][0] === '--') && typeof s[1][1] === 'string') {
+    const inc = s[1][0] === '++'
+    if ((inc && s[0] === '-') || (!inc && s[0] === '+')) return { lhs: s[1][1], val: [inc ? '+' : '-', s[1][1], [, 1]] }
+  }
+  return null
+}
+
 function emitLooseEq(a, b, negate) {
   const eqOp = negate ? 'ne' : 'eq'
   const sentinel = emitNum(negate ? 1 : 0)
@@ -1405,6 +1606,12 @@ function emitLooseEq(a, b, negate) {
   const tc = emitTypeofCmp(a, b, eqOp); if (tc) return tc
   const va = emit(a), vb = emit(b)
   if (va.type === 'i32' && vb.type === 'i32') return typed([`i32.${eqOp}`, va, vb], 'i32')
+  // Both operands integer-backed (e.g. an i32 local vs a `b[j]` u8 read materialized as f64):
+  // compare the i32 sources directly, skipping the per-op widen to f64. Recovers `intElem ===
+  // intElem` in hot loops (levenshtein's DP cell, where `a[i-1] === b[j-1]` was an f64.eq + 2
+  // converts every iteration). Sound only when the widen can't change the answer (see i32EqSound).
+  const pa = peelIntCmp(va), pb = peelIntCmp(vb)
+  if (pa && pb && i32EqSound(pa, pb)) return typed([`i32.${eqOp}`, pa.src, pb.src], 'i32')
   // Either side known-pure NUMBER (literal or typed) → f64.eq/ne is correct regardless
   // of the other side: jz's `==` is strict (prepare.js:868), and every NaN-boxed pointer
   // reinterprets to a quiet NaN (0x7FF8… prefix) so f64.eq with any normal float is false.
@@ -1425,6 +1632,43 @@ function emitLooseEq(a, b, negate) {
   if (vta && vta === vtb && REF_EQ_KINDS.has(vta)) {
     return typed([`i64.${eqOp}`, ['i64.reinterpret_f64', asF64(va)], ['i64.reinterpret_f64', asF64(vb)]], 'i32')
   }
+  // String-equality specialization — the hot `node[0] === 'literal'` AST-tag dispatch,
+  // the compiler's single most-emitted comparison (5579 of its 6487 __eq sites). When one
+  // side is statically a STRING, skip the generic __eq NaN-box dispatch (the #1 self-host
+  // hot helper). jz's ==/=== never coerce (number-vs-string is false in __eq), so this is
+  // sound for both. Two shapes by what the OTHER side is known to be:
+  //   both STRING        → __str_eq directly (no number/NaN/tag test needed at all).
+  //   STRING vs unknown  → i64.eq fast ? equal : (__is_str_key(u) ? __str_eq : not-equal).
+  // Soundness of the fast path: the known string is a non-NaN STRING NaN-box, so a bit
+  // match can ONLY be that same string (a normal f64 can't alias those bits). On bit
+  // MISMATCH the unknown can still content-match — a heap string from `'i'+'f'` shares
+  // content but not bits — so the fallback __str_eq stays (pure i64.eq is unsound here).
+  // __is_str_key rejects the number-whose-bits-alias-the-STRING-tag case that a bare
+  // __ptr_type would misroute into a wild __str_eq deref (see __eq's own guard).
+  // INLINED (not a helper call): a single $__str_eq_lit helper measured 2.4% slower on
+  // the corpus — V8 keeps the call at the hot miss path; inlining lets the optimizer fold
+  // __is_str_key/__str_eq's prefix in, which is where the tag dispatch spends its time.
+  // Behaviorally identical to __eq when one side is a string — proven by a 4584-case
+  // spec-on/spec-off differential (zero divergence at optimize 0 and 2).
+  const strEqResult = (r) => negate ? typed(['i32.eqz', r], 'i32') : r
+  const aStr = rawA === VAL.STRING, bStr = rawB === VAL.STRING
+  if (aStr && bStr) {
+    inc('__str_eq')
+    return strEqResult(typed(['call', '$__str_eq', asI64(va), asI64(vb)], 'i32'))
+  }
+  if ((bStr && rawA == null) || (aStr && rawB == null)) {
+    const uVal = bStr ? va : vb, lVal = bStr ? vb : va   // u: unknown side, l: known string
+    inc('__is_str_key', '__str_eq')
+    const u = tempI64('seq'), l = tempI64('seq'), uG = ['local.get', `$${u}`], lG = ['local.get', `$${l}`]
+    return strEqResult(typed(['block', ['result', 'i32'],
+      ['local.set', `$${u}`, asI64(uVal)],
+      ['local.set', `$${l}`, asI64(lVal)],
+      ['if', ['result', 'i32'], ['i64.eq', uG, lG],
+        ['then', ['i32.const', 1]],
+        ['else', ['if', ['result', 'i32'], ['call', '$__is_str_key', uG],
+          ['then', ['call', '$__str_eq', uG, lG]],
+          ['else', ['i32.const', 0]]]]]], 'i32'))
+  }
   inc('__eq')
   const call = typed(['call', '$__eq', asI64(va), asI64(vb)], 'i32')
   return negate ? typed(['i32.eqz', call], 'i32') : call
@@ -1696,6 +1940,13 @@ function emitSpreadElementLoop(spreadExpr, bodyFn, { reverse = false } = {}) {
   ]
 }
 
+function emitAsValue(fn) {
+  const prev = ctx.func._expect
+  ctx.func._expect = null
+  try { return fn() }
+  finally { ctx.func._expect = prev }
+}
+
 function emitSingleSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   const inPlace = SPREAD_MUTATORS.has(method)
   // unshift prepends each arg to the front — forward iteration reverses intent.
