jz 0.7.0 → 0.8.1

package/src/compile/index.js

@@ -27,7 +27,8 @@
 
 import parseWat from 'watr/parse'
 import { ctx, err, inc, resolveIncludes, PTR, LAYOUT, declGlobal } from '../ctx.js'
-import { T, isBlockBody, isReassigned, refsName, REFS_IN_EXPR } from '../ast.js'
+import { T, isBlockBody, isReassigned, refsName, REFS_IN_EXPR, returnExprs } from '../ast.js'
+import { valTypeOf } from '../kind.js'
 import { intLiteralValue } from '../static.js'
 import {
   analyzeBody, unboxablePtrs, cseSafeLoadBases, boxedCaptures,
@@ -38,7 +39,14 @@ import { VAL, updateRep, REP_FIELDS } from '../reps.js'
 import { inferLocals } from './infer.js'
 import { optimizeFunc, treeshake } from '../optimize/index.js'
 import { strengthReduceLoopDivMod } from './loop-divmod.js'
+import { narrowBoundedSquare } from './loop-square.js'
+import { unrollRecurrence } from './loop-recurrence.js'
 import { peelClampedStencil } from './peel-stencil.js'
+import { cseLoads } from './cse-load.js'
+
+// Monotonic across all functions so a CSE temp never collides (even after later inlining).
+let __cseCtr = 0
+const freshCseName = () => `${T}cse${__cseCtr++}`
 import { emit, emitter, emitVoid, emitBlockBody } from './emit.js'
 import { emitCharDecompPrologue, JSS_IMPORT_SIGS } from '../abi/string.js'
 import {
@@ -59,8 +67,9 @@ import plan from './plan/index.js'
 import { foldStaticConstAggregates } from './plan/literals.js'
 import {
   buildStartFn, dedupClosureBodies, finalizeClosureTable,
-  pullStdlib, syncImports, optimizeModule, stripStaticDataPrefix, hoistConstGlobalInits,
+  pullStdlib, syncImports, optimizeModule, stripStaticDataPrefix, hoistConstGlobalInits, stripDeadElTable,
 } from '../wat/assemble.js'
+import { instrumentHelperCallsites } from '../helper-counters.js'
 
 // =============================================================================
 // Single-source export semantics
@@ -133,15 +142,21 @@ const timePhase = (profiler, name, fn) => profiler?.time ? profiler.time(name, f
  * fractional Number gets the same truncation it would get from `arr[n]`).
  */
 const isBoundaryWrapped = (func) => {
-  if (!isExported(func) || func.raw || func.sig.results.length !== 1) return false
+  if (!isExported(func) || func.raw) return false
+  // Multi-value return: every lane is an f64 NaN-box carrier (the `return [a,b,…]` emit forces
+  // asF64 per lane; result narrowing only touches single-result funcs), so any lane may hold a
+  // box whose NaN payload JSC/V8 erases at the boundary — wrap to i64-carry every lane.
+  if (func.sig.results.length !== 1) return true
   if (func.sig.results[0] !== 'f64' || func.sig.ptrKind != null) return true
-  // A boolean result rides the 0/1 number carrier internally; the export thunk
-  // boxes it to the TRUE_NAN/FALSE_NAN atom so the host sees a real boolean.
-  if (func.valResult === VAL.BOOL) return true
-  // A bigint result rides the i64-reinterpreted-f64 carrier internally; the export thunk converts
-  // it to a real Number so a JS host doesn't see raw i64 bits (`() => 100n` was returning 4.94e-322).
-  if (func.valResult === VAL.BIGINT) return true
-  return func.sig.params.some(p => p.type !== 'f64' || p.ptrKind != null)
+  // Any result that isn't a proven plain number can be a NaN-box — a heap pointer,
+  // a null/undef/bool atom, a bigint carrier, or a dynamic value — so it crosses as
+  // i64 and JSC (Safari) can't canonicalize the payload away. A proven-number result
+  // stays f64: free, and a number is never a NaN-box. `_resultNumeric` is set in
+  // analyzeFuncForEmit (covers value-bound arrows narrowValResults skips).
+  if (!func._resultNumeric) return true
+  // Number result, but a param may still carry a box — a pointer-ABI param, or a
+  // dynamic f64 param flagged `boundaryI64` during analyze — so wrap for i64 params.
+  return func.sig.params.some(p => p.type !== 'f64' || p.ptrKind != null || p.boundaryI64)
 }
 
 // Static-string intern index (the `internStrings` pass). Open-addressing table
@@ -212,20 +227,39 @@ const ensureThrowRuntime = (sec) => {
     sec.tags.push(['export', '"__jz_last_err_bits"', ['global', '$__jz_last_err_bits']])
 }
 
