jz 0.8.0 → 0.9.0

package/src/compile/index.js

@@ -27,9 +27,11 @@
 
 import parseWat from 'watr/parse'
 import { ctx, err, inc, resolveIncludes, PTR, LAYOUT, declGlobal } from '../ctx.js'
+import { i64Hex } from '../../layout.js'
 import { T, isBlockBody, isReassigned, refsName, REFS_IN_EXPR, returnExprs } from '../ast.js'
 import { valTypeOf } from '../kind.js'
 import { intLiteralValue } from '../static.js'
+import { intCertainMap, typedStaticLen } from '../type.js'
 import {
   analyzeBody, unboxablePtrs, cseSafeLoadBases, boxedCaptures,
   analyzeStructInline, invalidateLocalsCache,
@@ -40,8 +42,12 @@ import { inferLocals } from './infer.js'
 import { optimizeFunc, treeshake } from '../optimize/index.js'
 import { strengthReduceLoopDivMod } from './loop-divmod.js'
 import { narrowBoundedSquare } from './loop-square.js'
+import { unrollRecurrence } from './loop-recurrence.js'
 import { peelClampedStencil } from './peel-stencil.js'
 import { cseLoads } from './cse-load.js'
+import {
+  scanDynClosureTableCandidates, recordParamClosureDefault, recordDirectReturnClosure, resolveDynFnTables,
+} from './dyn-closure-tables.js'
 
 // Monotonic across all functions so a CSE temp never collides (even after later inlining).
 let __cseCtr = 0
@@ -49,7 +55,7 @@ const freshCseName = () => `${T}cse${__cseCtr++}`
 import { emit, emitter, emitVoid, emitBlockBody } from './emit.js'
 import { emitCharDecompPrologue, JSS_IMPORT_SIGS } from '../abi/string.js'
 import {
-  typed, asF64, asI32, asPtrOffset, asParamType, toI32, asI64, fromI64,
+  typed, asF64, asI32, asPtrOffset, asParamType, toI32, asI64, fromI64, ptrTypeEq,
   NULL_NAN, UNDEF_NAN, NULL_WAT, UNDEF_WAT, NULL_IR, UNDEF_IR, nullExpr, undefExpr,
   MAX_CLOSURE_ARITY,
   mkPtrIR,
@@ -66,7 +72,7 @@ import plan from './plan/index.js'
 import { foldStaticConstAggregates } from './plan/literals.js'
 import {
   buildStartFn, dedupClosureBodies, finalizeClosureTable,
-  pullStdlib, syncImports, optimizeModule, stripStaticDataPrefix, hoistConstGlobalInits, stripDeadElTable,
+  pullStdlib, syncImports, optimizeModule, stripStaticDataPrefix, hoistConstGlobalInits, stripDeadLazyTables,
 } from '../wat/assemble.js'
 import { instrumentHelperCallsites } from '../helper-counters.js'
 
@@ -392,6 +398,8 @@ function enterFunc(sig, body, { uniq = 0, directClosures = null } = {}) {
   ctx.func.directClosures = directClosures
   ctx.func.localProps = null
   ctx.func.charDecomp = null
+  ctx.func.charDecompGlobals = false  // only emitFunc's named path drains — it re-arms
+  ctx.func.probeHoist = null
   if (ctx.transform.optimize) {
     scanAndTagNonEscapingClosures(body)
   }
@@ -426,6 +434,11 @@ function analyzeFuncForEmit(func, programFacts) {
   // so the sieve's product/counter chain carries i32 instead of f64. Before analyze so the
   // Math.imul typed/narrows like any i32. Off at L0 / `loopSquare:false`.
   if (_o && _o.loopSquare !== false && isBlockBody(func.body)) func.body = narrowBoundedSquare(func.body)
+  // Array-recurrence unroll: a unit-stride DP/scan that reads arr[j-1] and writes arr[j] carries
+  // its value through memory (store→load) and re-pays loop overhead per cell — both of which V8
+  // hides but Cranelift/baseline don't. Scalar-replace the recurrence + unroll ×2 (clang's fix).
+  // Off at L0 / `unrollRecurrence:false`.
+  if (_o && _o.unrollRecurrence !== false && isBlockBody(func.body)) func.body = unrollRecurrence(func.body)
   // Edge-clamp peeling: split a clamped stencil loop into clamp-free interior + edges
   // (the interior then lifts to SIMD). Before analyze so the new loops are analyzed.
   if (_o && _o.clampPeel !== false && isBlockBody(func.body)) func.body = peelClampedStencil(func.body)
@@ -437,21 +450,68 @@ function analyzeFuncForEmit(func, programFacts) {
   ctx.func.boxed = new Map()
   ctx.func.localReps = null
   ctx.types.typedElem = ctx.scope.globalTypedElem ? new Map(ctx.scope.globalTypedElem) : null
+  // typedLen mirrors typedElem's per-function lifecycle EXACTLY — a stale entry from a
+  // sibling function's same-named local would prove a wrong bound (names are per-function).
+  ctx.types.typedLen = ctx.scope.globalTypedLen ? new Map(ctx.scope.globalTypedLen) : null
 