@@ -1704,11 +1955,11 @@ function emitSingleSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   ctx.func.locals.set(acc, 'f64')
   const ir = [['local.set', `$${acc}`, asF64(emit(objArg))]]
   if (parsed.normal.length > 0) {
-    const r = asF64(methodEmitter(objArg, ...parsed.normal))
+    const r = asF64(emitAsValue(() => methodEmitter(objArg, ...parsed.normal)))
     ir.push(inPlace ? ['drop', r] : ['local.set', `$${acc}`, r])
   }
   ir.push(...emitSpreadElementLoop(parsed.spreads[0].expr, (arr, idx) => {
-    const body = asF64(methodEmitter(inPlace ? objArg : acc, ['[]', arr, idx]))
+    const body = asF64(emitAsValue(() => methodEmitter(inPlace ? objArg : acc, ['[]', arr, idx])))
     return [inPlace ? ['drop', body] : ['local.set', `$${acc}`, body]]
   }, { reverse }))
   ir.push(inPlace ? asF64(emit(objArg)) : ['local.get', `$${acc}`])
@@ -1730,7 +1981,7 @@ function emitMultiSpreadMethodCall(objArg, parsed, method, methodEmitter) {
   let batch = []
   const flushBatch = () => {
     if (!batch.length) return
-    const r = asF64(methodEmitter(recv, ...batch))
+    const r = asF64(emitAsValue(() => methodEmitter(recv, ...batch)))
     ir.push(inPlace ? ['drop', r] : ['local.set', `$${acc}`, r])
     batch = []
   }
@@ -1738,7 +1989,7 @@ function emitMultiSpreadMethodCall(objArg, parsed, method, methodEmitter) {
     if (Array.isArray(item) && item[0] === '__spread') {
       flushBatch()
       ir.push(...emitSpreadElementLoop(item[1], (arr, idx) => {
-        const body = asF64(methodEmitter(recv, ['[]', arr, idx]))
+        const body = asF64(emitAsValue(() => methodEmitter(recv, ['[]', arr, idx])))
         return [inPlace ? ['drop', body] : ['local.set', `$${acc}`, body]]
       }))
     } else {
@@ -1815,7 +2066,7 @@ function tryCharCodeAtFast(callee, obj, method, parsed) {
       return typed(['call', '$__jss_charCodeAt', recv, asI32(emit(parsed.normal[0]))], 'i32')
     }
     return typed(stringOps(obj).charCodeAt(
-      asF64(recv), asI32(emit(parsed.normal[0])), ctx, false), 'i32')
+      asF64(recv), asI32(emit(parsed.normal[0])), ctx, false, true), 'i32')
   }
 }
 
@@ -2497,7 +2748,15 @@ export const emitter = {
       inc('__to_num')
       return writeVar(name, typed(['call', '$__to_num', asI64(emit(name))], 'f64'), void_)
     }
-    return writeVar(name, emit(val), void_)
+    // Self-accumulation `x = x + …` (incl. desugared `x += …`): the new value REPLACES x, so x's
+    // old buffer is dead — the one context where a string concat may bump-EXTEND it in place. The
+    // `+` handler reads this flag for its immediate concat; nested operands clear it (not the target).
+    const selfAccum = Array.isArray(val) && val[0] === '+' && val[1] === name
+    const prevSA = ctx.func._selfAccumConcat
+    ctx.func._selfAccumConcat = selfAccum ? name : null
+    const ev = emit(val)
+    ctx.func._selfAccumConcat = prevSA
+    return writeVar(name, ev, void_)
   },
 
   // Compound assignments: read-modify-write with type coercion
@@ -2587,15 +2846,18 @@ export const emitter = {
   // Postfix in void: (++i)-1 / (--i)+1 → just ++i / --i
   '+': (a, b) => {
     if (ctx.func._expect === 'void' && isPostfix(a, '--', b)) return emit(a, 'void')
+    // A self-accumulation `a = a + …` lets the concat bump-EXTEND `a` in place (a is dead-after).
