@@ -18,45 +18,54 @@ pub(crate) struct ValueStack {
 }
 
 #[cfg_attr(feature = "debug", derive(Debug))]
+/// One value lane: a stack of `len` values over `data`.
+///
+/// `data` only grows. Its length is the most the stack has ever reserved, and the slots above
+/// `len` hold stale values that are written before they are read again. Keeping the height outside
+/// the `Vec` lets the tail-call handlers carry it in a register and write it back without `unsafe`.
 pub(crate) struct Stack<T: Copy + Default> {
     data: Vec<T>,
+    len: usize,
     max_size: usize,
     dynamic: bool,
 }
 
 impl<T: Copy + Default> Stack<T> {
     pub(crate) fn new(config: StackConfig) -> Self {
-        Self { data: Vec::with_capacity(config.initial_size), max_size: config.max_size, dynamic: config.dynamic }
+        Self { data: Vec::with_capacity(config.initial_size), len: 0, max_size: config.max_size, dynamic: config.dynamic }
     }
 
     pub(crate) fn clear(&mut self) {
-        self.data.clear();
+        self.len = 0;
     }
 
     #[inline(always)]
     pub(crate) fn len(&self) -> usize {
-        self.data.len()
+        self.len
     }
 
     /// Pushes a value inside a function body. `enter_locals` reserved the function's whole operand
-    /// stack, so the stack is never full here. After this check `Vec::push` cannot reach its own
-    /// growth path, so the instruction handlers make no calls.
+    /// stack, so the stack is never full here, and the handlers make no calls.
     #[inline(always)]
     pub(crate) fn push(&mut self, value: T) {
-        if self.data.len() == self.data.capacity() {
-            crate::invariant_violated("value stack push beyond the function's reservation");
+        let len = self.len;
+        match self.data.get_mut(len) {
+            Some(slot) => *slot = value,
+            None => crate::invariant_violated("value stack push beyond the function's reservation"),
         }
-        self.data.push(value);
+        self.len = len + 1;
     }
 
     /// Pushes a value outside a function body (host arguments and results), which no reservation
     /// covers, so a dynamic stack grows here if needed.
     #[inline(always)]
     pub(crate) fn push_or_grow(&mut self, value: T) -> Result<(), Trap> {
-        if self.data.len() == self.data.capacity() {
-            return self.push_grow(value);
+        let len = self.len;
+        match self.data.get_mut(len) {
+            Some(slot) => *slot = value,
+            None => return self.push_grow(value),
         }
-        self.data.push(value);
+        self.len = len + 1;
         Ok(())
     }
 
@@ -69,33 +78,36 @@ impl<T: Copy + Default> Stack<T> {
     #[cold]
     #[inline(never)]
     fn push_grow(&mut self, value: T) -> Result<(), Trap> {
-        // Check the limit only at capacity to avoid an extra hot-path check. Vec growth may
-        // intentionally overshoot max_size.
-        if !self.dynamic || self.data.len() >= self.max_size {
+        // Only the reserved capacity is free to use. Past it, check the limit, which Vec growth
+        // may intentionally overshoot.
+        if self.data.len() == self.data.capacity() && (!self.dynamic || self.data.len() >= self.max_size) {
             return Err(Trap::ValueStackOverflow);
         }
         self.data.push(value);
+        self.len = self.data.len();
         Ok(())
     }
 
+    /// Pops the top value. On an empty stack the index wraps around, so the bounds check in
+    /// [`Self::get`] also catches an underflow.
     #[inline(always)]
     pub(crate) fn pop(&mut self) -> T {
-        match self.data.pop() {
-            Some(value) => value,
-            None => crate::invariant_violated("value stack underflow"),
-        }
+        let index = self.len.wrapping_sub(1);
+        let value = *self.get(index);
+        self.len = index;
+        value
     }
 
     #[inline(always)]
     pub(crate) fn last(&self) -> &T {
-        match self.data.last() {
-            Some(value) => value,
-            None => crate::invariant_violated("value stack underflow"),
-        }
+        self.get(self.len.wrapping_sub(1))
     }
 
+    /// The slot at `index`, which validation keeps below the height. The check is against the
+    /// slots in use at any height, which is what memory safety needs.
     #[inline(always)]
     pub(crate) fn get(&self, index: usize) -> &T {
+        debug_assert!(index < self.len);
         match self.data.get(index) {
             Some(value) => value,
             None => crate::invariant_violated("value stack index out of range"),
@@ -104,6 +116,7 @@ impl<T: Copy + Default> Stack<T> {
 
     #[inline(always)]
     pub(crate) fn set(&mut self, index: usize, value: T) {
+        debug_assert!(index < self.len);
         match self.data.get_mut(index) {
             Some(slot) => *slot = value,
             None => crate::invariant_violated("value stack index out of range"),
@@ -118,29 +131,35 @@ impl<T: Copy + Default> Stack<T> {
 