   const _reps = paramReps.get(name)
   if (_reps) {
     for (const [k, r] of _reps) {
       if (k >= sig.params.length) continue
       const pname = sig.params[k].name
-      if (r.typedCtor) {
+      // r.val/r.typedCtor describe the CALLER's argument — the param's value AT
+      // ENTRY, before this function's own body runs. A param the body reassigns
+      // (`opts = normalize(opts)`) no longer necessarily holds that entry-time
+      // kind past the write, so seeding it here is only sound when the body
+      // never writes the name. Without this guard the stale entry-time kind
+      // stands unchallenged: analyzeBody's OWN valType tracker (below, `bodyFacts.
+      // valTypes`) starts with no memory of this pre-seeded value (it's a fresh
+      // Map, not the shared ctx.func.localReps store), so when the reassignment's
+      // RHS type can't be resolved (e.g. a call to a function whose own valResult
+      // never converges), makeValTracker's poison path requires a PRIOR value
+      // in ITS OWN map to fire — there isn't one — so it neither confirms nor
+      // invalidates the seed, and the merge loop below never touches the name at
+      // all. A hardcoded-wrong kind then rides every read of that binding for the
+      // rest of the function (watr's own `optimize()`: opts's param-fact kind is
+      // VAL.OBJECT from callers that pass object literals; `opts = normalize(opts)`
+      // reassigns it to normalize's actual return — a HASH in the schema-less-
+      // spread shape — but the stale OBJECT kind survives, so `emitTypeTag` bakes
+      // a hardcoded `(i32.const PTR.OBJECT)` tag into `opts.inlineOnce`'s dyn-get
+      // dispatch instead of reading the receiver's true runtime tag, and the probe
+      // walks a schema this HASH was never shaped as — a silent miss, not a trap).
+      const reassigned = isReassigned(body, pname)
+      if (r.typedCtor && !reassigned) {
         if (!ctx.types.typedElem) ctx.types.typedElem = new Map()
         if (!ctx.types.typedElem.has(pname)) ctx.types.typedElem.set(pname, r.typedCtor)
         updateRep(pname, { val: VAL.TYPED })
       }
-      if (r.val && !ctx.func.localReps?.get(pname)?.val) updateRep(pname, { val: r.val })
+      if (r.val && !reassigned && !ctx.func.localReps?.get(pname)?.val) updateRep(pname, { val: r.val })
       if (r.arrayElemSchema != null) updateRep(pname, { arrayElemSchema: r.arrayElemSchema })
       if (r.arrayElemValType != null) updateRep(pname, { arrayElemValType: r.arrayElemValType })
       if (r.intConst != null) updateRep(pname, { intConst: r.intConst })
+      // Cross-function never-relocation proof (analyzeParamNeverGrown) — the
+      // raw-base array read (module/array.js arrBase) keys off this rep.
+      if (r.neverGrown) updateRep(pname, { neverGrown: true })
+    }
+  }
+  // Caller-side nullability: a NO-DEFAULT param observes the UNDEF pad whenever a
+  // site omits its position (narrow's missing rule poisons r.val) or when callers
+  // are unknown (exported / value-used — no fact at all). A later body write
+  // (`nbar = 4` inside `if (nbar == null)`) sets val=NUMBER, which used to
+  // constant-fold the very null-check guarding it — under-arity callers then read
+  // the raw UNDEF box as NaN (window-function's taylor manual-default idiom).
+  // `nullable` only suppresses the nullish-compare FOLD; arithmetic typing keeps.
+  // `r.nullable` alongside a SETTLED val is narrow.js's BIGINT re-derivation:
+  // a `c ? BigInt(x) : null` site proves the kind yet still passes null — the
+  // callee's `x == null` sentinel must stay a live bit-compare.
+  {
+    const restIdx = func.rest ? sig.params.length - 1 : -1
+    for (let k = 0; k < sig.params.length; k++) {
+      if (k === restIdx) continue                       // rest arrays are never undefined
+      const pname = sig.params[k].name
+      if (func.defaults?.[pname] != null) continue      // default fires on the UNDEF pad
+      const r = _reps?.get(k)
+      if (!r || r.val == null || r.nullable) updateRep(pname, { nullable: true })
     }
   }
   // Trust numeric export params. An exported f64 param used only in numeric
@@ -496,7 +556,32 @@ function analyzeFuncForEmit(func, programFacts) {
   const bodyFacts = block ? analyzeBody(body) : null
   ctx.func.locals = bodyFacts ? bodyFacts.locals : new Map()
   if (bodyFacts?.valTypes) {
-    for (const [name, vt] of bodyFacts.valTypes) updateRep(name, { val: vt })
+    // A PARAMETER name has no `let`/`const` declaration node inside body for
+    // analyzeBody's own tracker to seed a baseline "unknown" observation from
+    // (makeValTracker's poison logic needs a PRIOR value in ITS OWN map to
+    // detect a conflict — see that function's doc). So when a parameter is
+    // reassigned only CONDITIONALLY (`if (typeof opts === 'string' && …) opts
+    // = { profile: … }` — watr's own normalize()), the tracker's first (and
+    // only) observation is that ONE branch's type, with no competing
+    // observation for the other, equally-reachable path where the param keeps
+    // its original, caller-supplied value — a path this walk never visits
+    // because there's no assignment node ON it to visit. The merge below would
+    // then adopt the conditional branch's type as if it held on EVERY path.
+    // Trust it only when the param's own call-site-proven entry type (_reps,
+    // the fixpoint-settled cross-call-site fact — unlike this per-body walk,
+    // it already answers "what can this param be at entry, always") agrees:
+    // if it does, both the reassigned and the original-value paths carry the
+    // same kind, so unconditional-adoption is sound; if it's absent or
+    // different, the conditional branch's type does NOT generalize and must
+    // not override the (correctly) unresolved entry-time kind.
+    const paramIdx = block ? new Map(sig.params.map((p, i) => [p.name, i])) : null
+    for (const [name, vt] of bodyFacts.valTypes) {
+      if (paramIdx?.has(name)) {
+        const entryVal = _reps?.get(paramIdx.get(name))?.val
+        if (entryVal !== vt) continue
+      }
+      updateRep(name, { val: vt })
+    }
   }
   // Never-relocated array bindings — the `[]` reader skips the forwarding follow.
   if (bodyFacts?.neverGrown) for (const name of bodyFacts.neverGrown) updateRep(name, { neverGrown: true })
@@ -524,6 +609,17 @@ function analyzeFuncForEmit(func, programFacts) {
     .filter(p => !ctx.func.localReps?.get(p.name)?.val)
     .map(p => p.name)
   inferLocals(body, candidates)
+  // analyzeBody's locals slice (line above bodyFacts) ran BEFORE inferLocals
+  // bound elem-alias schema ids (`const p = ps[i]` → p.schemaId via
+  // analyzeValTypes). With strict-int32 slots in the program, re-derive the
+  // widths so exprType's slotI32CertainAt consult resolves through p — then
+  // `const x = hitX ? p.x : nx` declares i32 and the raw i32 slot load lands
+  // without an f64 round-trip. Gated: programs without strict slots skip the
+  // extra walk.
+  if (block && ctx.schema.slotI32Certain?.size) {
+    invalidateLocalsCache(body)
+    ctx.func.locals = analyzeBody(body).locals
+  }
   if (block) {
     boxedCaptures(body)
     // Lower provably-monomorphic pointer locals to i32 offset storage.
@@ -567,15 +663,30 @@ function analyzeFuncForEmit(func, programFacts) {
     : new Set()
 
