jz 0.7.0 → 0.8.1

package/src/prepare/index.js

@@ -169,7 +169,7 @@ const addHostImport = (mod, name, alias, spec) => {
   // ABI — record it so references fold to an f64 literal (see prep's identifier resolution) instead
   // of emitting a 0-arg func import that can't be read as a value ("'PI' is not in scope").
   if (typeof spec === 'number') {
-    if (!ctx.scope.hostConsts) ctx.scope.hostConsts = {}
+    if (!ctx.scope.hostConsts) ctx.scope.hostConsts = Object.create(null)  // name-keyed: prototype-less (see derive)
     ctx.scope.hostConsts[alias] = spec
     return
   }
@@ -196,6 +196,19 @@ const stripBoolNot = c => {
   while (Array.isArray(c) && c[0] === '!' && Array.isArray(c[1]) && c[1][0] === '!') c = c[1][1]
   return c
 }
+// In a statement (value-discarded) position, postfix `x++`/`x--` is lowered to `(++x) − 1` /
+// `(--x) + 1` to recover the old value — but nobody reads it, so drop the ∓1 and keep the bare
+// increment. (`obj.p++` lowers via `obj.p = obj.p + 1`, also wrapped.) Cleaner AST for the loop/
+// recurrence passes; codegen already discarded the ∓1, so this is purely canonicalization.
+const isOne = n => Array.isArray(n) && n[0] == null && n[1] === 1
+const dropDeadPostfix = s => {
+  if (Array.isArray(s) && s.length === 3 && isOne(s[2]) && Array.isArray(s[1])) {
+    const inner = s[1][0]
+    if ((s[0] === '-' && (inner === '++' || inner === '=')) ||
+        (s[0] === '+' && (inner === '--' || inner === '='))) return s[1]
+  }
+  return s
+}
 const stringValue = node => Array.isArray(node) && node[0] == null && typeof node[1] === 'string' ? node[1] : null
 const MUTATING_ARRAY_METHODS = new Set(['copyWithin', 'fill', 'pop', 'push', 'reverse', 'shift', 'sort', 'splice', 'unshift'])
 
@@ -590,9 +603,13 @@ export default function prepare(node) {
 
 // Named constants → numeric literals. The JZ_NULL/JZ_UNDEF atom sentinels live
 // in ast.js — shared with emit without crossing the prepare↔compile boundary.
-const CONSTANTS = { 'true': true, 'false': false, 'null': JZ_NULL, 'undefined': JZ_UNDEF }
+// Prototype-less (Object.create(null)): a plain `{}` inherits Object.prototype in V8, so
+// `'valueOf' in CONSTANTS` / `CONSTANTS['toString']` would hit an inherited method and
+// mis-resolve a user identifier named like an Object method (jz.js-only — kernel objects
+// are already prototype-less). Same reason on F64_CONSTANTS / GLOBALS / REJECT_IDENTS.
+const CONSTANTS = Object.assign(Object.create(null), { 'true': true, 'false': false, 'null': JZ_NULL, 'undefined': JZ_UNDEF })
 // NaN/Infinity stay as special f64 values in emit()
-const F64_CONSTANTS = { 'NaN': NaN, 'Infinity': Infinity }
+const F64_CONSTANTS = Object.assign(Object.create(null), { 'NaN': NaN, 'Infinity': Infinity })
 
 /** Resolve variable name through block scope chain (innermost rename wins). */
 function resolveScope(name) {
@@ -848,7 +865,7 @@ function prep(node) {
 // Not actually "implicit imports" — these are ambient globals that exist in every jz/JS
 // program (they do not live in any module). jzify auto-injecting imports would still
 // need a list of these names to know what to emit, so the table lives here either way.
-export const GLOBALS = {
+export const GLOBALS = Object.assign(Object.create(null), {
   Math: 'math',
   Number: 'Number',
   Array: 'Array',
@@ -878,7 +895,7 @@ export const GLOBALS = {
   BigInt: 'BigInt',
   TextEncoder: 'TextEncoder',
   TextDecoder: 'TextDecoder',
-}
+})
 
 const patternItems = (node) => node?.[0] === ',' ? node.slice(1) : [node]
 const isDestructPattern = (node) => Array.isArray(node) && (node[0] === '[]' || node[0] === '{}')
@@ -1583,7 +1600,7 @@ const handlers = {
       if (Array.isArray(specifiers) && specifiers[0] === 'as' && specifiers[1] === '*') {
         const alias = specifiers[2]
         // Store namespace mapping so '.' handler can resolve X.prop → mangled name
-        if (!ctx.module.namespaces) ctx.module.namespaces = {}
+        if (!ctx.module.namespaces) ctx.module.namespaces = Object.create(null)  // name-keyed: prototype-less (see derive)
         ctx.module.namespaces[alias] = resolved.exports
         return null
       }
@@ -1632,20 +1649,20 @@ const handlers = {
   '!=='(a, b) { return prepStrictEq('!==', a, b) },
 