-// Drop the $__jz_err tag + __jz_last_err_bits globals when optimization
-// eliminated every actual throw site. ensureThrowRuntime runs before
-// optimizeModule so dead-throw analysis can see the tag/global as live; once
-// opt has finished, an unused tag still forces consumers (wasmtime, wasm2c) to
-// enable the exceptions proposal just to parse the module. User-written
-// throw/try/catch/finally is an ABI contract (JS-side may inspect
-// __jz_last_err_bits), so `userThrows` keeps the runtime declared regardless;
-// the prune fires only when `throws` was set purely by stdlib pattern matching
-// or compiler-internal coercion sites.
+// Drop the $__jz_err tag + __jz_last_err_bits globals when no throw can be CAUGHT.
+// ensureThrowRuntime runs before optimizeModule so dead-throw analysis sees the
+// tag/global as live; once opt has finished, an unused tag still forces consumers
+// (wasmtime, wasm2c, wabt) to enable the exceptions proposal just to PARSE the module.
+//
+// When `!userThrows`, every `throw` is compiler-internal (bounds / coercion / type
+// errors) and — with no user try/catch — uncatchable: nothing inspects the thrown
+// value, so it is semantically a trap. The exceptions proposal is needed only to
+// DECLARE the tag a `throw` references; lowering each surviving uncatchable throw to
+// `unreachable` keeps the module in the wasm MVP, so every runtime can parse it
+// (V8 alone enables exceptions by default, which masked this). A pure-recursion or
+// typed-array kernel (nqueens, anything pulling __to_num) thus stops emitting a Tag
+// section it can never use. User-written throw/try/catch/finally is an ABI contract
+// (JS-side may inspect __jz_last_err_bits), so `userThrows` keeps the runtime intact.
 const pruneUnusedThrowRuntime = (sec) => {
   if (!ctx.runtime.throws || ctx.runtime.userThrows) return
-  const hasThrow = (n) => Array.isArray(n) && (n[0] === 'throw' || n.some(hasThrow))
+  // A catch handler (try_table) appears only under userThrows; defensively bail if one
+  // is present so a caught throw is never silently turned into a trap.
+  const hasCatch = (n) => Array.isArray(n) &&
+    (n[0] === 'try_table' || n[0] === 'catch' || n[0] === 'catch_all' || n.some(hasCatch))
   for (const arr of [sec.funcs, sec.stdlib, sec.start])
-    for (const f of arr) if (hasThrow(f)) return
+    for (const f of arr) if (hasCatch(f)) return
+  // Rewrite every surviving `(throw $__jz_err …)` to `(unreachable)` (same polymorphic
+  // stack type — a drop-in in any position). The thrown operand is side-effect-free
+  // (a local read / const), so dropping it loses nothing.
+  const lowerThrows = (n) => {
+    if (!Array.isArray(n)) return n
+    if (n[0] === 'throw') return ['unreachable']
+    for (let i = 1; i < n.length; i++) n[i] = lowerThrows(n[i])
+    return n
+  }
+  for (const arr of [sec.funcs, sec.stdlib, sec.start])
+    for (let i = 0; i < arr.length; i++) arr[i] = lowerThrows(arr[i])
   sec.tags = sec.tags.filter(t => !(Array.isArray(t) &&
     ((t[0] === 'tag' && t[1] === '$__jz_err') ||
      (t[0] === 'export' && t[1] === '"__jz_last_err_bits"'))))
@@ -351,6 +385,7 @@ function enterFunc(sig, body, { uniq = 0, directClosures = null } = {}) {
   ctx.func.stack = []
   ctx.func.zeroInitSeen = new Set()   // names whose `let x=0` zero-init was elided once; a 2nd is a real re-init (unrolled bodies)
   ctx.func.maybeNullish = new Set()   // bindings assigned a nullish literal → coerce in arithmetic (null-flow)
+  ctx.func.refinements = new Map()     // flow-sensitive type facts (typeof/instanceof guards) — per-function; clear so none leak across bodies
   ctx.func.pendingLabel = null        // label awaiting its loop, for `continue <label>`
   ctx.func.uniq = uniq
   ctx.func.current = sig
@@ -388,6 +423,15 @@ function analyzeFuncForEmit(func, programFacts) {
   // counters are typed/narrowed like any i32 local. Off at L0 / `loopIVDivMod:false`.
   const _o = ctx.transform.optimize
   if (_o && _o.loopIVDivMod !== false && isBlockBody(func.body)) func.body = strengthReduceLoopDivMod(func.body)
+  // Bounded-square narrowing: `i*i` under an `i*i < CONST` (CONST ≤ 2³⁰) guard → Math.imul,
+  // so the sieve's product/counter chain carries i32 instead of f64. Before analyze so the
+  // Math.imul typed/narrows like any i32. Off at L0 / `loopSquare:false`.
+  if (_o && _o.loopSquare !== false && isBlockBody(func.body)) func.body = narrowBoundedSquare(func.body)
+  // Array-recurrence unroll: a unit-stride DP/scan that reads arr[j-1] and writes arr[j] carries
+  // its value through memory (store→load) and re-pays loop overhead per cell — both of which V8
+  // hides but Cranelift/baseline don't. Scalar-replace the recurrence + unroll ×2 (clang's fix).
+  // Off at L0 / `unrollRecurrence:false`.
+  if (_o && _o.unrollRecurrence !== false && isBlockBody(func.body)) func.body = unrollRecurrence(func.body)
   // Edge-clamp peeling: split a clamped stencil loop into clamp-free interior + edges
   // (the interior then lifts to SIMD). Before analyze so the new loops are analyzed.
   if (_o && _o.clampPeel !== false && isBlockBody(func.body)) func.body = peelClampedStencil(func.body)
@@ -425,7 +469,10 @@ function analyzeFuncForEmit(func, programFacts) {
   // ToNumber string-parse dep tree (`__to_str`→`__itoa`/`__toExp`/`__mkstr`/…)
   // treeshake away — a ~4× module shrink that, decisively, lets V8 tier the hot
   // fill loop up properly (the bloated module JITs the *identical* loop ~2× slower).
-  if (func.exported && block) {
+  // Block AND expression bodies: value-bound arrows (`export let f = (a,b) => a*b`) are
+  // skipped by narrowValResults, so without trusting their params here they'd fall to the
+  // i64 boundary carrier. The closure path runs the same proof at line ~1300.
+  if (func.exported) {
     for (const p of sig.params) {
       if (p.type === 'f64' && p.ptrKind == null && !p.jsstring
           && !func.defaults?.[p.name] && !ctx.func.boxed?.has(p.name)
@@ -438,6 +485,12 @@ function analyzeFuncForEmit(func, programFacts) {
         updateRep(p.name, { val: VAL.NUMBER })
     }
   }
+  // Sound load-CSE: cache a repeated pure typed-array load `arr[idx]` when every intervening
+  // store writes a provably-different element (idx2 ≠ idx). Recovers the fft butterfly's redundant
+  // `re[a]` load. Before analyze so the introduced temp is typed/narrowed like any local.
+  if (_o && _o.loadCSE !== false && block && ctx.types.typedElem?.size)
+    cseLoads(body, n => ctx.types.typedElem.has(n), freshCseName)
+
   if (block) {
     seedLocalIntConsts(body)
   }
@@ -531,6 +584,32 @@ function analyzeFuncForEmit(func, programFacts) {
     if (ctx.func.localReps?.get(name)?.intCertain === true) cellTypes.add(name)
   }
 
