Update tlottie and ship its no-SIMD build

Repin the vendored renderer to dkaraush/tlottie cbfaf4fa, which now builds
the same sources twice - with and without `-C target-feature=simd128`.
Both artifacts are vendored, and lottieLoader hands the scalar one to
browsers that fail IS_WEB_ASSEMBLY_SIMD_SUPPORTED, so stickers stay
animated on Chrome 75-90, Firefox 79-88 and Safari 15-16.3 instead of
freezing on their static thumbnail.

Which build runs is now separate from whether lottie runs at all: apart
from simd128 both need only bulk-memory, sign-extension and non-trapping
float-to-int, so the NO_WASM gates moved to a new probe for exactly those
(the shared validate() guard is factored out of both environment flags).

The vendoring script takes the upstream examples/web directory, verifies
each variant against its own source and stripped-output checksum, and
refuses a binary whose target_features contradict the expected variant.

Both builds render frame-identical output - the test asserts it across
every bundled asset and all six Fitz tones, so the golden hashes are
unchanged by the renderer update.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: morethanwords

scripts/vendor-tlottie.mjs

@@ -3,23 +3,29 @@ import {readFileSync, writeFileSync} from 'node:fs';
 import {dirname, resolve} from 'node:path';
 import {fileURLToPath} from 'node:url';
 
-const SOURCE_COMMIT = '8efaf11d2113e5d2d0ef0a8b0b710703d296c153';
-const SOURCE_SHA256 = '60f37ce619fac19905b760efce96195c7f4c683b2bca7f85777a8825ab613e19';
-const OUTPUT_SHA256 = '1d959e0e5efccd470c1a1ce79bcacc066cfa38499237955b0ec382d00245f8ec';
-
-const sourcePath = process.argv[2];
-if(!sourcePath) {
-  throw new Error('Usage: node scripts/vendor-tlottie.mjs /path/to/tlottie/examples/web/tlottie.wasm');
+const SOURCE_COMMIT = 'cbfaf4fa180a74aec826ac2662e83d3ae0bbc560';
+
+// Upstream builds the same sources twice: with and without `-C target-feature=simd128`.
+// Both variants are vendored so browsers without WebAssembly SIMD still get a renderer.
+const VARIANTS = [{
+  name: 'tlottie.wasm',
+  sourceSha256: '48e7ad6025cdae153214ea32ec4393c446475df7a3d5939d8cc286f7b9979248',
+  outputSha256: '0cb9c73e2e184d3c3d2762d4f7c23ed1c993a76a9f0c10f1ea84883a4dc41801',
+  simd: true
+}, {
+  name: 'tlottie.nosimd.wasm',
+  sourceSha256: '17bebc9128dcc3351a405a47192af7ee2c5d4653869fd76ef504c75681d242d7',
+  outputSha256: '01e0d8359073259cb6aed1a61e97ceee964419cdfecb2c8849a8deae6b6b934c',
+  simd: false
+}];
+
+const sourceDir = process.argv[2];
+if(!sourceDir) {
+  throw new Error('Usage: node scripts/vendor-tlottie.mjs /path/to/tlottie/examples/web');
 }
 
 const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
 
-const source = readFileSync(sourcePath);
-const sourceHash = sha256(source);
-if(sourceHash !== SOURCE_SHA256) {
-  throw new Error(`Expected tlottie ${SOURCE_COMMIT} (${SOURCE_SHA256}), got ${sourceHash}`);
-}
-
 const readVarUint32 = (bytes, start) => {
   let offset = start;
   let value = 0;
@@ -38,50 +44,99 @@ const readVarUint32 = (bytes, start) => {
   throw new Error('Invalid WebAssembly varuint32');
 };
 
-// Drop only debug/name custom sections from the upstream web artifact;
-// executable sections and target metadata remain byte-for-byte.
-const chunks = [source.subarray(0, 8)];
-let offset = 8;
-while(offset < source.length) {
-  const sectionStart = offset;
-  const sectionId = source[offset++];
-  const length = readVarUint32(source, offset);
-  const payloadStart = length.offset;
-  const sectionEnd = payloadStart + length.value;
-  if(sectionEnd > source.length) {
-    throw new Error('Invalid WebAssembly section length');
-  }
+const readSections = (bytes) => {
+  const sections = [];
+  let offset = 8;
+  while(offset < bytes.length) {
+    const sectionStart = offset;
+    const sectionId = bytes[offset++];
+    const length = readVarUint32(bytes, offset);
+    const payloadStart = length.offset;
+    const sectionEnd = payloadStart + length.value;
+    if(sectionEnd > bytes.length) {
+      throw new Error('Invalid WebAssembly section length');
+    }
+
+    let name;
+    if(sectionId === 0) {
+      const nameLength = readVarUint32(bytes, payloadStart);
+      const nameEnd = nameLength.offset + nameLength.value;
+      if(nameEnd > sectionEnd) {
+        throw new Error('Invalid WebAssembly custom section name');
+      }
 