   // Closure-capture narrowing: a boxed var whose every defining RHS — owner
-  // body AND nested arrows, the narrower's intCertain contract — is integer-
-  // valued keeps its CELL in i32, so readVar/writeVar skip the f64↔i32
-  // round-trip per access. Params are excluded: their cell is seeded from the
-  // raw f64 param value, which would desync an i32-read cell. Same asm.js-style
-  // range contract as plain intCertain locals.
+  // body AND nested arrows — is integer-valued keeps its CELL in i32, so
+  // readVar/writeVar skip the f64↔i32 round-trip per access. Params are
+  // excluded: their cell is seeded from the raw f64 param value, which would
+  // desync an i32-read cell. Same asm.js-style range contract as plain
+  // intCertain locals.
+  //
+  // `ctx.func.localReps.get(name).intCertain` (forward-propagated in analyze.js
+  // via the plain, single-arg `intCertainMap(body)`) only sees defs in THIS
+  // scope's own top level — correct for an ordinary local (it can't be
+  // assigned from inside a nested arrow without becoming a capture) but blind
+  // to the writes that make a name "boxed" in the first place: `let env = 0;
+  // let set = () => { env = 1.5 }` has no top-level def contradicting `env`'s
+  // integer init, so it read back intCertain=true and the cell stayed i32,
+  // silently truncating every closure-body float write. Recompute instead with
+  // `capturedNames` — collectIntDefs' arrow-descending mode — scoped to just
+  // the boxed names, so their nested-arrow write sites join the SAME fixpoint.
   const cellTypes = new Set()
-  for (const name of ctx.func.boxed.keys()) {
-    if (sig.params.some(p => p.name === name)) continue
-    if (ctx.func.localReps?.get(name)?.intCertain === true) cellTypes.add(name)
+  const boxedNames = new Set(ctx.func.boxed.keys())
+  if (boxedNames.size) {
+    const capturedIntCertain = intCertainMap(body, boxedNames)
+    for (const name of boxedNames) {
+      if (sig.params.some(p => p.name === name)) continue
+      if (capturedIntCertain.get(name) === true) cellTypes.add(name)
+    }
   }
 