+  // Snapshot each param's JS-boundary carrier while reps are live — synthesizeBoundaryWrappers
+  // runs after they're torn down. A dynamic f64 param crosses as i64 (the carrier JSC can't
+  // canonicalize) iff it can hold a NaN-box, i.e. it isn't proven numeric. Numeric (NUMBER /
+  // BOOL → 0/1) params keep f64; pointer-ABI (ptrKind, type i32) and jsstring params are
+  // classified directly in the wrapper, so leave their flag false here.
+  if (isExported(func)) for (const p of sig.params) {
+    if (p.jsstring || p.ptrKind != null || p.type !== 'f64') { p.boundaryI64 = false; continue }
+    const rv = ctx.func.localReps?.get(p.name)?.val
+    p.boundaryI64 = rv !== VAL.NUMBER && rv !== VAL.BOOL
+  }
+
+  // Result-numeric proof for the boundary carrier. Block bodies get func.valResult from
+  // narrowValResults; value-bound arrows (`export let f = (a,b) => a*b`) don't, so prove via
+  // the return expression(s) with params now trusted numeric. A proven-number f64 result
+  // never carries a NaN-box → crosses as plain f64; anything else rides i64 (Safari-safe).
+  if (isExported(func))
+    func._resultNumeric = func.valResult === VAL.NUMBER ||
+      (func.valResult == null && sig.results[0] === 'f64' &&
+        (() => {
+          const rex = returnExprs(body)
+          // Void body (falls off → undefined, which callers ignore) keeps the f64 carrier:
+          // undefined isn't a reference, so no i64 is needed and wrapping every void export
+          // is pure overhead. A non-empty set must be all-NUMBER to stay f64.
+          return rex.length === 0 || rex.every(e => valTypeOf(e) === VAL.NUMBER)
+        })())
+
   return {
     block,
     locals: new Map(ctx.func.locals),
@@ -539,6 +618,7 @@ function analyzeFuncForEmit(func, programFacts) {
     flatObjects: new Map(ctx.func.flatObjects),
     sliceViews: new Set(ctx.func.sliceViews),
     cseLoadBases,
+    distinctParams: func.distinctParams || null,
     typedElem: ctx.types.typedElem ? new Map(ctx.types.typedElem) : null,
     localReps: cloneRepMap(ctx.func.localReps),
   }
@@ -958,6 +1038,11 @@ function emitFunc(func, funcFacts, programFacts) {
   // it the pass is a no-op. `$`-prefixed to match WAT local names directly.
   if (funcFacts.cseLoadBases?.size)
     fn.cseLoadBases = new Set([...funcFacts.cseLoadBases].map(n => `$${n}`))
+  // Param-distinctness fact (alias analysis): typed-array params proven mutually-distinct buffers
+  // at every call site. `$`-prefixed to match WAT param names; read by hoistInvariantLoop to hoist
+  // a load from one such param across a store to another (they can't alias).
+  if (funcFacts.distinctParams?.size)
+    fn.distinctParams = new Set([...funcFacts.distinctParams].map(n => `$${n}`))
   // Inline `(export ...)` attribute only for the syntactic inline-export
   // form (`export function foo`, snapshot in `func.exported` at defFunc
   // time). Re-exports (`function foo; export { foo }`) and aliases (`export
@@ -1098,17 +1183,26 @@ function synthesizeBoundaryWrappers() {
   for (const func of ctx.func.list) {
     if (!isBoundaryWrapped(func)) continue
     const { name, sig } = func
-    // Quiet NaN-box ABI: every boundary value is f64. A number is a plain f64; a
-    // tagged value (heap pointer, null/undef/bool atom) is an f64 whose quiet-NaN
-    // (0x7FF8…) payload carries the tag. Quiet-NaN payloads are preserved across the
-    // JS↔wasm call boundary by every real engine (and non-JS hosts don't canonicalize
-    // at all), so no i64 carrier is needed — the wasm signature is self-describing
-    // (f64 everywhere) and a consumer discriminates a tagged value by the NaN prefix.
-    // Env requirement: a non-canonicalizing NaN boundary. To support a canonicalizing
-    // engine, a per-position i64 carrier would re-enter here (param/result type i64 +
-    // `i64.reinterpret_f64`) plus a `jz:i64exp` section for interop.js.
-    const resultBool = func.valResult === VAL.BOOL && sig.ptrKind == null
-    const resultBigint = func.valResult === VAL.BIGINT && sig.ptrKind == null
+    // i64 boundary carrier (Safari-safe). A genuine number is never a NaN-box, so it crosses
+    // as plain f64 (zero cost). Everything that can be a NaN-box — heap pointer, null/undef/