   // Statements
-  ';': (...stmts) => [';', ...stmts.map(prep).filter(x => x != null)],
+  ';': (...stmts) => [';', ...stmts.map(prep).filter(x => x != null).map(dropDeadPostfix)],
   'let': (...inits) => prepDecl('let', ...inits),
   'const': (...inits) => prepDecl('const', ...inits),
 
   // Block-scoped control flow: push scope for bodies so inner let/const shadows correctly
   'if': (cond, then, els) => {
     const c = prep(stripBoolNot(cond))
-    pushScope(); const t = prep(then); popScope()
-    if (els != null) { pushScope(); const e = prep(els); popScope(); return ['if', c, t, e] }
+    pushScope(); const t = dropDeadPostfix(prep(then)); popScope()
+    if (els != null) { pushScope(); const e = dropDeadPostfix(prep(els)); popScope(); return ['if', c, t, e] }
     return ['if', c, t]
   },
   'while': (cond, body) => {
     const c = prep(stripBoolNot(cond))
-    pushScope(); const b = prep(body); popScope()
+    pushScope(); const b = dropDeadPostfix(prep(body)); popScope()
     return ['while', c, b]
   },
   // do { body } while (cond) → flag-guarded while: `flag=true; while (flag||cond) { flag=false; body }`.
@@ -2123,7 +2140,7 @@ const handlers = {
           }
         }
       }
-      r = ['for', init ? prep(init) : null, cond ? prep(cond) : null, step ? prep(step) : null, prep(body)]
+      r = ['for', init ? prep(init) : null, cond ? prep(cond) : null, step ? dropDeadPostfix(prep(step)) : null, dropDeadPostfix(prep(body))]
     } else if (Array.isArray(head) && head[0] === 'of') {
       // for (let x of arr) → hoist arr (if non-trivial) and arr.length once, iterate by index.
       // Divergence from JS: mutating arr during iteration won't extend/shorten the loop.
@@ -2466,7 +2483,7 @@ function prepareModule(specifier, source) {
   const savedFuncCount = ctx.func.list.length  // track new funcs from this module
   const savedModulePrefix = ctx.module.currentPrefix
   ctx.scope.chain = derive(savedScope)  // inherit parent scope
-  ctx.func.exports = {}
+  ctx.func.exports = Object.create(null)  // name-keyed: prototype-less (see derive)
   ctx.module.currentPrefix = prefix
 
   try {

package/src/reps.js

@@ -57,6 +57,9 @@ export const VAL = {
  * @property {number}  [arrayElemSchema]  element object-schema id for arrays.
  * @property {string}  [arrayElemValType] element VAL.* kind for arrays.
  * @property {string}  [arrayElemElemValType] nested element VAL.* kind (`X[i][j]`) for arrays of arrays.
+ * @property {string}  [arrayElemTypedCtor] element TypedArray ctor (`new.Float32Array`) for an
+ *   array whose elements are all typed arrays of one ctor (`Array.from(n,()=>new Float32Array())`),
+ *   so `arr[i]` is a known typed array and `arr[i][j]` inlines instead of runtime aux-dispatch.
  * @property {string}  [carrier]          abi carrier id override (e.g. 'jsstring').
  * @property {boolean} [unsigned]         i32 carries an unsigned value (`>>>` result).
  * @property {*}       [jsonShape]        inferred shape for the JSON.stringify fast path.
@@ -68,7 +71,7 @@ export const VAL = {
  */
 export const REP_FIELDS = new Set([
   'val', 'ptrKind', 'ptrAux', 'schemaId', 'intConst', 'intCertain', 'notString',
-  'arrayElemSchema', 'arrayElemValType', 'arrayElemElemValType', 'carrier', 'unsigned', 'jsonShape',
+  'arrayElemSchema', 'arrayElemValType', 'arrayElemElemValType', 'arrayElemTypedCtor', 'carrier', 'unsigned', 'jsonShape',
   'typedCtor', 'wasm', 'nullable', 'neverGrown',
 ])
 

