release/v0.6.0 PR-B: eliminate_dead_locals (-0.86% on gale)

[avrabe]

Summary

Second PR of v0.6.0. Stacks on PR #94 — base branch is release/v0.6.0-pr-a-cse-cost-threshold, so this PR's diff shows only the new pass. After PR #94 merges, GitHub will auto-retarget this PR to main.

A new pass eliminate_dead_locals that drops locals declared by a function but never read by any LocalGet anywhere in the function body. Targets the gale "default-then-override" pattern: rustc/LLVM materializes an EINVAL default at function entry, then every reachable path overwrites it before return. The default's local.set becomes pure dead store.

Pick #2 from the v0.6.0 wasm-opt-gap research agent's plan, narrowed to the path-insensitive subset (full liveness is Pick #3).

Why a NEW pass instead of extending simplify_locals?

The crucial observation: "zero reads anywhere in the function" is a structural property of the instruction tree — sound regardless of BrIf/BrTable/early-Return control flow. So this pass DOES NOT need the has_dataflow_unsafe_control_flow guard that gates simplify_locals (lib.rs:7706) and coalesce_locals (lib.rs:9843) on every kernel-style early-exit function.

v0.5.0's simplify_locals had zero effect on the gale workload by construction. This pass picks up where it refused to act.

Algorithm

1. Recursive read-count scan over the instruction tree (matches the recursion shape of remap_instructions and eliminate_redundant_sets).
2. Dead set: { idx | idx >= param_count && reads(idx) == 0 }.
3. Neutralize writes to dead locals:
   • LocalSet dead → Drop (preserves [T] -> [] stack effect)
   • LocalTee dead → removed (Tee's [T] -> [T] lets the value pass through)
4. Pack-down remap: surviving locals get dense indices starting at param_count (best LEB128 encoding); reuse existing remap_instructions.
5. Z3 translation-validation — revert on rejection.

Stack-effect rationale (subtle!)

Original	Stack effect	Substitute	Why
LocalSet idx	[T] -> []	Drop	Drop also [T] -> []
LocalTee idx	[T] -> [T]	(removed)	Value passes through unchanged

Confusing these would corrupt the stack — replacing LocalTee with Drop would consume a value that downstream consumers expected to remain. The asymmetric handling in neutralize_dead_writes is the single most important correctness invariant in this PR.

Measurement on gale_ffi

Build	Code section	Δ vs baseline
baseline	811 B	—
v0.5.0 (regression)	862 B	+6.3%
v0.6.0 PR-A (CSE)	808 B	-0.4%
v0.6.0 PR-B (this)	804 B	-0.86%

PR-A and PR-B are independent and stack: PR-A fixes the regression, PR-B exposes a new optimization wasm-opt does that LOOM previously skipped on early-exit code.

Visual confirmation (gale_bitarray_alloc_validate, func 0)

Before:

(local i32)         ;; local 3 declared
i32.const -22
local.set 3         ;; writes EINVAL — never read
local.get 0
...

After (this PR):

(no locals)
i32.const -22
drop                ;; LocalSet → Drop
local.get 0
...

Tests (5 new)

• test_eliminate_dead_locals_basic_write_only — the canonical gale pattern; pin elimination.
• test_eliminate_dead_locals_preserves_used_locals — locals that ARE read must survive.
• test_eliminate_dead_locals_localtee_neutralization — Tee removed (not Drop) — encoding must validate.
• test_eliminate_dead_locals_packs_indices — surviving middle-deleted locals get packed indices, downstream LocalGet/Set/Tee references all updated.
• test_eliminate_dead_locals_skips_params — parameters are caller-observable, never touched.

All 252 existing lib tests pass.

Follow-ups (not in this PR)

• The leftover i32.const -22; drop pair is dead code that vacuum could in principle eliminate. A const+drop peephole in vacuum (~5 LOC) would close the loop on this transformation. Tracked for follow-up.
• Pick Phase 3: ISLE Term Definitions #3 (RedundantSetElimination liveness) — the path-sensitive case. ~600 LOC, ~1.5 weeks. Will further close the gap on functions where SOME paths use a local but a particular write is dominated by another write.

🤖 Generated with Claude Code