+    // bool atom, bigint carrier, or a dynamic value — crosses as i64: JSC (Safari) canonicalizes
+    // f64 NaN payloads at the JS↔wasm boundary, erasing the box. The wasm signature is
+    // self-describing; interop.js wrap() reinterprets BigInt↔f64 by bits, driven by the
+    // `jz:i64exp` section emitted below. Non-JS hosts (WASI) read the same signature — i64 is
+    // just int64 there, no BigInt.
+    const resultPtr = sig.ptrKind != null
+    const resultBool = func.valResult === VAL.BOOL && !resultPtr
+    const resultBigint = func.valResult === VAL.BIGINT && !resultPtr
+    // Dynamic f64 result: not pointer/bool/bigint and not a proven number → may be a NaN-box
+    // at runtime, so i64. (An i32-carrier result is numeric → stays f64 via convert below.)
+    const resultDynamic = !resultPtr && !resultBool && !resultBigint
+      && sig.results[0] === 'f64' && !func._resultNumeric
+    const resultI64 = resultPtr || resultBool || resultBigint || resultDynamic
+    // jz:i64exp `r` marks results interop must reinterpret then `mem.read`. A bigint result is
+    // i64 too, but the BigInt *is* the value (no reinterpret) — so it stays unmarked.
+    const resultReinterpret = resultPtr || resultBool || resultDynamic
+    // i64 carrier per param: pointer-ABI (offset) or a dynamic f64 param (boundaryI64).
+    const paramIsI64 = (p) => !p.jsstring && (p.ptrKind != null || p.boundaryI64)
     // Inline `(export ...)` attribute only when the func decl carried the
     // inline-export keyword (`export function foo`). For re-exports
     // (`function foo; export { foo as bar }`) the `name` is the *internal*
@@ -1118,26 +1212,58 @@ function synthesizeBoundaryWrappers() {
     const wrapNode = func.exported
       ? ['func', `$${name}$exp`, ['export', `"${name}"`]]
       : ['func', `$${name}$exp`]
-    // jsstring params flow as externref end-to-end; every other boundary value is f64.
-    sig.params.forEach((p) => {
-      wrapNode.push(['param', `$${p.name}`, p.jsstring ? 'externref' : 'f64'])
+    // jsstring params flow as externref end-to-end; boxed params ride i64; numbers f64.
+    const i64Params = []
+    sig.params.forEach((p, i) => {
+      wrapNode.push(['param', `$${p.name}`, p.jsstring ? 'externref' : paramIsI64(p) ? 'i64' : 'f64'])
+      if (paramIsI64(p)) i64Params.push(i)
     })
-    wrapNode.push(['result', resultBigint ? 'i64' : 'f64'])
+    // Track externref param positions so interop.js can pass JS values raw (skipping
+    // `mem.wrapVal`) at those slots — today only `jsstring` params; future externref carriers
+    // wire here too. `extParams` is per-slot: false | { def: '...' } for a JS-side default.
+    const extParams = sig.params.map(p => !p.jsstring ? false : p.jsstringDefault != null ? { def: p.jsstringDefault } : true)
+    if (extParams.some(Boolean)) func._exportExtParams = extParams
+    // Inner→wrapper argument list, shared by both single- and multi-value result shapes.
     const args = sig.params.map((p) => {
       const get = ['local.get', `$${p.name}`]
-      // jsstring: externref flows through unchanged — inner func also takes externref.
-      if (p.jsstring) return get
-      // ptrKind param: the f64 NaN-box carries the pointer — extract the i32 offset.
-      if (p.ptrKind != null) return ['i32.wrap_i64', ['i64.reinterpret_f64', get]]
+      if (p.jsstring) return get                              // externref flows through unchanged
+      if (p.ptrKind != null) return ['i32.wrap_i64', get]     // ptr param: inner takes the i32 offset
+      if (p.boundaryI64) return ['f64.reinterpret_i64', get]  // dynamic boxed param → f64 NaN-box carrier
       if (p.type === 'f64') return get
-      // Numeric narrowing: f64 → i32 truncate
-      return ['i32.trunc_sat_f64_s', get]
+      return ['i32.trunc_sat_f64_s', get]                     // numeric narrowing f64 → i32
     })
     const callIR = ['call', `$${name}`, ...args]
+    // Multi-value return: each lane is an f64 NaN-box carrier (every `return [a,b,…]` lane is
+    // asF64; narrowing only touches single-result funcs). A boxed lane's NaN payload is erased
+    // at the JS boundary, so cross EVERY lane as i64 — capture the inner call's N lanes into f64