   // Snapshot each param's JS-boundary carrier while reps are live — synthesizeBoundaryWrappers
@@ -614,6 +725,7 @@ function analyzeFuncForEmit(func, programFacts) {
     cseLoadBases,
     distinctParams: func.distinctParams || null,
     typedElem: ctx.types.typedElem ? new Map(ctx.types.typedElem) : null,
+    typedLen: ctx.types.typedLen ? new Map(ctx.types.typedLen) : null,
     localReps: cloneRepMap(ctx.func.localReps),
   }
 }
@@ -996,6 +1108,9 @@ function emitFunc(func, funcFacts, programFacts) {
   const _reps = paramReps.get(name)
 
   enterFunc(sig, body)
+  // Only this path drains charDecomp prologues (collectParamInits below) —
+  // the shape-1b global-receiver decomposition may mint only here.
+  ctx.func.charDecompGlobals = true
   const block = funcFacts.block
   ctx.func.locals = new Map(funcFacts.locals)
   ctx.func.boxed = new Map(funcFacts.boxed)
@@ -1004,6 +1119,8 @@ function emitFunc(func, funcFacts, programFacts) {
   ctx.func.sliceViews = new Set(funcFacts.sliceViews)
   ctx.func.localReps = cloneRepMap(funcFacts.localReps)
   ctx.types.typedElem = funcFacts.typedElem ? new Map(funcFacts.typedElem) : null
+  ctx.types.typedLen = funcFacts.typedLen ? new Map(funcFacts.typedLen)
+    : ctx.scope.globalTypedLen ? new Map(ctx.scope.globalTypedLen) : null
 
   // D: Apply call-site param facts (only if body analysis didn't already set them).
   // Schema bindings additionally write into ctx.schema.vars so prop-access dispatch
@@ -1013,13 +1130,20 @@ function emitFunc(func, funcFacts, programFacts) {
     for (const [k, r] of _reps) {
       if (k >= sig.params.length) continue
       const pname = sig.params[k].name
-      if (r.val && !ctx.func.localReps?.get(pname)?.val) updateRep(pname, { val: r.val })
-      if (r.typedCtor) {
+      // Same entry-vs-body-reassignment hazard analyzeFuncForEmit guards against
+      // (see its comment): r.val/r.typedCtor/r.schemaId describe the CALLER's
+      // argument, sound only while the body never writes the name. This step
+      // duplicates that seeding (funcFacts.localReps already carries whatever
+      // analyzeFuncForEmit settled, guarded — but re-applying the UNGUARDED
+      // call-site fact here would undo it) so it needs the identical guard.
+      const reassigned = isReassigned(body, pname)
+      if (r.val && !reassigned && !ctx.func.localReps?.get(pname)?.val) updateRep(pname, { val: r.val })
+      if (r.typedCtor && !reassigned) {
         if (!ctx.types.typedElem) ctx.types.typedElem = new Map()
         if (!ctx.types.typedElem.has(pname)) ctx.types.typedElem.set(pname, r.typedCtor)
         if (!ctx.func.localReps?.get(pname)?.val) updateRep(pname, { val: VAL.TYPED })
       }
-      if (r.schemaId != null && !exported && !ctx.schema.vars.has(pname)) {
+      if (r.schemaId != null && !reassigned && !exported && !ctx.schema.vars.has(pname)) {
         ctx.schema.vars.set(pname, r.schemaId)
         updateRep(pname, { schemaId: r.schemaId })
       }
@@ -1064,9 +1188,16 @@ function emitFunc(func, funcFacts, programFacts) {
     // externref so no `ref.is_null` branch is needed.
     if (p?.jsstring && p.jsstringDefault != null) continue
     const t = p?.type || 'f64'
+    // emit(defVal) ONCE, before branching on t — same self-host miscompile class as
+    // emit.js's 'return' handler. See .work/todo.md (groundtruth archive).
+    const emittedDefVal = emit(defVal)
+    // dyn-closure-tables.js: a default value that's provably a closure literal
+    // (e.g. subscript's `dispatch(ops, tail, fn = (a, …) => {…})`) is the fact
+    // proveClosureFactory needs to see through `dispatch`'s forwarded return.
+    recordParamClosureDefault(name, pname, emittedDefVal)
     defaultInits.set(pname,
       ['if', isUndef(typed(['local.get', `$${pname}`], 'f64')),
-        ['then', ['local.set', `$${pname}`, t === 'f64' ? asF64(emit(defVal)) : asI32(emit(defVal))]]])
+        ['then', ['local.set', `$${pname}`, t === 'f64' ? asF64(emittedDefVal) : asI32(emittedDefVal)]]])
   }
 