+    // Read it for THIS concat, then clear so nested operands (not the accumulation target) stay fresh.
+    const selfAccum = typeof a === 'string' && a === ctx.func._selfAccumConcat
+    ctx.func._selfAccumConcat = null
     // String concatenation: pure string operands skip generic ToString coercion.
     const vtA = valTypeOf(a)
     const vtB = valTypeOf(b)
     if (vtA === VAL.STRING && vtB === VAL.STRING) {
-      // Fused append-byte: `buf += s[i]` skips 1-char SSO construction +
-      // generic concat dispatch when rhs is a string-index. The byte flows
-      // straight from __char_at into memory, and the bump-extend path elides
-      // the alloc+copy when lhs is the heap-top STRING.
-      if (Array.isArray(b) && b[0] === '[]' && ctx.core.stdlib['__str_append_byte'] && ctx.core.stdlib['__char_at']) {
+      // Fused append-byte: `buf += s[i]` skips 1-char SSO construction + generic concat dispatch
+      // when rhs is a string-index. The byte flows straight from __char_at into memory and bump-
+      // EXTENDS the heap-top lhs — so only when proven self-accumulating (else it mutates a live s).
+      if (selfAccum && Array.isArray(b) && b[0] === '[]' && ctx.core.stdlib['__str_append_byte'] && ctx.core.stdlib['__char_at']) {
         if (valTypeOf(b[1]) === VAL.STRING) {
           inc('__str_append_byte', '__char_at')
           return typed(['call', '$__str_append_byte',
@@ -2604,7 +2866,7 @@ export const emitter = {
           ], 'f64')
         }
       }
-      return typed(ctx.abi.string.ops.concatRaw(asF64(emit(a)), asF64(emit(b)), ctx), 'f64')
+      return typed(ctx.abi.string.ops.concatRaw(asF64(emit(a)), asF64(emit(b)), ctx, selfAccum), 'f64')
     }
     if (vtA === VAL.STRING || vtB === VAL.STRING) {
       // An OBJECT operand coerces via ToPrimitive(string) at compile time —
@@ -2624,10 +2886,10 @@ export const emitter = {
       const coercionFree = (vt) => vt === VAL.STRING || vt === VAL.OBJECT || vt === VAL.BOOL
       const cfA = coercionFree(vtA), cfB = coercionFree(vtB)
       const strI64 = (n) => typed(['f64.reinterpret_i64', toStrI64(n, emit(n))], 'f64')
-      if (cfA && cfB) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strOperand(vtB, b), ctx), 'f64')
-      if (cfA) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strI64(b), ctx), 'f64')
-      if (cfB) return typed(ctx.abi.string.ops.concatRaw(strI64(a), strOperand(vtB, b), ctx), 'f64')
-      return typed(ctx.abi.string.ops.cat(strOperand(vtA, a), strOperand(vtB, b), ctx), 'f64')
+      if (cfA && cfB) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strOperand(vtB, b), ctx, selfAccum), 'f64')
+      if (cfA) return typed(ctx.abi.string.ops.concatRaw(strOperand(vtA, a), strI64(b), ctx, selfAccum), 'f64')
+      if (cfB) return typed(ctx.abi.string.ops.concatRaw(strI64(a), strOperand(vtB, b), ctx, selfAccum), 'f64')
+      return typed(ctx.abi.string.ops.cat(strOperand(vtA, a), strOperand(vtB, b), ctx, selfAccum), 'f64')
     }
     if (vtA === VAL.BIGINT || vtB === VAL.BIGINT)
       return fromI64(['i64.add', asI64(emit(a)), asI64(emit(b))])
@@ -2637,6 +2899,12 @@ export const emitter = {
     // operand needs the runtime check.
     if ((vtA == null || vtB == null) && ctx.core.stdlib['__str_concat']) {
       const tA = temp('add'), tB = temp('add')
+      // Fully-untyped `+`: the string arm is a runtime-guarded cold path that the engine reaches
+      // only if BOTH operands are strings at runtime, so it keeps the bump-extend `__str_concat`
+      // (its body stays out-of-line — folding it to the smaller _fresh twin would inline this
+      // never-numeric branch into every hot integer loop). The demonstrated `t = s + "lit"` mutation
+      // is a TYPED concat (handled by concatRaw above); a both-untyped self-mutation stays the
+      // documented rare-aliasing tradeoff. Self-accumulation is still safe to extend.
       inc('__str_concat', '__is_str_key')
       const checkA = vtA == null ? ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.tee', `$${tA}`, asF64(emit(a))]]] : null
       const checkB = vtB == null ? ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.tee', `$${tB}`, asF64(emit(b))]]] : null
@@ -2661,6 +2929,7 @@ export const emitter = {
     // op whose result can exceed i32, so `i32.add` would wrap (4294967295+1→0).