+    // locals (last result on top of the stack ⇒ pop in reverse) and re-push each reinterpreted.
+    // interop reads the lane tuple via mem.read / decode (both map over an array result).
+    if (sig.results.length > 1) {
+      sig.results.forEach(() => wrapNode.push(['result', 'i64']))
+      // Lane temporaries — guaranteed distinct from the wrapper's params (jz doesn't reserve
+      // `__`, so a user param could be `__mlane0`): bump the prefix until no lane name collides.
+      const pnames = new Set(sig.params.map((p) => p.name))
+      let pfx = '__mlane'
+      while (sig.results.some((_, i) => pnames.has(`${pfx}${i}`))) pfx = `_${pfx}`
+      const lanes = sig.results.map((_, i) => `$${pfx}${i}`)
+      lanes.forEach((n) => wrapNode.push(['local', n, 'f64']))
+      const stmts = [callIR]
+      for (let i = lanes.length - 1; i >= 0; i--) stmts.push(['local.set', lanes[i]])
+      for (const n of lanes) stmts.push(['i64.reinterpret_f64', ['local.get', n]])
+      wrapNode.push(...stmts)
+      // `m` (lane count) marks a multi-value result so interop / the test adapter decode each
+      // lane (vs `r`'s single reinterpret). Always recorded — even with no i64 params — so the
+      // numeric-only `(a,b)=>[a+1,b+2]` tuple still gets its lanes turned back into numbers.
+      func._exportI64 = { p: i64Params, m: sig.results.length }
+      wrappers.push(wrapNode)
+      continue
+    }
+    wrapNode.push(['result', resultI64 ? 'i64' : 'f64'])
+    const toI64 = (n) => ['i64.reinterpret_f64', n]
     let body
-    if (sig.ptrKind != null) {
+    if (resultPtr) {
       const ptrType = valKindToPtr(sig.ptrKind)
-      body = mkPtrIR(ptrType, sig.ptrAux ?? 0, callIR)
+      body = toI64(mkPtrIR(ptrType, sig.ptrAux ?? 0, callIR))
     } else if (resultBool) {
       // The inner func returns a clean 0/1 boolean carrier — never NaN. The i32
       // carrier already takes truthyIR's identity path; the f64 carrier would
@@ -1147,28 +1273,22 @@ function synthesizeBoundaryWrappers() {
       const carrier = sig.results[0] === 'i32'
         ? typed(callIR, 'i32')
         : typed(['f64.ne', callIR, ['f64.const', 0]], 'i32')
-      body = boolBoxIR(carrier)
-    } else if (resultBigint) {
-      // BigInt rides the i64-reinterpret-f64 carrier internally; expose the raw i64 at the JS
-      // boundary so the host receives a real, lossless BigInt (wasm i64 <-> JS BigInt). Internal
-      // callers use `$name` (the f64 carrier) untouched; only the `$exp` export result is i64.
-      body = ['i64.reinterpret_f64', callIR]
+      body = toI64(boolBoxIR(carrier))
+    } else if (resultBigint || resultDynamic) {
+      // BigInt rides the i64-reinterpret-f64 carrier internally; a dynamic result is already an
+      // f64 NaN-box carrier. Either way expose the raw i64 at the JS boundary for a lossless
+      // value. Internal callers use `$name` (the f64 carrier) untouched; only `$exp` is i64.
+      body = toI64(callIR)
     } else if (sig.results[0] === 'i32') {
       body = [sig.unsignedResult ? 'f64.convert_i32_u' : 'f64.convert_i32_s', callIR]
     } else {
       body = callIR
     }
     wrapNode.push(body)
-    // Track externref param positions so interop.js can pass JS values
-    // raw (skipping `mem.wrapVal`) at those slots. Today this only fires
-    // for `jsstring`-tagged params; future externref carriers wire here too.
-    // `extParams` is per-slot: false (non-ext) | { def: '...' }-bearing object
-    // for jsstring params with a JS-side default substitution.
-    const extParams = sig.params.map(p => {
-      if (!p.jsstring) return false
-      return p.jsstringDefault != null ? { def: p.jsstringDefault } : true
-    })
-    if (extParams.some(Boolean)) func._exportExtParams = extParams
+    // Record the i64 carrier map for interop.js (jz:i64exp). A pure-numeric export
+    // (no i64 params, f64 result) records nothing — zero footprint off the box path.
+    if (i64Params.length || resultReinterpret)
+      func._exportI64 = { p: i64Params, r: resultReinterpret ? 1 : 0 }
     wrappers.push(wrapNode)
   }
   return wrappers
@@ -1709,6 +1829,7 @@ export default function compile(ast, profiler) {
   ensureThrowRuntime(sec)
 