package/src/type.js

@@ -12,8 +12,10 @@
  */
 import { isI32, isReassigned } from './ast.js'
 import { ctx } from './ctx.js'
+import { FITS_I32_MAX } from './widen.js'
 import { VAL, lookupValType } from './reps.js'
 import { valTypeOf } from './kind.js'
+import { propValType, CMP_OPS } from './kind-traits.js'
 import { NO_VALUE, staticValue, intLiteralValue } from './static.js'
 import { typedElemAux } from '../layout.js'
 
@@ -362,9 +364,24 @@ export function isTerminator(body) {
   return false
 }
 
-const isUnsignedI32Expr = (e) => Array.isArray(e) && (
+// Resolve a name's typed-array element ctor: in-progress local overlay (analyzeBody) →
+// per-func map (post-analyze) → module-global registry. The global fallback matters during
+// analyzeBody/narrow when the per-func map is null, so a read of a *global* typed array
+// (`DX[i]` with `let DX = new Int32Array(...)` at module scope) resolves its element type
+// instead of defaulting to f64. Guard against local shadows / dynamic rewrites (cf. kind.js).
+const typedElemCtorOf = (name, locals) =>
+  ctx.func.localTypedElemsOverlay?.get(name) ?? ctx.types.typedElem?.get(name)
+    ?? (!locals?.has?.(name) && !ctx.types?.dynWriteVars?.has?.(name)
+      ? ctx.scope?.globalTypedElem?.get(name) : undefined)
+
+// An expression whose i32 value carries the unsigned [0, 2^32) magnitude (not a signed i32):
+// `>>>`, an unsigned-result call, or a Uint32Array read (aux 5 — the only typed array whose
+// element can exceed signed-i32 range). The +/-/*/% rules widen these to f64 so `U[i] + 1`
+// near 2^32 doesn't wrap; bitwise/store consumers are ToInt32-exact and keep the i32 bits.
+const isUnsignedI32Expr = (e, locals) => Array.isArray(e) && (
   e[0] === '>>>' ||
-  (e[0] === '()' && typeof e[1] === 'string' && ctx.func.map?.get(e[1])?.sig?.unsignedResult === true)
+  (e[0] === '()' && typeof e[1] === 'string' && ctx.func.map?.get(e[1])?.sig?.unsignedResult === true) ||
+  (e[0] === '[]' && typeof e[1] === 'string' && typedElemAux(typedElemCtorOf(e[1], locals)) === 5)
 )
 