     #[inline(always)]
     pub(crate) fn truncate_keep(&mut self, n: usize, end_keep: usize) {
-        let len = self.data.len();
+        let len = self.len;
         debug_assert!(n <= len);
         if n >= len {
             return;
         }
 
         let keep = len.wrapping_sub(n).min(end_keep);
-        self.data.copy_within(len.wrapping_sub(keep)..len, n);
-        self.data.truncate(n.wrapping_add(keep));
+        if keep != 0 {
+            // Copying to the start of the values above `n` leaves copy_within no check to fail.
+            match self.data.get_mut(n..len) {
+                Some(above) => above.copy_within(above.len().wrapping_sub(keep).., 0),
+                None => crate::invariant_violated("value stack index out of range"),
+            }
+        }
+        self.len = n.wrapping_add(keep);
     }
 
     #[inline(always)]
     pub(crate) fn truncate_to(&mut self, n: usize) {
-        debug_assert!(n <= self.data.len());
-        self.data.truncate(n);
+        debug_assert!(n <= self.len);
+        self.len = n;
     }
 
     #[inline(always)]
     pub(crate) fn truncate_to_one_tail(&mut self, n: usize) {
-        debug_assert!(n < self.data.len());
+        debug_assert!(n < self.len);
         let last = self.pop();
-        self.data.truncate(n);
-        self.data.push(last);
+        self.len = n;
+        self.push(last);
     }
 
     /// Enters a function: turns its parameters into the first locals, zeroes the rest, and reserves
@@ -154,27 +173,52 @@ impl<T: Copy + Default> Stack<T> {
         max_stack: usize,
     ) -> Result<u32, Trap> {
         debug_assert!(param_count <= local_count);
-        debug_assert!(param_count <= self.data.len());
+        debug_assert!(param_count <= self.len);
 
-        let len = self.data.len();
+        let len = self.len;
         let start = len - param_count;
         let end = start + local_count;
         let reserve = end + max_stack;
 
-        if reserve > self.data.capacity() {
+        if reserve > self.data.len() {
             core::hint::cold_path();
+            self.grow_to(reserve)?;
+        }
+
+        // Most functions have no or few locals in a lane. Store the first and last directly and
+        // fill only what lies between: `fill` becomes a memset call even for one value.
+        if end > len {
+            match self.data.get_mut(len..end) {
+                Some([a]) => *a = T::default(),
+                Some([a, middle @ .., b]) => {
+                    if !middle.is_empty() {
+                        middle.fill(T::default());
+                    }
+                    (*a, *b) = (T::default(), T::default());
+                }
+                _ => crate::invariant_violated("value stack index out of range"),
+            }
+        }
+        self.len = end;
+        Ok(start as u32)
+    }
+
+    /// Makes `reserve` slots usable, growing the allocation if a dynamic stack allows it.
+    #[cold]
+    #[inline(never)]
+    fn grow_to(&mut self, reserve: usize) -> Result<(), Trap> {
+        let cap = self.data.capacity();
+        if reserve > cap {
             if reserve > self.max_size || !self.dynamic {
                 return Err(Trap::ValueStackOverflow);
             }
-            let cap = self.data.capacity();
             let target = reserve.max(cap.max(1).saturating_mul(2)).min(self.max_size);
-            if self.data.try_reserve(target - len).is_err() {
+            if self.data.try_reserve(target - self.data.len()).is_err() {
                 return Err(Trap::ValueStackOverflow);
             }
         }
-
-        self.data.resize(end, T::default());
-        Ok(start as u32)
+        self.data.resize(reserve, T::default());
+        Ok(())
     }
 
     #[inline(always)]
@@ -183,7 +227,7 @@ impl<T: Copy + Default> Stack<T> {
             return;
         }
 
-        let len = self.data.len();
+        let len = self.len;
         let needed = count.wrapping_mul(2);
 
         if len < needed {
@@ -193,10 +237,13 @@ impl<T: Copy + Default> Stack<T> {
         if !condition {
             let dst = len.wrapping_sub(needed);
             let src = len.wrapping_sub(count);
-            self.data.copy_within(src..len, dst);
+            match self.data.get_mut(..len) {
+                Some(live) => live.copy_within(src..len, dst),
+                None => crate::invariant_violated("value stack index out of range"),
+            }
         }
 
-        self.data.truncate(len.wrapping_sub(count));
+        self.len = len.wrapping_sub(count);
     }
 }
 
@@ -205,7 +252,7 @@ impl<'a, T: Copy + Default> IntoIterator for &'a Stack<T> {
     type IntoIter = core::slice::Iter<'a, T>;
 
     fn into_iter(self) -> Self::IntoIter {
-        self.data.iter()
+        self.data[..self.len].iter()
     }
 }
 impl ValueStack {