   timePhase(profiler, 'optimizeModule', () => optimizeModule(sec, profiler))
+  if (ctx.transform.helperCallsites) instrumentHelperCallsites([...sec.funcs, ...sec.stdlib, ...sec.start])
 
   // Fold constant `__start` global inits into immutable inline decls (drops the
   // store, and `__start` with it when that empties it). Runs HERE — after
@@ -1733,6 +1854,11 @@ export default function compile(ast, profiler) {
       [`${ty}.const`, g.init]]
   }))
 
+  // Drop the Eisel-Lemire decimal table if no live code parses decimals at runtime — must
+  // run after sec.globals/funcs are final (exact reachability) and before the data segment
+  // below serializes ctx.runtime.data. See stripDeadElTable.
+  stripDeadElTable(sec)
+
   // Data segments (after emit — string literals append to ctx.runtime.data / strPool during emit)
   // Active segment at address 0 — skipped for shared memory (would collide across modules)
   const escBytes = (s) => {
@@ -1817,6 +1943,23 @@ export default function compile(ast, profiler) {
   if (extExports.length)
     sec.customs.push(['@custom', '"jz:extparam"', `"${JSON.stringify(extExports).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
 
+  // jz:i64exp — per-export i64 carrier map (NaN-canonicalization dodging). Each entry
+  // `{name, p:[i64 param indices], r:1? | m:N?}`: `p` lists params interop must pass as BigInt
+  // (f64ToI64); `r` marks a single result to reinterpret (i64ToF64) before mem.read; `m` marks
+  // an N-lane multi-value result whose lanes interop/the adapter decode element-wise. Pure-
+  // numeric single-result exports emit no entry. A bigint result is i64 but unmarked (the BigInt
+  // is the value). Written under every JS-visible alias, like jz:extparam. Each shape is built as
+  // a direct literal (no spread) — the self-host kernel's fixed schemas don't enumerate post-hoc keys.
+  const i64Exports = []
+  for (const f of ctx.func.list) {
+    if (!isExported(f) || !isBoundaryWrapped(f) || !f._exportI64) continue
+    const { p, r, m } = f._exportI64
+    for (const exportName of exportNamesOf(f.name))
+      i64Exports.push(m ? { name: exportName, p, m } : r ? { name: exportName, p, r } : { name: exportName, p })
+  }
+  if (i64Exports.length)
+    sec.customs.push(['@custom', '"jz:i64exp"', `"${JSON.stringify(i64Exports).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`])
+
   // Named export aliases: export { name } or export { source as alias }
   for (const [name, val] of Object.entries(ctx.func.exports)) {
     if (wasiCommandExports.has(name)) continue

package/src/compile/infer.js

@@ -130,11 +130,18 @@ export const inferParams = (body, candidates) => {
 // regardless of prior evidence — a later method call can't re-induce a shape
 // already contradicted by an earlier scalar assignment.
 
+// Methods that exist ONLY on String.prototype — seeing one on a bare binding proves
+// it is a string. `indexOf`/`includes`/`lastIndexOf`/`concat`/`slice`/`at` are NOT here:
+// Array.prototype has them too, so the receiver is genuinely ambiguous (and the argument
+// can't disambiguate — String coerces it, Arrays hold strings). Those keep the runtime
+// __ptr_type fork, which is correct for both; forcing `lastIndexOf` to string here used to
+// miscompile `arr.lastIndexOf(x)` to -1. A string-using param still narrows via any of the
+// real discriminators below (charCodeAt, a string assignment, a string-passing call site).
 const STRING_ONLY_METHODS = new Set([
   'charCodeAt', 'charAt', 'codePointAt', 'startsWith', 'endsWith',
   'toUpperCase', 'toLowerCase', 'toLocaleLowerCase', 'normalize', 'localeCompare',
   'padStart', 'padEnd', 'repeat', 'trimStart', 'trimEnd', 'trim',
-  'matchAll', 'match', 'replace', 'replaceAll', 'split', 'lastIndexOf',
+  'matchAll', 'match', 'replace', 'replaceAll', 'split',
 ])
 const ARRAY_ONLY_POISON = new Set([
   'push', 'pop', 'shift', 'unshift', 'splice', 'sort', 'fill', 'reverse',

package/src/compile/loop-divmod.js

@@ -20,64 +20,33 @@
 // hole = undefined), so literal tests use `== null`; created literals are bare numbers.
 
 import { findMutations } from './analyze-scans.js'
+import { litN, unitIncVar, normalizeLoop, closureMutatedVars, rewriteBlocks, freshLoopId } from './loop-model.js'
 
-const litN = (n, k) => Array.isArray(n) && n.length === 2 && n[0] == null && n[1] === k
 const isMod = (n, i, w) => Array.isArray(n) && n[0] === '%' && n[1] === i && n[2] === w
 const isFloorDiv = (n, i, w) =>
   Array.isArray(n) && n[0] === '|' && litN(n[2], 0) &&
   Array.isArray(n[1]) && n[1][0] === '/' && n[1][1] === i && n[1][2] === w
 