 /**
@@ -380,12 +397,16 @@ export function exprType(expr, locals) {
     if (locals?.has?.(expr)) return locals.get(expr)
     const paramType = ctx.func.current?.params?.find(p => p.name === expr)?.type
     if (paramType) return paramType
-    // Module-level numeric consts (top-level `const N = 128`) are emitted as
-    // wasm globals with a known wasm type. Without this lookup, references to
-    // them inside functions fall back to f64, widening counters bounded by the
-    // const (`for (let r = 0; r < N_ROUNDS; r++)`) to f64 via the comparison
-    // pass. Only propagate primitive numeric kinds — i64 globals are reserved
-    // for the NaN-box carrier ABI and shouldn't influence local typing.
+    // A module-level INTEGER const (`const N = 16384`) is an integer compile-time
+    // constant — type it i32 when it fits, regardless of the global's f64 (NaN-box)
+    // storage. Otherwise a counter bounded by it (`for (i=0; i<N; i++)`) widens to
+    // f64 and `x % N` / `x & N` / `x / N` take the f64 round-trip instead of the
+    // native integer path (i32.rem_s / i32.and / i32.shr). Mirrors a literal int.
+    const ci = ctx.scope?.constInts?.get?.(expr)
+    if (ci != null && isI32(ci)) return 'i32'
+    // Module-level numeric consts emitted as wasm globals with a known wasm type.
+    // Only propagate primitive numeric kinds — i64 globals are reserved for the
+    // NaN-box carrier ABI and shouldn't influence local typing.
     const gt = ctx.scope?.globalTypes?.get?.(expr)
     if (gt === 'i32' || gt === 'f64') return gt
     return 'f64'
@@ -411,7 +432,10 @@ export function exprType(expr, locals) {
   // localTypedElemsOverlay during analyzeBody; post-analyze passes read ctx.types.typedElem.
   if (op === '[]') {
     if (typeof args[0] === 'string') {
-      const ctor = ctx.func.localTypedElemsOverlay?.get(args[0]) ?? ctx.types.typedElem?.get(args[0])
+      // Resolve the element ctor across local overlay → per-func map → module-global registry
+      // (the global fallback is why `DX[i]` on a module-scope Int32Array types as i32 instead of
+      // f64-round-tripping integer accumulation like `ax = ax + DX[i]`). See typedElemCtorOf.
+      const ctor = typedElemCtorOf(args[0], locals)
       if (ctor) {
         const aux = typedElemAux(ctor)
         if (aux != null && (aux & 7) <= 5) return 'i32'
@@ -419,30 +443,20 @@ export function exprType(expr, locals) {
     }
     return 'f64'
   }
-  // `.length` on a known sized receiver returns i32 directly (__len/__str_byteLen
-  // both return i32). Letting it stay i32 lets analyzeBody keep the counter
-  // local i32 too, eliminating the per-iteration `f64.convert_i32_s` widen and
-  // the matching `i32.trunc_sat_f64_s` truncs at every `arr[i]` / `i*k` site.
-  // Only safe when receiver type is statically known to expose an integer length.
+  // A sized built-in property on a statically-known receiver (`.length` on
+  // STRING/ARRAY/TYPED, `.size` on SET/MAP, `.byteLength`/`.byteOffset` on
+  // TYPED/BUFFER) returns i32 directly (`__len`/`__str_byteLen` return i32).
+  // Keeping it i32 lets analyzeBody keep the counter local i32, eliminating the
+  // per-iteration `f64.convert_i32_s` widen and matching `arr[i]`/`i*k` truncs.
+  // The membership lives in one place — `propValType` (src/kind-traits.js).
   if (op === '.') {
-    if (args[1] === 'length' && typeof args[0] === 'string') {
-      const vt = lookupValType(args[0])
-      if (vt === VAL.TYPED || vt === VAL.ARRAY || vt === VAL.STRING || vt === VAL.BUFFER) return 'i32'
-    }
-    if (args[1] === 'size' && typeof args[0] === 'string') {
-      const vt = lookupValType(args[0])
-      if (vt === VAL.SET || vt === VAL.MAP) return 'i32'
-    }
-    if (args[1] === 'byteLength' && typeof args[0] === 'string') {
-      const vt = lookupValType(args[0])
-      if (vt === VAL.BUFFER || vt === VAL.TYPED) return 'i32'
-    }
+    if (typeof args[0] === 'string' && propValType(args[1], lookupValType(args[0])) === VAL.NUMBER) return 'i32'
     return 'f64'
   }
   // Comparisons, logical-not, and unsigned shift always yield an i32 — a boolean,
   // or a ToUint32 result. True even on BigInt operands (`>>>` throws on bigint, so
   // it never reaches here with one).
-  if (['>', '<', '>=', '<=', '==', '!=', '!', '>>>'].includes(op)) return 'i32'
+  if (CMP_OPS.has(op) || op === '>>>') return 'i32'
   // Bitwise & signed-shift: i32 on numbers, but f64 when operands are BigInt — the
   // result is a bigint carried in the i64-bits-as-f64 ABI, not a 32-bit int.
   if (['&', '|', '^', '~', '<<', '>>'].includes(op))
@@ -455,7 +469,7 @@ export function exprType(expr, locals) {
     // A uint32 operand ([0, 2^32)) makes the result exceed signed i32 range, so
     // emit widens to f64 (see emit.js `+`/`-`). exprType must agree — else
     // narrowing the result back to i32 would trunc_sat-saturate the f64 to INT32_MAX.
-    if (isUnsignedI32Expr(args[0]) || (args[1] != null && isUnsignedI32Expr(args[1]))) return 'f64'
+    if (isUnsignedI32Expr(args[0], locals) || (args[1] != null && isUnsignedI32Expr(args[1], locals))) return 'f64'
     return 'i32'
   }
   // `%` is i32 only when emit takes the i32.rem_s path: both operands i32, neither
@@ -465,7 +479,7 @@ export function exprType(expr, locals) {
   if (op === '%') {
     const ta = exprType(args[0], locals), tb = exprType(args[1], locals)
     if (ta !== 'i32' || tb !== 'i32') return 'f64'
-    if (isUnsignedI32Expr(args[0]) || isUnsignedI32Expr(args[1])) return 'f64'
+    if (isUnsignedI32Expr(args[0], locals) || isUnsignedI32Expr(args[1], locals)) return 'f64'
     const dv = staticValue(args[1])
     return (dv !== NO_VALUE && typeof dv === 'number' && dv !== 0 && Number.isInteger(dv)) ? 'i32' : 'f64'
   }
@@ -478,11 +492,15 @@ export function exprType(expr, locals) {
     const ta = exprType(args[0], locals), tb = exprType(args[1], locals)
     if (ta !== 'i32' || tb !== 'i32') return 'f64'
     // uint32 operand: product can exceed i32; emit widens to f64 (see emit.js `*`).
-    if (isUnsignedI32Expr(args[0]) || isUnsignedI32Expr(args[1])) return 'f64'
+    if (isUnsignedI32Expr(args[0], locals) || isUnsignedI32Expr(args[1], locals)) return 'f64'
     if (sv !== NO_VALUE && typeof sv === 'number') return isI32(sv) ? 'i32' : 'f64'
+    // Shared FITS_I32_MAX threshold (widen.js) keeps this in lock-step with emit's
+    // `mulFitsI32`. exprType only proves the static-literal case — a strict SUBSET of
+    // emit's i32 verdict (emit also admits masked-bound operands), which is the safe
+    // direction: never claim i32 where emit might widen to f64.
     const small = e => {
       const v = staticValue(e)
-      return v !== NO_VALUE && typeof v === 'number' && Math.abs(v) <= 0x400000
+      return v !== NO_VALUE && typeof v === 'number' && Math.abs(v) <= FITS_I32_MAX
     }
     return small(args[0]) || small(args[1]) ? 'i32' : 'f64'
   }
@@ -531,7 +549,6 @@ export function exprType(expr, locals) {
 // === Integer-certainty fixpoint (shared by analyzeIntCertain + program-facts) ===
 