   // Box params that are mutably captured: allocate cell, copy param value
@@ -1102,6 +1233,28 @@ function emitFunc(func, funcFacts, programFacts) {
   // in-bounds char wrongly decodes as the OOB NaN.
   const collectParamInits = () => {
     const inits = []
+    // Global-receiver decompositions (shape 1b) come first: a param default
+    // like `(c = cur.charCodeAt(0))` must see the global's prologue locals
+    // populated. Globals are readable at entry, so nothing precedes them.
+    if (ctx.func.charDecomp) for (const dec of ctx.func.charDecomp.values())
+      if (dec.global) inits.push(...emitCharDecompPrologue(dec))
+    // Hoisted method-override probes (emit.js tryGenericEmitter): the probe's
+    // answer is loop-invariant for a stable-global receiver — resolve it once.
+    // Mirrors sidecarOverride's arm: primitives (real numbers, strings) can
+    // never carry an own override, so only NaN-boxed non-STRING receivers probe.
+    if (ctx.func.probeHoist) for (const ph of ctx.func.probeHoist.values()) {
+      const g = () => ['i64.reinterpret_f64', ph.recvIR()]
+      inits.push(
+        ['local.set', `$${ph.ovr}`, ['if', ['result', 'f64'],
+          ['i32.and',
+            ['f64.ne', ph.recvIR(), ph.recvIR()],
+            ['i64.ne',
+              ['i64.and', g(), ['i64.const', i64Hex(BigInt(LAYOUT.TAG_MASK) << BigInt(LAYOUT.TAG_SHIFT))]],
+              ['i64.const', i64Hex(BigInt(PTR.STRING) << BigInt(LAYOUT.TAG_SHIFT))]]],
+          ['then', ['f64.reinterpret_i64', ['call', '$__dyn_get_expr', g(), ph.keyIR()]]],
+          ['else', undefExpr()]]],
+        ['local.set', `$${ph.is}`, ptrTypeEq(['local.get', `$${ph.ovr}`], PTR.CLOSURE)])
+    }
     for (const p of sig.params) {
       const di = defaultInits.get(p.name)
       if (di) inits.push(di)
@@ -1135,6 +1288,10 @@ function emitFunc(func, funcFacts, programFacts) {
     fn.push(...paramInits, ...boxedParamInits, ...preboxedLocalInits, ...values)
   } else {
     const ir = emit(body)
+    // dyn-closure-tables.js: an expression-bodied function whose return value
+    // is unconditionally a closure literal (e.g. `mk = (n) => (x) => x + n`) —
+    // a direct-return closure factory, no defaulted-param indirection needed.
+    recordDirectReturnClosure(name, ir)
     const paramInits = collectParamInits()
     for (const [l, t] of ctx.func.locals) fn.push(['local', dollar(l), t])
     const finalIR = sig.ptrKind != null ? asPtrOffset(ir, sig.ptrKind) : asParamType(ir, sig.results[0])
@@ -1259,14 +1416,18 @@ function synthesizeBoundaryWrappers() {
       const ptrType = valKindToPtr(sig.ptrKind)
       body = toI64(mkPtrIR(ptrType, sig.ptrAux ?? 0, callIR))
     } else if (resultBool) {
-      // The inner func returns a clean 0/1 boolean carrier — never NaN. The i32
-      // carrier already takes truthyIR's identity path; the f64 carrier would
-      // otherwise fall through to the full __is_truthy NaN-discrimination, every
-      // arm of which is dead for a boolean. Pull the bit out with one f64.ne so
-      // boolBoxIR boxes `4|bit` straight into the TRUE_NAN/FALSE_NAN atom.
-      const carrier = sig.results[0] === 'i32'
-        ? typed(callIR, 'i32')
-        : typed(['f64.ne', callIR, ['f64.const', 0]], 'i32')
+      // The i32 carrier is a clean 0/1 — truthyIR's identity path boxes it
+      // straight into the TRUE_NAN/FALSE_NAN atom. The f64 carrier is NOT
+      // provably raw: a BOOL-valued result may already be the atom box
+      // (JSON.parse("false") returns FALSE_NAN — a bare f64.ne(v,0) reads any
+      // atom as truthy). __is_truthy normalizes both representations; this is
+      // the cold host boundary, the call costs nothing that matters.
+      let carrier
+      if (sig.results[0] === 'i32') carrier = typed(callIR, 'i32')
+      else {
+        inc('__is_truthy')
+        carrier = typed(['call', '$__is_truthy', toI64(callIR)], 'i32')
+      }
       body = toI64(boolBoxIR(carrier))
     } else if (resultBigint || resultDynamic) {
       // BigInt rides the i64-reinterpret-f64 carrier internally; a dynamic result is already an
@@ -1322,6 +1483,12 @@ function emitClosureBody(cb) {
   } else {
     ctx.types.typedElem = prevTypedElems
   }
+  // Static typed lengths ride the same channel (module globals + per-body): the
+  // typedIdxProven bounds proof reads the merged view.
+  const globalTL = ctx.scope.globalTypedLen
+  ctx.types.typedLen = cb.typedLens
+    ? (globalTL ? new Map([...globalTL, ...cb.typedLens]) : new Map(cb.typedLens))
+    : (globalTL ? new Map(globalTL) : null)
   // In closure bodies, boxed captures use the original name as both var and cell local
   ctx.func.boxed = cb.boxed ? new Map([...cb.boxed].map(v => [v, v])) : new Map()
   // i32-narrowed cells: the owner decided the cell width (funcFacts.cellTypes);
@@ -1673,11 +1840,30 @@ export default function compile(ast, profiler) {
           // Cache integer values for cross-call const-arg propagation: `f(N)` where
           // `const N = 8` should observe the param as intConst=8.
           if (isInt) (ctx.scope.constInts ||= new Map()).set(name, v)
+          // Cache EVERY folded value (fractional too) so readVar substitutes the
+          // literal at each read site — compile-time paths (emitPow's constant
+          // non-integer exponent → exp(c·log x), narrowing, the vectorizer) see
+          // through the global where V8 would only fold it at runtime. colorpq's
+          // PQ exponents (nv = 2610/16384, p = 1.7·2523/32) rode global.get into
+          // the generic runtime-exponent $math.pow because of exactly this gap.
+          ;(ctx.scope.constNums ||= new Map()).set(name, v)
         }
       }
     }
   }
 
