jz 0.8.0 → 0.8.1

package/src/optimize/index.js

@@ -97,6 +97,14 @@ export const PASS_NAMES = [
   'hoistInvariantLoop',       // unified LICM (subsumes the former ToInt32/PtrOffsetLoop/CellLoads hoists)
   'narrowLoopBound',          // f64 loop bound → hoisted i32 (unblocks the lane-vectorizer)
   'splitCharScan',            // charCodeAt scan loops: split at min(N, s.length) → i32 char carrier (plan-level)
+  // Pre-analyze loop-shape transforms — applied in compile/index.js (NOT this pass pipeline), but
+  // gated by these flags. Listing them here is load-bearing: ALL_OFF sets them false so level 0/1
+  // (the self-host fast path) actually skip them, instead of `undefined !== false` running them
+  // unconditionally at every level. ALL_ON keeps them on at level 2+ where they belong.
+  'loopIVDivMod',             // strength-reduce per-iter `i%w` / `(i/w)|0` → incremental i32 counters
+  'loopSquare',               // bounded `i*i < CONST` → Math.imul (i32 product chain)
+  'unrollRecurrence',         // unit-stride DP/scan: scalar-replace arr[j-1]/arr[j] recurrence + ×2 unroll
+  'clampPeel',                // edge-clamp stencil: split into clamp-free interior (vectorizes) + edges
   'hoistGlobalPtrOffset',     // stable typed GLOBALS: __ptr_offset resolve → once per function (post-watr, module-level)
   'fusedRewrite',             // peephole + ptr-helper inline + memarg fold
   'hoistAddrBase',
@@ -106,6 +114,7 @@ export const PASS_NAMES = [
   'unswitchTypedParamLoop',   // Float64Array param loop-unswitch → base-hoisted f64.load/store fast path (vectorizes)
   'dropDeadZeroInit',
   'deadStoreElim',
+  'propagateSingleUse',       // forward-substitute single-def/single-use pure temps (watr's "propagate")
   'promoteGlobals',          // read-only global.get → local for multi-read globals
   'sortLocalsByUse',
   'specializeMkptr',
@@ -157,10 +166,14 @@ const LEVEL_PRESETS = Object.freeze({
     ...ALL_ON,
     smallConstForUnroll: false, nestedSmallConstForUnroll: false, vectorizeLaneLocal: false, splitCharScan: false,
     recursionUnroll: false,   // body tripling is a size regression — speed-only
+    unrollRecurrence: false,  // ×2 body duplication is a size regression — speed-only
+    clampPeel: false,         // edge-clamp peel triples a stencil loop (clamp-free interior + 2 edges) to vectorize — speed-only
 
     boolConvertToSelect: false,  // adds a const + op per site — speed-only latency trade
     devirtIndirect: false,    // guards + duplicated args grow bytes — speed-only trade
     internStrings: false,     // the intern index costs ~16 B per eligible literal — speed-only trade
+    promoteGlobals: false,    // snapshots a multi-read global into an entry local — pure speed (V8 can't CSE a mutable global); the snapshot is dead size weight at -Os
+    hoistInvariantLoop: false,// LICM: hoists loop-invariants to entry temps — a speed/latency trade whose entry cost outweighs the per-iter saving in bytes
     scalarTypedLoopUnroll: 4, scalarTypedNestedUnroll: 8, scalarTypedArrayLen: 8,
   }),
   // 'speed' === level 3: full watr (inlining on) + L3 cap/hash tuning, pool off.
@@ -589,6 +602,25 @@ const NON_MUTATING_CALLS = new Set(['$__is_str_key', '$__str_concat', '$__to_num
 // `for(j) { ... grid[i][j] ... }` inner loop (the jagged-array deopt).
 const READONLY_MEM_CALLS = new Set(['$__typed_idx', '$__str_idx'])
 