 const INT_BIT_OPS = new Set(['|', '&', '^', '~', '<<', '>>', '>>>'])
-const INT_CMP_OPS = new Set(['<', '>', '<=', '>=', '==', '!=', '===', '!==', '!'])
 const INT_CLOSED_OPS = new Set(['+', '-', '*'])  // `%` handled separately — int only for nonzero divisor
 const INT_MATH_FNS = new Set(['imul', 'clz32', 'floor', 'ceil', 'round', 'trunc'])
 
@@ -552,7 +569,7 @@ function collectIntDefs(body) {
     } else if (op === '=' && typeof args[0] === 'string') {
       pushDef(args[0], args[1])
     } else if (typeof op === 'string' && op.length > 1 && op.endsWith('=') &&
-               !INT_CMP_OPS.has(op) && op !== '=>' && typeof args[0] === 'string') {
+               !CMP_OPS.has(op) && op !== '=>' && typeof args[0] === 'string') {
       pushDef(args[0], [op.slice(0, -1), args[0], args[1]])
     } else if ((op === '++' || op === '--') && typeof args[0] === 'string') {
       pushDef(args[0], [op === '++' ? '+' : '-', args[0], [null, 1]])
@@ -578,18 +595,9 @@ function makeIsIntExpr(intCertain) {
       if (typeof v === 'boolean') return true
       return false
     }
-    if (INT_BIT_OPS.has(op) || INT_CMP_OPS.has(op)) return true
-    if (op === '.') {
-      if ((args[1] === 'length' || args[1] === 'byteLength') && typeof args[0] === 'string') {
-        const vt = lookupValType(args[0])
-        return vt === VAL.TYPED || vt === VAL.ARRAY || vt === VAL.STRING || vt === VAL.BUFFER
-      }
-      if (args[1] === 'size' && typeof args[0] === 'string') {
-        const vt = lookupValType(args[0])
-        return vt === VAL.SET || vt === VAL.MAP
-      }
-      return false
-    }
+    if (INT_BIT_OPS.has(op) || CMP_OPS.has(op)) return true
+    if (op === '.')
+      return typeof args[0] === 'string' && propValType(args[1], lookupValType(args[0])) === VAL.NUMBER
     if (INT_CLOSED_OPS.has(op)) {
       const a = isIntExpr(args[0])
       const b = args[1] != null ? isIntExpr(args[1]) : a