-// IV a statement increments by exactly +1, or null. Covers `i++` (post-inc desugars
-// to `(++i) - 1`), `++i`, `i += 1`, `i = i + 1`.
-function incVarOf(stmt) {
-  if (!Array.isArray(stmt)) return null
-  let inc = stmt
-  if (stmt[0] === '-' && litN(stmt[2], 1) && Array.isArray(stmt[1]) && stmt[1][0] === '++') inc = stmt[1]
-  if (inc[0] === '++' && typeof inc[1] === 'string') return inc[1]
-  if (stmt[0] === '+=' && typeof stmt[1] === 'string' && litN(stmt[2], 1)) return stmt[1]
-  if (stmt[0] === '=' && typeof stmt[1] === 'string' && Array.isArray(stmt[2]) && stmt[2][0] === '+') {
-    const [, a, b] = stmt[2]
-    if (a === stmt[1] && litN(b, 1)) return stmt[1]
-    if (b === stmt[1] && litN(a, 1)) return stmt[1]
-  }
-  return null
-}
-
 const usesPattern = (n, i, w, pred) => Array.isArray(n) && (pred(n, i, w) || n.some(c => usesPattern(c, i, w, pred)))
 const replace = (n, i, w, cx, cy) =>
   !Array.isArray(n) ? n : isMod(n, i, w) ? cx : isFloorDiv(n, i, w) ? cy : n.map(c => replace(c, i, w, cx, cy))
 // a `continue` that targets THIS loop (not one nested inside) — would skip the increment
 const hasOuterContinue = (n) => Array.isArray(n) &&
   (n[0] === 'continue' || (n[0] !== 'while' && n[0] !== 'for' && n[0] !== 'do' && n[0] !== '=>' && n.some(hasOuterContinue)))
-// Vars assigned anywhere inside a closure in the function. Such a var can be
-// mutated by a call in the loop body (the closure may be defined outside the loop,
-// so a body-local findMutations misses it), so it is not safe as the IV or divisor.
-const ASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '**=', '&=', '|=', '^=', '<<=', '>>=', '>>>=', '&&=', '||=', '??='])
-const collectAssigns = (n, out) => {
-  if (!Array.isArray(n)) return
-  if (typeof n[1] === 'string' && (ASSIGN_OPS.has(n[0]) || n[0] === '++' || n[0] === '--')) out.add(n[1])
-  n.forEach(c => collectAssigns(c, out))
-}
-const closureMutated = (n, out) => {
-  if (!Array.isArray(n)) return out
-  if (n[0] === '=>') collectAssigns(n, out)
-  n.forEach(c => closureMutated(c, out))
-  return out
-}
 
-let _uniq = 0
-let _cm = new Set()  // closure-mutated vars for the function currently being transformed
 
-// Try to strength-reduce one `while` statement. Returns [seed, loop] or null.
-function tryReduce(stmt) {
-  if (!Array.isArray(stmt) || stmt[0] !== 'while') return null
-  const cond = stmt[1], lbody = stmt[2]
+// Try to strength-reduce one `while` statement. Returns [seed, loop] or null. `cm` is
+// the function's closure-mutated-vars set (an IV/divisor in it is unsafe).
+function tryReduce(stmt, cm) {
+  const L = normalizeLoop(stmt)
+  if (!L || L.kind !== 'while') return null
+  const cond = L.cond, lbody = L.body
   if (!Array.isArray(lbody) || lbody[0] !== ';') return null
 
   // exactly one IV incremented by +1
   let iv = null, ivIdx = -1
   for (let k = 1; k < lbody.length; k++) {
-    const v = incVarOf(lbody[k])
+    const v = unitIncVar(lbody[k])
     if (v) { if (iv) return null; iv = v; ivIdx = k }
   }
   if (!iv) return null
@@ -105,9 +74,9 @@ function tryReduce(stmt) {
   findMutations([';', ...lbody.slice(1).filter((_, k) => k !== ivIdx - 1)], new Set([iv]), ivMut)
   if (ivMut.has(iv)) return null
   if (hasOuterContinue(lbody)) return null
-  if (_cm.has(iv) || _cm.has(w)) return null  // IV/divisor mutable via a closure call
+  if (cm.has(iv) || cm.has(w)) return null  // IV/divisor mutable via a closure call
 
-  const id = _uniq++
+  const id = freshLoopId()
   const cx = `__lsrx${id}`, cy = `__lsry${id}`
   // seed (inside the w>0 branch): cx = (i%w)|0, cy = (i/w)|0 — one-time, i32 via |0
   const seedDecls = [['=', cx, ['|', ['%', iv, w], 0]]]
@@ -134,22 +103,7 @@ function tryReduce(stmt) {
   return [['if', ['&&', ['>', w, 0], ['>=', iv, 0]], ['{}', [';', seed, fast]], stmt]]
 }
 