+// PURE FUNCTION calls — result is a function of the ARGUMENTS alone, with no
+// dependence on mutable state: math reads no memory; the string search/compare
+// helpers read only their operands' bytes, and jz strings are IMMUTABLE, so their
+// content can't change under the loop's stores. So on loop-invariant args the
+// RESULT is loop-invariant regardless of anything else the loop does (unlike a
+// READONLY_MEM_CALLS element read, which an aliasing store could invalidate — no
+// !hasDirectStore guard is needed here). Speculative pre-header execution can't
+// trap: math returns NaN/∞ rather than trapping, and a value reaching .indexOf/===
+// is a valid string (in-bounds reads). This is the LICM V8's wasm tier won't do —
+// it treats every call as opaque and recomputes the search/transcendental each
+// iteration. (Math.random is INLINED — it mutates a global PRNG seed, never a
+// `$math.` call — but exclude it by name defensively; $__str_eq_cold is the cold
+// half of __str_eq, equally pure.) byteLen/length stay OUT: $__length is polymorphic
+// over MUTABLE arrays (push changes it), so it isn't arg-pure.
+const PURE_CALL_I32 = new Set(['$__str_indexof', '$__str_lastindexof', '$__str_eq', '$__str_eq_cold', '$__is_str_key'])
+const isPureFnCall = (callee) =>
+  typeof callee === 'string' &&
+  ((callee.startsWith('$math.') && !callee.startsWith('$math.random')) || PURE_CALL_I32.has(callee))
+
 export function hoistInvariantPtrOffset(fn) {
   if (!Array.isArray(fn) || fn[0] !== 'func') return
   const bodyStart = findBodyStart(fn)
@@ -796,7 +828,7 @@ function loopInvariance(loopNode, { distinctParams, baseParamOf }) {
     if (op.startsWith('v128.') || /^[if]\d+x\d+\./.test(op)) hasV128 = true
     if (op === 'local.set' || op === 'local.tee') { if (typeof node[1] === 'string') locals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
     if (op === 'global.set') { if (typeof node[1] === 'string') globals.add(node[1]); for (let i = 2; i < node.length; i++) scan(node[i]); return }
-    if (op === 'call') { hasAnyCall = true; if (!SAFE_OFFSET_CALLS.has(node[1]) && !READONLY_MEM_CALLS.has(node[1]) && !NON_MUTATING_CALLS.has(node[1])) hasUnsafeCall = true; for (let i = 2; i < node.length; i++) scan(node[i]); return }
+    if (op === 'call') { hasAnyCall = true; if (!SAFE_OFFSET_CALLS.has(node[1]) && !READONLY_MEM_CALLS.has(node[1]) && !NON_MUTATING_CALLS.has(node[1]) && !isPureFnCall(node[1])) hasUnsafeCall = true; for (let i = 2; i < node.length; i++) scan(node[i]); return }
     if (op === 'call_ref' || op === 'call_indirect') { hasAnyCall = hasUnsafeCall = true; for (let i = 1; i < node.length; i++) scan(node[i]); return }
     if ((op === 'f64.store' || op === 'i32.store') && node.length >= 3) {
       hasDirectStore = true
@@ -843,6 +875,13 @@ function loopInvariance(loopNode, { distinctParams, baseParamOf }) {
       return false
     }
     if (op === 'call') {
+      // Pure-function call: invariant iff its ARGS are. No effect-summary barrier —
+      // its result depends on nothing the loop can mutate (math: no memory; string
+      // search/compare: immutable operands), so neither a store nor another call
+      // can invalidate it. This hoists the loop-invariant transcendental / substr
+      // search V8's wasm tier recomputes every iteration.
+      if (isPureFnCall(node[1]))
+        return node.slice(2).every(c => pureGiven(c, bound))
       if (SAFE_OFFSET_CALLS.has(node[1]))
         return !hasUnsafeCall && node.slice(2).every(c => pureGiven(c, bound))
       // Read-only heap reads: additionally require no direct store (alias-safe).
@@ -1088,6 +1127,8 @@ export function hoistInvariantLoop(fn) {
       // SAFE_OFFSET_CALLS all return i32; READONLY_MEM_CALLS return f64 (NaN-boxed element)
       if (SAFE_OFFSET_CALLS.has(node[1])) return 'i32'
       if (READONLY_MEM_CALLS.has(node[1])) return 'f64'
+      if (PURE_CALL_I32.has(node[1])) return 'i32'        // string search/compare → i32
+      if (typeof node[1] === 'string' && node[1].startsWith('$math.')) return 'f64'   // transcendentals → f64
       return null
     }
     if (op === 'local.get' || op === 'local.tee') return localTypes.get(node[1]) ?? null
@@ -2127,6 +2168,121 @@ export function deadStoreElim(fn) {
   }
 }
 