+  // Typed-ctor sizes parked at prepare (`new T(CIN*H*W)` — names only now folded):
+  // re-run the static-len derivation with constInts populated. Feeds the interval
+  // proof's receiver lengths (typedIdxProven class 5).
+  if (ctx.scope.pendingTypedLens) {
+    for (const [name, rhs] of ctx.scope.pendingTypedLens) {
+      const len = typedStaticLen(rhs)
+      if (len != null && ctx.scope.globalTypedElem?.has(name))
+        (ctx.scope.globalTypedLen ||= new Map()).set(name, len)
+    }
+    ctx.scope.pendingTypedLens = null
+  }
+
   // Whole-program constant fold of module-scope aggregate literals — `var x=[1,2,3];
   // y=x[0]` → `y=1`, dropping the array (no data segment, no __arr_idx_known) when
   // every reference is a static read. The scalar analog of the constInts fold above.
@@ -1685,6 +1871,13 @@ export default function compile(ast, profiler) {
 
   const programFacts = timePhase(profiler, 'plan', () => plan(ast, profiler))
 
+  // Same-body indirect devirt (dyn-closure-tables.js): which module globals are
+  // structurally safe candidate closure tables (never alias/escape) — the
+  // write-family + call-site facts gathered during emission below only fire
+  // for names in this set. Post-plan so the scan sees the AST shapes that will
+  // actually emit.
+  if (ctx.transform.optimize) ctx.scope.dynFnTableCandidates = scanDynClosureTableCandidates(ast)
+
   // Inspect sink: editor hosts opt in via { inspect: true } to read inferred shapes.
   // Initialized here (post-plan) so paramReps and schema.list are stable, populated
   // per-function below as funcFacts settle. Bytes themselves are unchanged.
@@ -1800,6 +1993,12 @@ export default function compile(ast, profiler) {
 
   timePhase(profiler, 'buildStart', () => buildStartFn(ast, sec, closureFuncs, compilePendingClosures))
 
+  // dyn-closure-tables.js: every function AND module init has now emitted, so
+  // callSites/paramClosureDefaults/directReturnClosures are complete — resolve
+  // each candidate table's write family and (if monomorphic) hand it to
+  // devirtConstFnArrayCalls via ctx.scope.constFnArrays, same as a const array.
+  if (ctx.transform.optimize) timePhase(profiler, 'resolveDynFnTables', () => resolveDynFnTables(programFacts))
+
   // Host globals (globalThis/process/WebAssembly/…) referenced as values are
   // recorded in ctx.core.hostGlobals during emit; register them as env imports
   // now (assembly owns ctx.module.imports). Drained after buildStartFn so a
@@ -1848,10 +2047,10 @@ export default function compile(ast, profiler) {
       [`${ty}.const`, g.init]]
   }))
 
-  // Drop the Eisel-Lemire decimal table if no live code parses decimals at runtime — must
-  // run after sec.globals/funcs are final (exact reachability) and before the data segment
-  // below serializes ctx.runtime.data. See stripDeadElTable.
-  stripDeadElTable(sec)
+  // Drop the lazy conversion tables (EL decimal→f64, Ryū float→decimal) whose owner
+  // functions no live code calls — must run after sec.globals/funcs are final (exact
+  // reachability) and before the data segment below serializes ctx.runtime.data.
+  stripDeadLazyTables(sec)
 