     // Widen to f64 — never wrap — matching spec. Only `>>>0`/`|0`/imul wrap.
     if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.add', va, vb], 'i32')
+    const i32add = tryI32Arith('i32.add', '+', a, b, va, vb); if (i32add) return i32add
     return typed(['f64.add', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '-': (a, b) => {
@@ -2676,6 +2945,7 @@ export const emitter = {
     // Unsigned uint32 operand: JS `-` is float (can go negative / exceed i32),
     // so avoid the wrapping i32.sub fast-path. See `+` above.
     if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb)) return typed(['i32.sub', va, vb], 'i32')
+    const i32sub = tryI32Arith('i32.sub', '-', a, b, va, vb); if (i32sub) return i32sub
     return typed(['f64.sub', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   'u+': a => {
@@ -2705,7 +2975,8 @@ export const emitter = {
     if (isLit(va) && litVal(va) === 0 && finiteFactor(vb)) return isLit(vb) ? va : typed(['block', ['result', va.type], vb, 'drop', va], va.type)
     // `.unsigned` operand is a uint32 ([0, 2^32)); its product can exceed i32, so
     // `i32.mul` would wrap ((2^32-1)*2 → -2). Widen to f64 — see `+` above.
-    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb) && mulFitsI32(va, vb)) return typed(['i32.mul', va, vb], 'i32')
+    if (isI32Num(va) && isI32Num(vb) && !widensUnsigned(va) && !widensUnsigned(vb) && (mulFitsI32(va, vb) || mulBoundedFaithful(va, vb))) return typed(['i32.mul', va, vb], 'i32')
+    const i32mul = tryI32Arith('i32.mul', '*', a, b, va, vb); if (i32mul) return i32mul
     return typed(['f64.mul', stripCanon(toNumF64(a, va)), stripCanon(toNumF64(b, vb))], 'f64')
   },
   '/': (a, b) => {
@@ -3075,6 +3346,21 @@ export const emitter = {
       if (els != null) return emitVoid(els)
       return null
     }
+    // If-conversion (speed tier): `if (cond) x = <cheap pure value>` (no else) → `x = cond ? value
+    // : x`, which lowers to a branchless `select`. Removes the data-dependent branch (and its
+    // misprediction) from min/max/clamp reductions — e.g. levenshtein's `if (ins < m) m = ins`,
+    // ~27% faster — and from heapsort's child pick `if (a[c] < a[c+1]) c++`, the canonical
+    // unpredictable compare that costs jz on x86 (Cranelift/V8-x64 keep the branch; Binaryen, which
+    // AS uses, selects it). The condition is evaluated exactly once whether we branch or select, so
+    // it need only be SIDE-EFFECT-FREE (loads allowed — sort's `a[c] < a[c+1]`); only the assigned
+    // VALUE is evaluated unconditionally, hence must be a cheap, trap-free pure expr. `x++`/`x--`
+    // are admitted as `x = x ± 1`. The already-emitted condition `ce` is reused (`__emitted`), so a
+    // load-bearing condition is not emitted twice.
+    if (els == null && ctx.transform.optimize?.boolConvertToSelect && isSideEffectFree(cond)) {
+      const asg = Array.isArray(then) && then[0] === ';' && then.length === 2 ? then[1] : then
+      const sel = matchVoidLocalStore(asg)
+      if (sel) return emitVoid(['=', sel.lhs, ['?:', ['__emitted', ce], sel.val, sel.lhs]])
+    }
     const c = ce.type === 'i32' ? ce : toBoolFromEmitted(ce)
     // Flow-sensitive type refinement: narrow types within each branch based on the guard.
     const thenRefs = extractRefinements(cond, new Map(), true)
@@ -3336,6 +3622,10 @@ export function emit(node, expect) {
     if (node.loc != null) ctx.error.loc = node.loc
   }
   if (node == null) return null
+  // Pre-emitted IR passthrough: `['__emitted', ir]` returns `ir` untouched. Lets a caller that
+  // already emitted a subtree (e.g. the `if` handler's condition) splice it into an AST-shaped
+  // re-emit (a `?:` for if→select conversion) without emitting it a second time.
+  if (Array.isArray(node) && node[0] === '__emitted') return node[1]
   // Boolean literals carry VAL.BOOL for type observation (valTypeOf reads the
   // AST), but their working representation is the plain number 0/1 — identical
   // codegen to the pre-carrier `[, 1]`/`[, 0]` folding, so no perf is paid.