+/**
+ * Forward-substitute a single-def / single-use local into its sole use, eliminating the local,
+ * its `local.set` and its `local.get`. This is watr's "propagate": jz emits short-lived address/
+ * index temps (`set $t (i32.add …); … (load $t) …`) that the WAT optimizer folds away — the
+ * dominant slice of the watr-optimizer-OFF size gap (a matmul carries ~14 such temps, ≈ the whole
+ * delta). Closing it lets jz lean on its own optimizer instead of watr's.
+ *
+ * SOUND only when moving the def's RHS `E` to the use can't change order or value:
+ *   - `E` is PURE — reads only locals (no load/store/call/global/memory): its value is a function
+ *     of its read-locals alone, and it has no side effects to reorder past intervening statements.
+ *   - the use is at the SAME loop nesting — never under a deeper `loop` than the def (which would
+ *     re-evaluate `E` per iteration and could read a clobbered input).
+ *   - no read-local of `E` is written between the def and the use (incl. the use statement itself).
+ * Anything it can't prove safe is left untouched.
+ */
+export function propagateSingleUse(fn) {
+  if (!Array.isArray(fn) || fn[0] !== 'func') return
+  const bodyStart = findBodyStart(fn)
+  if (bodyStart < 0) return
+
+  // Leave a vectorized function alone: it carries v128 lane sequences that are already register-tight,
+  // and forward-substituting into them only adds pressure (mirrors hoistInvariantLoop's hasV128 gate).
+  let hasV128 = false
+  const scanV = (n) => { if (hasV128 || !Array.isArray(n)) return; const op = n[0]; if (typeof op === 'string' && (op.startsWith('v128.') || /^[if]\d+x\d+\./.test(op))) { hasV128 = true; return } for (let i = 1; i < n.length; i++) scanV(n[i]) }
+  for (let i = bodyStart; i < fn.length && !hasV128; i++) scanV(fn[i])
+  if (hasV128) return
+
+  // def/use tally over the whole body. A `local.tee` is both a read and a write — exclude any
+  // tee'd local from candidacy rather than reason about it.
+  const setN = new Map(), getN = new Map(), teed = new Set()
+  const tally = (n) => {
+    if (!Array.isArray(n)) return
+    const op = n[0]
+    if (op === 'local.set' && typeof n[1] === 'string') setN.set(n[1], (setN.get(n[1]) || 0) + 1)
+    else if (op === 'local.tee' && typeof n[1] === 'string') teed.add(n[1])
+    else if (op === 'local.get' && typeof n[1] === 'string') getN.set(n[1], (getN.get(n[1]) || 0) + 1)
+    for (let i = 1; i < n.length; i++) tally(n[i])
+  }
+  for (let i = bodyStart; i < fn.length; i++) tally(fn[i])
+
+  const cand = new Set()
+  for (const [name, c] of setN) if (c === 1 && getN.get(name) === 1 && !teed.has(name)) cand.add(name)
+  if (!cand.size) return
+
+  const movablePure = (n) => {
+    if (!Array.isArray(n)) return true
+    const op = n[0]
+    if (op === 'local.get') return true
+    if (op === 'local.set' || op === 'local.tee' || op === 'call' || op === 'call_indirect' || op === 'call_ref'
+      || op === 'global.get' || op === 'global.set' || op === 'memory.size' || op === 'memory.grow'
+      || op === 'memory.copy' || op === 'memory.fill') return false
+    if (typeof op === 'string' && (op.includes('.load') || op.includes('.store') || op.includes('.atomic'))) return false
+    for (let i = 1; i < n.length; i++) if (!movablePure(n[i])) return false
+    return true
+  }
+  const readsOf = (n, out) => { if (!Array.isArray(n)) return; if (n[0] === 'local.get' && typeof n[1] === 'string') out.add(n[1]); for (let i = 1; i < n.length; i++) readsOf(n[i], out) }
+  const writesAny = (n, R) => { if (!Array.isArray(n)) return false; if ((n[0] === 'local.set' || n[0] === 'local.tee') && R.has(n[1])) return true; for (let i = 1; i < n.length; i++) if (writesAny(n[i], R)) return true; return false }
+  // Locate the (local.get $t) within `root`'s subtree (not root itself); flag if it sits under a
+  // `loop` relative to root (→ would re-evaluate the moved RHS each iteration).
+  const locateUse = (root, t) => {
+    let found = null
+    const rec = (node, underLoop) => {
+      if (found || !Array.isArray(node)) return
+      for (let i = 1; i < node.length; i++) {
+        if (found) return
+        const c = node[i]