package/src/wat/assemble.js

@@ -39,6 +39,7 @@ import { VAL } from '../reps.js'
 import { optimizeFunc, collectVolatileGlobals, collectReachableGlobalWrites, hoistGlobalPtrOffset, stablePtrGlobalNames, hoistConstantPool, specializeMkptr, specializePtrBase, sortStrPoolByFreq, arenaRewindModule } from '../optimize/index.js'
 import { emit, emitVoid } from '../compile/emit.js'
 import { mkPtrIR, MAX_CLOSURE_ARITY, MEM_OPS, findBodyStart } from '../ir.js'
+import { installHelperCounters, instrumentHelperCounter } from '../helper-counters.js'
 
 // NaN-prefix top-13-bits as BigInt — used by the static-prefix-strip pass
 const NAN_PREFIX = BigInt(LAYOUT.NAN_PREFIX)
@@ -221,6 +222,7 @@ export function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
   // table holding only empty schemas is pure dead weight there. __json_obj has
   // no such guard — it must read the table whenever stringify is in play.
   const tblConsumed = hasStringify ||
+    ctx.core.includes.has('__obj_clone') ||
     ctx.core.includes.has('__dyn_get') ||
     ctx.core.includes.has('__dyn_get_t') ||
     ctx.core.includes.has('__dyn_get_t_h') ||
@@ -230,7 +232,13 @@ export function buildStartFn(ast, sec, closureFuncs, compilePendingClosures) {
     ctx.core.includes.has('__dyn_get_any_t_h') ||
     ctx.core.includes.has('__dyn_get_expr') ||
     ctx.core.includes.has('__dyn_get_expr_t') ||
-    ctx.core.includes.has('__dyn_get_or')
+    ctx.core.includes.has('__dyn_get_or') ||
+    // A string runtime-key WRITE `o[k]=v` whose `k` matches a schema field must
+    // mirror the value into the fixed schema slot (buildObjectSchemaSetArm), or a
+    // later static `o.x` read returns the stale slot. That mirror is gated on
+    // `$__schema_tbl != 0`, so a write-only module (no `__dyn_get*`) must still
+    // build the table. (needsSchemaTbl below skips it when every schema is empty.)
+    ctx.core.includes.has('__dyn_set')
   const needsSchemaTbl = (ctx.schema.list.length && tblConsumed &&
     (hasStringify || ctx.schema.list.some(s => s.length > 0))) ||
     hasJpObj
@@ -552,6 +560,7 @@ export function appendLateStdlib(moduleArr) {
  * Phase: pull stdlib + memory.
  */
 export function pullStdlib(sec) {
+  installHelperCounters()
   resolveIncludes()
 