-// Walk the body; transform `while` loops inside every block (post-order so a nested
-// loop is reduced before its enclosing one is examined).
-function walk(node) {
-  if (!Array.isArray(node)) return node
-  const n = node.map(walk)
-  if (n[0] !== ';') return n
-  const out = [';']
-  for (let k = 1; k < n.length; k++) {
-    const r = tryReduce(n[k])
-    if (r) out.push(...r)
-    else out.push(n[k])
-  }
-  return out
-}
-
 export function strengthReduceLoopDivMod(body) {
-  _cm = closureMutated(body, new Set())
-  return walk(body)
+  const cm = closureMutatedVars(body)
+  return rewriteBlocks(body, stmt => tryReduce(stmt, cm))
 }

package/src/compile/loop-model.js

@@ -0,0 +1,91 @@
+// Shared AST-level loop primitives for the per-function loop transforms
+// (loop-divmod, loop-square, peel-stencil). Operates on the post-prepare AST.
+//
+// Each of those passes recognizes one narrow loop idiom and rewrites it, but they had
+// re-derived the same building blocks verbatim: the `[, v]` number-literal-hole
+// recognizer, the "+1 induction variable" matcher, the closure-mutated-variable
+// analysis (a var assigned inside any `=>` may be mutated by a call in the loop, so it
+// is unsafe as an IV/bound/divisor), the while/for structural normalizer, and the
+// post-order block walk that applies a per-statement rewrite. One home for all of them
+// — adding the next loop transform is then one recognizer over these, not a fourth copy.
+
+import { ASSIGN_OPS } from '../ast.js'
+import { ctx } from '../ctx.js'
+
+// Fresh id for a loop transform's generated locals (`__lsrx<id>`, `__pks<id>`, …). Backed by
+// a per-compile counter (reset in ctx.reset), NOT a module-global: a module-`let` counter
+// grows unbounded across a long-lived host and makes compile(P) non-deterministic — its output
+// names depend on how many programs were compiled before it. Distinct prefixes keep the shared
+// id space collision-free across transforms.
+export const freshLoopId = () => ctx.transform.loopXformId++
+
+// Post-prepare number literals are sparse-array holes `[<hole>, v]` (length 2, the op
+// slot `n[0]` is the elided hole == null). `litVal` returns the numeric value or null;
+// `litN(n, k)` tests for the exact literal `k`.
+export const litVal = (n) => Array.isArray(n) && n.length === 2 && n[0] == null && typeof n[1] === 'number' ? n[1] : null
+export const litN = (n, k) => Array.isArray(n) && n.length === 2 && n[0] == null && n[1] === k
+
+// The induction variable a statement increments by exactly +1, else null. Covers
+// `i++` (post-inc desugars to `(++i) - 1`), `++i`, `i += 1`, `i = i + 1` / `i = 1 + i`.
+export function unitIncVar(stmt) {
+  if (!Array.isArray(stmt)) return null
+  let inc = stmt
+  if (stmt[0] === '-' && litN(stmt[2], 1) && Array.isArray(stmt[1]) && stmt[1][0] === '++') inc = stmt[1]
+  if (inc[0] === '++' && typeof inc[1] === 'string') return inc[1]
+  if (stmt[0] === '+=' && typeof stmt[1] === 'string' && litN(stmt[2], 1)) return stmt[1]
+  if (stmt[0] === '=' && typeof stmt[1] === 'string' && Array.isArray(stmt[2]) && stmt[2][0] === '+') {
+    const [, a, b] = stmt[2]
+    if (a === stmt[1] && litN(b, 1)) return stmt[1]
+    if (b === stmt[1] && litN(a, 1)) return stmt[1]
+  }
+  return null
+}
+
+// Normalize a `while` / flat `for` (`['for', init, cond, update, body]`) into a common
+// shape, else null. `init`/`step` are null for a while; a `for` with fewer than the 5
+// flat slots (no body) is not a loop here.
+export function normalizeLoop(stmt) {
+  if (!Array.isArray(stmt)) return null
+  if (stmt[0] === 'while') return { kind: 'while', init: null, cond: stmt[1], step: null, body: stmt[2] }
+  if (stmt[0] === 'for' && stmt.length >= 5) return { kind: 'for', init: stmt[1], cond: stmt[2], step: stmt[3], body: stmt[4] }
+  return null
+}
+
+// Variables assigned anywhere inside a closure (`=>`) in `body`. A call in the loop can
+// mutate such a var even though a direct-write scan (findMutations) misses it (the
+// closure may be defined outside the loop), so an IV / bound / divisor in this set is
+// unsafe to strength-reduce. (ASSIGN_OPS plus the `++`/`--` updates.)
+export function closureMutatedVars(body) {
+  const out = new Set()
+  const collect = (n) => {
+    if (!Array.isArray(n)) return
+    if (typeof n[1] === 'string' && (ASSIGN_OPS.has(n[0]) || n[0] === '++' || n[0] === '--')) out.add(n[1])
+    n.forEach(collect)
+  }
+  const walk = (n) => {
+    if (!Array.isArray(n)) return
+    if (n[0] === '=>') collect(n)
+    n.forEach(walk)
+  }
+  walk(body)
+  return out
+}
+
+// Post-order block rewriter: walk `body`; for every `;`-sequence, apply `tryStmt` to
+// each statement. A truthy result is an ARRAY of replacement statements spliced in
+// place; a falsy result keeps the statement unchanged. Children are rewritten first, so
+// a nested loop is transformed before the block that encloses it.
+export function rewriteBlocks(body, tryStmt) {
+  const walk = (node) => {
+    if (!Array.isArray(node)) return node
+    const n = node.map(walk)
+    if (n[0] !== ';') return n
+    const out = [';']
+    for (let k = 1; k < n.length; k++) {
+      const r = tryStmt(n[k])
+      if (r) out.push(...r); else out.push(n[k])
+    }
+    return out
+  }
+  return walk(body)
+}