+        if (Array.isArray(c) && c[0] === 'local.get' && c[1] === t) { found = { parent: node, idx: i, underLoop }; return }
+        rec(c, underLoop || node[0] === 'loop')
+      }
+    }
+    rec(root, false)
+    return found
+  }
+
+  const removed = new Set()
+  const optimizeList = (list, start) => {
+    for (let i = start; i < list.length; i++) {
+      const s = list[i]
+      if (!Array.isArray(s)) continue
+      // s.length === 3: an explicit-RHS `(local.set $t E)`. A bare `(local.set $t)` (length 2)
+      // binds a value already on the stack — e.g. the try_table catch payload — and has no RHS to
+      // move; treating its undefined RHS as movable would substitute `undefined` into the use.
+      if (s[0] === 'local.set' && s.length === 3 && typeof s[1] === 'string' && cand.has(s[1]) && movablePure(s[2])) {
+        const t = s[1], E = s[2], R = new Set(); readsOf(E, R)
+        for (let j = i + 1; j < list.length; j++) {
+          const sj = list[j]
+          const u = Array.isArray(sj) ? locateUse(sj, t) : null
+          if (u) {                                       // found the sole use's statement
+            if (!u.underLoop && !writesAny(sj, R)) {     // same nesting + read-locals intact
+              u.parent[u.idx] = E
+              list.splice(i, 1)
+              cand.delete(t); removed.add(t)
+              i--                                        // re-process from the freed slot (forward chains)
+            }
+            break                                        // use located — stop scanning this candidate
+          }
+          if (writesAny(sj, R)) break                    // a read-local clobbered before the use → can't move
+        }
+        if (removed.has(s[1])) continue
+      }
+      // recurse into nested statement lists
+      if (s[0] === 'block' || s[0] === 'loop') {
+        let k = 1; while (k < s.length && Array.isArray(s[k]) && s[k][0] === 'result') k++
+        optimizeList(s, k)
+      } else if (s[0] === 'if') {
+        for (let k = 1; k < s.length; k++) { const c = s[k]; if (Array.isArray(c) && (c[0] === 'then' || c[0] === 'else')) optimizeList(c, 1) }
+      }
+    }
+  }
+  optimizeList(fn, bodyStart)
+
+  // drop the now-orphaned decls (deferred so the body walk above sees stable indices)
+  if (removed.size) for (let i = fn.length - 1; i >= 2; i--) { const c = fn[i]; if (Array.isArray(c) && c[0] === 'local' && removed.has(c[1])) fn.splice(i, 1) }
+}
+
 /**
  * Module-wide scan for "volatile" globals — those mutated (`global.set`) in any
  * function other than `$__start`. Globals written only in `$__start` are
@@ -3216,6 +3372,7 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre
       cfg.csePureExpr === false &&
       cfg.dropDeadZeroInit === false &&
       cfg.deadStoreElim === false &&
+      cfg.propagateSingleUse === false &&
       cfg.promoteGlobals === false &&
       cfg.sortLocalsByUse === false &&
       cfg.vectorizeLaneLocal === false) return
@@ -3277,6 +3434,14 @@ export function optimizeFunc(fn, cfg, globalTypes, volatileGlobals, phase = 'pre
     // iteration, the hot-loop waste audit-fixpoint.mjs flagged on dot/sum.
     if (runVectorizer) foldV128Memargs(fn)
   }
+  // Forward-substitute single-use temps — AFTER the vectorizer, never before: it pattern-matches a
+  // STRAIGHT-LINE `s += a[i]*2`, and folding an address/index temp out scrambles it (the typed-array
+  // loop fell from a SIMD body to a scalar unroll, +231 B). For watr:false the whole pipeline is the
+  // 'pre' phase (no 'post' re-run), so vectorize already ran above; for full watr the vectorizer is
+  // deferred to 'post', so skip 'pre' here to stay after it. (propagateSingleUse itself skips any
+  // function the vectorizer already lifted to v128.)
+  const fullWatr_psu = !!(cfg && (cfg.watr === true || typeof cfg.watr === 'object'))
+  if ((phase === 'post' || !fullWatr_psu) && (!cfg || cfg.propagateSingleUse !== false)) propagateSingleUse(fn)
   // SSA-split loop-private unrolled scratch (post-vectorize: vectorized loops now carry
   // v128 and are skipped) so the LICM below hoists the per-iteration invariants the
   // unroller's name-merging hid — rust/LLVM's free-after-unroll register hoist (closes