   // Reachability, not inclusion, decides what the output needs. `ctx.core.includes`
@@ -600,7 +609,26 @@ export function pullStdlib(sec) {
   // are pulled in on demand, never eagerly, so they're already minimal and never pruned
   // here (guarding against any reachability blind spot in a dotted-name template).
   for (const n of [...ctx.core.includes]) if (n.startsWith('__') && !reachable.has(n)) ctx.core.includes.delete(n)
-  if (!needsAlloc) ctx.scope.globals.delete('__heap')
+  // Lazy Eisel-Lemire table injection: only when __dec_to_f64 (correctly-rounded
+  // decimal→f64, module/number.js) survived pruning — append its trimmed 131-entry
+  // (~2KB) power-of-10 table and declare $__el_tbl = that offset. Must run HERE so
+  // dataPages (below) accounts for the addition; keeps it out of programs that never
+  // parse decimals at runtime.
+  if (ctx.core.includes.has('__dec_to_f64') && ctx.runtime.elTable) {
+    const elBefore = ctx.runtime.data.length
+    while (ctx.runtime.data.length % 8 !== 0) ctx.runtime.data += '\0'
+    const elTblOff = ctx.runtime.data.length
+    ctx.runtime.data += ctx.runtime.elTable
+    declGlobal('__el_tbl', 'i32', elTblOff, { mut: false })
+    ctx.runtime.elTable = null  // prevent double-injection on re-entry (null-sentinel; jz forbids delete)
+    // Reachability here OVER-counts __dec_to_f64: a dead inlined helper's `arr[i] | 0`
+    // on an untyped param pulls __to_num → __dec_to_f64, landing the table even when no
+    // LIVE code parses decimals. Record the appended span (padding + table, always the
+    // data tail — it's the last append) so stripDeadElTable can drop it post-lowering,
+    // once reachability is exact. See stripDeadElTable.
+    ctx.runtime.elTableLen = ctx.runtime.data.length - elBefore
+  }
+  if (!needsAlloc) { ctx.scope.globals.delete('__heap'); ctx.scope.globals.delete('__heap_reset') }
   if (needsMemory && ctx.module.modules.core) {
     if (needsAlloc) {
       for (const fn of ['__alloc', '__alloc_hdr', '__clear']) ctx.core.includes.add(fn)
@@ -608,6 +636,20 @@ export function pullStdlib(sec) {
       // etc.) that the initial resolveIncludes did not yet see; re-resolve.
       // No-op when the alloc trio was already present.
       resolveIncludes()
+      // Record the post-init heap top into `__heap_reset` so `__clear` rewinds to
+      // just above this module's init-time heap state (e.g. the self-host compiler's
+      // GLOBALS/atom tables), not into it. Done here — where `__heap` is known to
+      // survive — as the last `__start` action before any non-returning timer loop.
+      // No `__start` ⇒ no init allocations ⇒ `__heap_reset`'s data-end seed is right.
+      if (!ctx.memory.shared && ctx.scope.globals.has('__heap_reset')) {
+        const startFn = sec.start.find(n => Array.isArray(n) && n[0] === 'func' && n[1] === '$__start')
+        if (startFn) {
+          const capture = ['global.set', '$__heap_reset', ['global.get', '$__heap']]
+          const tail = startFn[startFn.length - 1]
+          if (Array.isArray(tail) && tail[0] === 'call' && tail[1] === '$__timer_loop') startFn.splice(startFn.length - 1, 0, capture)
+          else startFn.push(capture)
+        }
+      }
     }
     // Initial pages must cover the static data segment (it loads at instantiation), not
     // just the default 1 — otherwise a module whose constants exceed 64 KiB emits a data
@@ -637,7 +679,7 @@ export function pullStdlib(sec) {
     }
   }
   for (const n of ctx.core.includes) if (!ctx.core.stdlib[n]) err(`internal: stdlib '${n}' was requested but never registered (this is a jz bug — feature pulled in something it can't deliver)`)
-  sec.stdlib.push(...[...ctx.core.includes].map(n => parseTemplate(stdlibStr(n))))
+  sec.stdlib.push(...[...ctx.core.includes].map(n => instrumentHelperCounter(n, parseTemplate(stdlibStr(n)))))
 }
 
 export function syncImports(sec) {
@@ -706,17 +748,58 @@ export function optimizeModule(sec, profiler) {
   if (dataLen > 1024 && !ctx.memory.shared) {
     const heapBase = (dataLen + 7) & ~7
     // Non-shared memory always carries a $__heap global — start it past the
-    // static data so the bump allocator never overwrites a literal.
+    // static data so the bump allocator never overwrites a literal. `__heap_reset`
+    // seeds to the same data end (its runtime value is overwritten by `__start`'s
+    // tail capture for modules that init-allocate; this seed serves modules with no
+    // `__start`, where the data end IS the correct rewind point). `__clear` reads
+    // `$__heap_reset` directly, so no per-function constant patch is needed.
     declGlobal('__heap', 'i32', heapBase, { export: '__heap' })
+    if (ctx.scope.globals.has('__heap_reset')) declGlobal('__heap_reset', 'i32', heapBase)
     if (ctx.scope.globals.has('__heap_start')) declGlobal('__heap_start', 'i32', heapBase)
-    for (const s of sec.stdlib)
-      if (s[0] === 'func' && s[1] === '$__clear')
-        for (let i = 2; i < s.length; i++)
-          if (Array.isArray(s[i]) && s[i][0] === 'global.set' && Array.isArray(s[i][2]) && s[i][2][0] === 'i32.const')
-            s[i][2][1] = `${heapBase}`
   }
 }
 