   // Data segments (after emit — string literals append to ctx.runtime.data / strPool during emit)
   // Active segment at address 0 — skipped for shared memory (would collide across modules)
@@ -1866,6 +2065,28 @@ export default function compile(ast, profiler) {
   }
   if (ctx.runtime.data && !ctx.memory.shared)
     sec.data.push(['data', ['i32.const', 0], '"' + escBytes(ctx.runtime.data) + '"'])
+  // Shared memory: no active segment at 0 (instances would collide) — ship the
+  // static region (static strings + lazy conversion tables) as a PASSIVE segment,
+  // memory.init it into __alloc'd space at start, and rebase its consumers:
+  // $__staticBase for __static_str, plus each surviving table global (their
+  // declared inits hold offsets WITHIN the region — see injectTable/strip).
+  else if (ctx.runtime.data && ctx.memory.shared && ctx.scope.globals.has('__staticBase')) {
+    const len = ctx.runtime.data.length
+    sec.data.push(['data', '$__staticData', '"' + escBytes(ctx.runtime.data) + '"'])
+    const inits = [
+      ['global.set', '$__staticBase', ['call', '$__alloc', ['i32.const', len]]],
+      ['memory.init', '$__staticData', ['global.get', '$__staticBase'], ['i32.const', 0], ['i32.const', len]],
+      ['data.drop', '$__staticData'],
+      ...(ctx.runtime.lazySpans || []).map(t => ['global.set', `$${t.global}`,
+        ['i32.add', ['global.get', '$__staticBase'], ['i32.const', ctx.scope.globals.get(t.global)?.init || 0]]]),
+    ]
+    let startFn = sec.start.find(n => Array.isArray(n) && n[0] === 'func' && n[1] === '$__start')
+    if (!startFn) sec.start.push(startFn = ['func', '$__start'], ['start', '$__start'])
+    // insert after the local decls, before any init code (module init may stringify)
+    let at = 2
+    while (at < startFn.length && Array.isArray(startFn[at]) && startFn[at][0] === 'local') at++
+    startFn.splice(at, 0, ...inits)
+  }
   // Passive segment for shared-memory string literals (copied via memory.init at runtime)
   if (ctx.runtime.strPool)
     sec.data.push(['data', '$__strPool', '"' + escBytes(ctx.runtime.strPool) + '"'])
@@ -1984,6 +2205,33 @@ export default function compile(ast, profiler) {
 
   pruneUnusedThrowRuntime(sec)
 
+  // WASI reactor convention: the p1 ABI forbids WASI calls inside the wasm start
+  // section — a JS shim literally cannot serve them (fd_write during `new
+  // WebAssembly.Instance` has no memory to read; a top-level console.log/Date.now
+  // crashed with "Cannot read properties of null"). Ship module init as the
+  // standard `_initialize` export instead: hosts (jz/wasi + interop shims, node:wasi
+  // initialize(), wasmtime) call it once memory is wired. Command entries
+  // (`run`/`_start`) self-init through the same once-guard, so a runtime that
+  // invokes a command without calling `_initialize` still runs init exactly once.
+  if (ctx.transform.host === 'wasi') {
+    const sFn = sec.start.find(n => Array.isArray(n) && n[0] === 'func')
+    const sDirIdx = sec.start.findIndex(n => Array.isArray(n) && n[0] === 'start')
+    if (sFn) {
+      sec.globals.push(['global', '$__init_done', ['mut', 'i32'], ['i32.const', 0]])
+      let at = 2
+      while (at < sFn.length && Array.isArray(sFn[at]) && sFn[at][0] === 'local') at++
+      sFn.splice(at, 0,
+        ['if', ['global.get', '$__init_done'], ['then', ['return']]],
+        ['global.set', '$__init_done', ['i32.const', 1]])
+      sFn.splice(2, 0, ['export', '"_initialize"'])
+      if (sDirIdx !== -1) sec.start.splice(sDirIdx, 1)
+      for (const name of wasiCommandExports) {
+        const w = sec.funcs.find(f => Array.isArray(f) && f[1] === `$${name}$wasi`)
+        if (w) w.splice(w.findIndex(n => Array.isArray(n) && n[0] === 'drop'), 0, ['call', '$__start'])
+      }
+    }
+  }
+
   // Reorder non-import funcs by call count: hot callees get low LEB128 indices.
   // `call $f` encodes funcidx as ULEB128 (1 B for idx < 128, 2 B for idx < 16384).
   // On watr self-host this saves ~6 KB (hot specialized helpers migrate to idx < 128).

package/src/compile/infer.js

@@ -47,7 +47,8 @@ import { ctx } from '../ctx.js'
 import { collectParamNames, ASSIGN_OPS } from '../ast.js'
 import { analyzeValTypes, analyzeIntCertain } from './analyze.js'
 import { staticObjectProps, staticArrayElems } from '../static.js'
-import { typedElemCtor } from '../type.js'
+import { isNullishLit } from '../ir.js'
+import { typedElemCtor, typedStaticLen } from '../type.js'
 import { ctorFromElemAux } from '../../layout.js'
 import { shapeOfObjectLiteralAst, valTypeOf } from '../kind.js'
 import { includeForStringValue } from '../autoload.js'
@@ -130,11 +131,18 @@ export const inferParams = (body, candidates) => {
 // regardless of prior evidence — a later method call can't re-induce a shape
 // already contradicted by an earlier scalar assignment.
 