package/src/optimize/vectorize.js

@@ -4061,6 +4061,16 @@ function tryDivergentEscapeVectorize(blockNode, fnLocals, freshIdRef) {
   const kTop = kindOf(keepTopC)
   const limitKeep = keepTopC   // initialised here; may be reassigned below for single-break
   let kMid = null, boundExpr, boundI32, itLeft
+  // Compound-top guard `while (A && B)`: classify the SECOND keep too. Left unclassified (kMid=null),
+  // the downstream lift/keepMask treats keepMidC as a per-lane f64 escape — right for the Julia order
+  // (limit, escape) but it then lifts the i32 LIMIT of the mandelbrot order (escape, `it<MAX`) into an
+  // f64 lane and crashes. Setting kMid routes the limit through the scalar guard instead; for the
+  // Julia order kMid='escape' is identical to the old null (both lift). Bail if neither keep is an
+  // escape — a two-limit guard has no per-lane divergence for this vectorizer to exploit.
+  if (compoundTop) {
+    kMid = kindOf(keepMidC)
+    if (kTop === 'limit' && kMid === 'limit') return null
+  }
   if (midBreaks.length === 1) {
     kMid = kindOf(keepMidC)
     if (kTop === kMid) return null

package/src/prepare/index.js

@@ -196,6 +196,19 @@ const stripBoolNot = c => {
   while (Array.isArray(c) && c[0] === '!' && Array.isArray(c[1]) && c[1][0] === '!') c = c[1][1]
   return c
 }
+// In a statement (value-discarded) position, postfix `x++`/`x--` is lowered to `(++x) − 1` /
+// `(--x) + 1` to recover the old value — but nobody reads it, so drop the ∓1 and keep the bare
+// increment. (`obj.p++` lowers via `obj.p = obj.p + 1`, also wrapped.) Cleaner AST for the loop/
+// recurrence passes; codegen already discarded the ∓1, so this is purely canonicalization.
+const isOne = n => Array.isArray(n) && n[0] == null && n[1] === 1
+const dropDeadPostfix = s => {
+  if (Array.isArray(s) && s.length === 3 && isOne(s[2]) && Array.isArray(s[1])) {
+    const inner = s[1][0]
+    if ((s[0] === '-' && (inner === '++' || inner === '=')) ||
+        (s[0] === '+' && (inner === '--' || inner === '='))) return s[1]
+  }
+  return s
+}
 const stringValue = node => Array.isArray(node) && node[0] == null && typeof node[1] === 'string' ? node[1] : null
 const MUTATING_ARRAY_METHODS = new Set(['copyWithin', 'fill', 'pop', 'push', 'reverse', 'shift', 'sort', 'splice', 'unshift'])
 
@@ -1636,20 +1649,20 @@ const handlers = {
   '!=='(a, b) { return prepStrictEq('!==', a, b) },
 
   // Statements
-  ';': (...stmts) => [';', ...stmts.map(prep).filter(x => x != null)],
+  ';': (...stmts) => [';', ...stmts.map(prep).filter(x => x != null).map(dropDeadPostfix)],
   'let': (...inits) => prepDecl('let', ...inits),
   'const': (...inits) => prepDecl('const', ...inits),
 
   // Block-scoped control flow: push scope for bodies so inner let/const shadows correctly
   'if': (cond, then, els) => {
     const c = prep(stripBoolNot(cond))
-    pushScope(); const t = prep(then); popScope()
-    if (els != null) { pushScope(); const e = prep(els); popScope(); return ['if', c, t, e] }
+    pushScope(); const t = dropDeadPostfix(prep(then)); popScope()
+    if (els != null) { pushScope(); const e = dropDeadPostfix(prep(els)); popScope(); return ['if', c, t, e] }
     return ['if', c, t]
   },
   'while': (cond, body) => {
     const c = prep(stripBoolNot(cond))
-    pushScope(); const b = prep(body); popScope()
+    pushScope(); const b = dropDeadPostfix(prep(body)); popScope()
     return ['while', c, b]
   },
   // do { body } while (cond) → flag-guarded while: `flag=true; while (flag||cond) { flag=false; body }`.
@@ -2127,7 +2140,7 @@ const handlers = {
           }
         }
       }
-      r = ['for', init ? prep(init) : null, cond ? prep(cond) : null, step ? prep(step) : null, prep(body)]
+      r = ['for', init ? prep(init) : null, cond ? prep(cond) : null, step ? dropDeadPostfix(prep(step)) : null, dropDeadPostfix(prep(body))]
     } else if (Array.isArray(head) && head[0] === 'of') {
       // for (let x of arr) → hoist arr (if non-trivial) and arr.length once, iterate by index.
       // Divergence from JS: mutating arr during iteration won't extend/shorten the loop.