+/**
+ * Phase: strip the Eisel-Lemire table when it is dead.
+ *
+ * pullStdlib injects the ~2 KB power-of-10 table whenever `__dec_to_f64` is *reachable*,
+ * but that over-counts: a dead inlined helper's `arr[i] | 0` on an untyped param pulls
+ * `__to_num` → `__dec_to_f64`, so the table lands even in a module no live code parses
+ * decimals in. watr later treeshakes the dead function + its `$__el_tbl` global, but it
+ * does NOT treeshake the data segment — so the orphaned table bloated every module ~2 KB.
+ *
+ * This runs LAST (after every lowering has emitted its call/ref.func — doing it earlier is
+ * unsound: refs like `util.clone` are emitted *after* pullStdlib), so a mark-sweep from the
+ * real roots (inline-exported funcs, __start, the closure table, globals/tags/table) gives
+ * EXACT liveness. If `__dec_to_f64` is dead, truncate the table from the data tail (it is
+ * the last append — see pullStdlib). DATA only: the dead function + global are left for
+ * watr, which already removes them. Keeps correctly-rounded decimal parsing wherever it is
+ * genuinely live (parseFloat, the self-host compiler's `Number()` on source literals).
+ */
+export function stripDeadElTable(sec) {
+  if (!ctx.runtime.elTableLen) return
+  const byName = new Map()
+  for (const arr of [sec.funcs, sec.stdlib, sec.start])
+    for (const f of arr || []) if (Array.isArray(f) && f[0] === 'func' && typeof f[1] === 'string') byName.set(f[1], f)
+  const live = new Set(), work = []
+  const mark = (ref) => { if (typeof ref === 'string' && byName.has(ref) && !live.has(ref)) { live.add(ref); work.push(ref) } }
+  const scan = (n) => {
+    if (!Array.isArray(n)) return
+    if ((n[0] === 'call' || n[0] === 'return_call' || n[0] === 'ref.func') && typeof n[1] === 'string') mark(n[1])
+    for (const c of n) scan(c)
+  }
+  for (const f of sec.funcs) if (f.some(el => Array.isArray(el) && el[0] === 'export')) mark(f[1])
+  for (const f of sec.start) scan(f)
+  for (const part of [sec.elem, sec.globals, sec.tags, sec.table]) for (const n of part || []) {
+    if (!Array.isArray(n)) continue
+    for (const c of n) { if (typeof c === 'string' && c[0] === '$') mark(c); else scan(c) }
+  }
+  while (work.length) scan(byName.get(work.pop()))
+  if (live.has('$__dec_to_f64')) return   // genuinely parses decimals at runtime — keep it
+  ctx.runtime.data = ctx.runtime.data.slice(0, ctx.runtime.data.length - ctx.runtime.elTableLen)
+  ctx.runtime.elTableLen = 0
+}
+
 /**
  * Phase: strip static-data prefix.
  */

package/src/widen.js

@@ -0,0 +1,21 @@
+/**
+ * Numeric widening thresholds — the SINGLE SOURCE for "when does an i32 arithmetic
+ * op stay i32 vs widen to f64", shared by the two phases that must agree:
+ *   • emit.js  DECIDES  — emits `i32.mul`/`i32.add` or widens to `f64.mul`/`f64.add`
+ *   • type.js  MIRRORS  — exprType predicts the same i32/f64 so locals are typed right
+ *
+ * SOUNDNESS INVARIANT (one-way, unforgiving): exprType's i32 verdict must be a SUBSET
+ * of emit's — exprType may answer i32 only where emit DEFINITELY produces i32. If type
+ * says i32 but emit yields f64, the result is `trunc_sat`-narrowed back to i32 → silent
+ * miscompile. The two predicates can't share a function (emit reads IR values via
+ * isLit/maskBound, type reads AST via staticValue), but they MUST share this threshold,
+ * or a future edit to one silently drifts the other out of the safe subset.
+ *
+ * @module widen
+ */
+
+// JS `*` is an f64 multiply; `i32.mul` agrees only while the exact product stays
+// f64-exact (|product| ≤ 2^53). Against the full i32 range (2^31) of one operand, the
+// other must be bounded |v| ≤ 2^22 for the product to hold within 2^53 — so a literal
+// or provably-masked operand of that magnitude keeps the multiply on `i32.mul`.
+export const FITS_I32_MAX = 0x400000  // 2^22