+// Methods that exist ONLY on String.prototype — seeing one on a bare binding proves
+// it is a string. `indexOf`/`includes`/`lastIndexOf`/`concat`/`slice`/`at` are NOT here:
+// Array.prototype has them too, so the receiver is genuinely ambiguous (and the argument
+// can't disambiguate — String coerces it, Arrays hold strings). Those keep the runtime
+// __ptr_type fork, which is correct for both; forcing `lastIndexOf` to string here used to
+// miscompile `arr.lastIndexOf(x)` to -1. A string-using param still narrows via any of the
+// real discriminators below (charCodeAt, a string assignment, a string-passing call site).
 const STRING_ONLY_METHODS = new Set([
   'charCodeAt', 'charAt', 'codePointAt', 'startsWith', 'endsWith',
   'toUpperCase', 'toLowerCase', 'toLocaleLowerCase', 'normalize', 'localeCompare',
   'padStart', 'padEnd', 'repeat', 'trimStart', 'trimEnd', 'trim',
-  'matchAll', 'match', 'replace', 'replaceAll', 'split', 'lastIndexOf',
+  'matchAll', 'match', 'replace', 'replaceAll', 'split',
 ])
 const ARRAY_ONLY_POISON = new Set([
   'push', 'pop', 'shift', 'unshift', 'splice', 'sort', 'fill', 'reverse',
@@ -334,13 +342,32 @@ export const inferLocals = (body, candidates) => {
 // confirmed prepare's depth-0 catch is a strict superset.
 export function recordGlobalRep(name, expr) {
   if (typeof name !== 'string') return
+  // A nullish decl init makes the binding NULLABLE program-wide — any later
+  // val-kind claim (typed promote, pointer-ABI assignment) must keep an
+  // `x === null` compare honest. This is THE plan-cache memo idiom
+  // (`let lastPlan = null` + `if (lastPlan === null) lastPlan = make()`):
+  // without the flag, strictSentinel folds the guard to a constant and the
+  // memo never fills (silently wrong values, not a trap).
+  if (isNullishLit(expr) || expr === 'null' || expr === 'undefined')
+    updateGlobalRep(name, { nullable: true })
   const vt = valTypeOf(expr)
   if (vt) {
     ;(ctx.scope.globalValTypes ||= new Map()).set(name, vt)
     if (vt === VAL.REGEX && ctx.runtime.regex) ctx.runtime.regex.vars.set(name, expr)
   }
   const ctor = typedElemCtor(expr)
-  if (ctor) (ctx.scope.globalTypedElem ||= new Map()).set(name, ctor)
+  if (ctor) {
+    ;(ctx.scope.globalTypedElem ||= new Map()).set(name, ctor)
+    const len = typedStaticLen(expr)
+    if (len != null) (ctx.scope.globalTypedLen ||= new Map()).set(name, len)
+    else {
+      ctx.scope.globalTypedLen?.delete(name)
+      // `new T(CIN*H*W)` — the size is a const expression whose names fold AFTER
+      // prepare (the compile-time constInts fixpoint). Park the rhs; the fold's tail
+      // re-runs typedStaticLen over these (see "Pre-fold const globals").
+      ;(ctx.scope.pendingTypedLens ||= new Map()).set(name, expr)
+    }
+  }
   // Module-level const array literal with a uniform element val-type (e.g. a numeric
   // table `const FREQS = [261.63, …]`): record it so `FREQS[i]` reads in any using
   // function are typed (NUMBER) rather than untyped. Without this an untyped element
@@ -496,7 +523,7 @@ export function inferArrElemValType(expr, callerArrElemVals, callerArrValParams)
 /** Infer typed-array ctor (`new.Float64Array` etc.) of an arg expression at a call site.
  *  Sources: caller's body-local typedElems, caller's typed params, literal `new TypedArray(...)`,
  *  calls to typed-narrowed user funcs. Returns null when the ctor can't be determined. */
-export function inferTypedCtor(expr, callerTypedElems, callerTypedParams) {
+export function inferTypedCtor(expr, callerTypedElems, callerTypedParams, callerSids) {
   if (typeof expr === 'string') {
     if (callerTypedElems?.has(expr)) return callerTypedElems.get(expr)
     if (callerTypedParams?.has(expr)) return callerTypedParams.get(expr)
@@ -508,5 +535,16 @@ export function inferTypedCtor(expr, callerTypedElems, callerTypedParams) {
     const f = ctx.func.map?.get(expr[1])
     if (f?.sig?.ptrKind === VAL.TYPED && f.sig.ptrAux != null) return ctorFromElemAux(f.sig.ptrAux)
   }
+  // Field provenance: `plan.twRe` where the receiver's schema slot holds one
+  // typed-array kind program-wide (observeProgramSlots) and the prop is never
+  // written — the write gate lives inside slotTypedCtorBySid. The receiver's
+  // schema comes from the caller's per-body localSids when provided (narrow's
+  // arg lattice — live reps aren't trustworthy there), else the idOf chain.
+  if (Array.isArray(expr) && (expr[0] === '.' || expr[0] === '?.') &&
+      typeof expr[1] === 'string' && typeof expr[2] === 'string' && ctx.schema?.slotTypedCtorAt) {
+    const sid = callerSids?.get(expr[1])
+    if (sid != null) return ctx.schema.slotTypedCtorBySid(sid, expr[2])
+    return ctx.schema.slotTypedCtorAt(expr[1], expr[2])
+  }
   return null
 }