Perf: low-risk codegen cleanups (dead box/unbox elision + loop-invariant hoisting)

[nickna]

Part of #856 (perf epic). Lowest-risk, start-today candidate — correctness-neutral codegen cleanups that help every numeric path. Good for validating the cost model (#856) before the larger refactors.

Summary

The emitted IL contains pervasive redundant work that a small peephole / loop-invariant pass would remove. Two independent items, grouped because both are local IL-cleanup passes:

(a) Dead box → unbox round-trips and discarded boxed results

A value already typed float64 on the stack is boxed and then immediately coerced back via a $Runtime call:

// stringWork scan — s.length:
conv.r8
box Double
call $Runtime::ConvertToNumber(object)   // <-- box then immediately unbox

// stringWork — charCodeAt result, and again for the index arg:
box Double → $Runtime::ToNumber(object)
box Double → $Runtime::ConvertToNumber(object)

And boxed values computed only to be thrown away — the push return (array length) is computed, boxed, and popped:

// countPrimes / arrayMethodWork after ArrayPush:
callvirt List`1::get_Count()
conv.r8
box Double
pop                                       // <-- boxed for nothing

Fix: when the static stack type already matches the consumer, skip the box + $Runtime coercion; when a boxed result is unused, don't compute/box it.

(b) Loop-invariant recomputation (LICM/CSE)

stringWork's scan recomputes UnwrapStringReceiver(s) + get_Length() every iteration although s is not mutated in that loop; array loops recompute .Count similarly.

IL_005a: call string $Runtime::UnwrapStringReceiver(object)  // loop-invariant
IL_005f: call instance int32 String::get_Length()            // loop-invariant

Fix: hoist provably loop-invariant receiver-unwrap / length / count out of the loop header.

Notes

• (a) composes with Perf epic: close the compiled-output gap to Node (without regressing interop or conformance) #856-F4: once locals are typed, many of these boxes vanish at the source; the peephole catches what remains and helps even before F4.
• These are pure codegen; no runtime-semantics change, so risk is low — but still gate on full suites since IL shape changes can surface latent verifier issues (--verify).

Scope / priority

Low risk, broad benefit. Good first perf PR.

[nickna]

Closing. The high-value slice — eliminating the per-char escaping box Double → $Runtime::ConvertToNumber round-trip in the promoted-string charCodeAt scan — shipped in #873 and took strings to ≈parity with Node (a real per-character heap allocation, removed).

The remaining items here are not worth pursuing for warm performance:

• box;pop (discarded boxed results) and dup;st;pop (discarded assignment results) are already elided by RyuJIT (box-pop optimization + register allocation) in tier-1 → zero steady-state gain; the typed work also removed them from the hot loops.
• The other static box sites (general charCodeAt, count-primes array reads) are structural branch-merges (a typed value converging with a boxed object/$Undefined fallback), not dead round-trips — removing them breaks IL verification.
• A general peephole-rewrite pass isn't feasible without an IL-buffer layer (ValidatedILBuilder emits straight to ILGenerator); the source-level valueNeeded alternative is a risky change to the core expression emitter for marginal cold-start/DLL-size gains only.

Reopen-worthy only if the goal shifts to cold-start/tier-0 latency or DLL size, or as part of building general IL-optimization infrastructure.