-  let keep = true;
-  if(sectionId === 0) {
-    const nameLength = readVarUint32(source, payloadStart);
-    const nameEnd = nameLength.offset + nameLength.value;
-    if(nameEnd > sectionEnd) {
-      throw new Error('Invalid WebAssembly custom section name');
+      name = bytes.subarray(nameLength.offset, nameEnd).toString();
     }
 
-    const name = source.subarray(nameLength.offset, nameEnd).toString();
-    keep = !name.startsWith('.debug_') && name !== 'name';
+    sections.push({sectionId, name, payloadStart, sectionStart, sectionEnd});
+    offset = sectionEnd;
   }
 
-  if(keep) {
-    chunks.push(source.subarray(sectionStart, sectionEnd));
-  }
+  return sections;
+};
 
-  offset = sectionEnd;
-}
+// rustc records the enabled target features; it is the only place the two variants
+// are told apart, so the vendored binary has to keep it and match the requested build.
+const readTargetFeatures = (bytes, section) => {
+  const features = [];
+  let offset = section.payloadStart;
+  const name = readVarUint32(bytes, offset);
+  offset = name.offset + name.value;
+
+  const count = readVarUint32(bytes, offset);
+  offset = count.offset;
+  for(let i = 0; i < count.value; ++i) {
+    const prefix = String.fromCharCode(bytes[offset++]);
+    const length = readVarUint32(bytes, offset);
+    features.push(prefix + bytes.subarray(length.offset, length.offset + length.value).toString());
+    offset = length.offset + length.value;
+  }
 
-const output = Buffer.concat(chunks);
-new WebAssembly.Module(output);
-const outputHash = sha256(output);
-if(outputHash !== OUTPUT_SHA256) {
-  throw new Error(`Expected vendored tlottie ${OUTPUT_SHA256}, got ${outputHash}`);
-}
+  return features;
+};
 
 const rootDir = dirname(dirname(fileURLToPath(import.meta.url)));
-const outputPath = resolve(rootDir, 'src/vendor/tlottie/tlottie.wasm');
-writeFileSync(outputPath, output);
 
-console.log(`Vendored tlottie ${SOURCE_COMMIT}`);
-console.log(`source: ${source.length} bytes, ${sourceHash}`);
-console.log(`output: ${output.length} bytes, ${outputHash}`);
+for(const variant of VARIANTS) {
+  const sourcePath = resolve(sourceDir, variant.name);
+  const source = readFileSync(sourcePath);
+  const sourceHash = sha256(source);
+  if(sourceHash !== variant.sourceSha256) {
+    throw new Error(`Expected ${variant.name} of tlottie ${SOURCE_COMMIT} (${variant.sourceSha256}), got ${sourceHash}`);
+  }
+
+  const sections = readSections(source);
+  const targetFeatures = sections.find((section) => section.name === 'target_features');
+  if(!targetFeatures) {
+    throw new Error(`${variant.name} has no target_features section`);
+  }
+
+  const hasSimd = readTargetFeatures(source, targetFeatures).includes('+simd128');
+  if(hasSimd !== variant.simd) {
+    throw new Error(`${variant.name} ${hasSimd ? 'requires' : 'does not require'} simd128, which contradicts the expected variant`);
+  }
+
+  // Drop only debug/name custom sections from the upstream web artifact;
+  // executable sections and target metadata remain byte-for-byte.
+  const chunks = [source.subarray(0, 8)];
+  for(const section of sections) {
+    const keep = section.sectionId !== 0 ||
+      (!section.name.startsWith('.debug_') && section.name !== 'name');
+    if(keep) {
+      chunks.push(source.subarray(section.sectionStart, section.sectionEnd));
+    }
+  }
+
+  const output = Buffer.concat(chunks);
+  new WebAssembly.Module(output);
+  const outputHash = sha256(output);
+  if(outputHash !== variant.outputSha256) {
+    throw new Error(`Expected vendored ${variant.name} ${variant.outputSha256}, got ${outputHash}`);
+  }
+
+  writeFileSync(resolve(rootDir, 'src/vendor/tlottie', variant.name), output);
+
+  console.log(`Vendored ${variant.name} of tlottie ${SOURCE_COMMIT}`);
+  console.log(`source: ${source.length} bytes, ${sourceHash}`);
+  console.log(`output: ${output.length} bytes, ${outputHash}`);
+}

src/environment/webAssemblyBaselineSupport.ts

@@ -0,0 +1,18 @@
+import isWebAssemblyFeatureSupported from '@environment/webAssemblyFeatureSupport';
+
+// A minimal module using every post-MVP feature the vendored tlottie builds need:
+// bulk-memory (memory.copy), non-trapping float-to-int (i32.trunc_sat_f32_s) and
+// sign-extension (i32.extend8_s). Both the SIMD and the no-SIMD build need exactly
+// these, so a browser failing here cannot run either one.
+const BASELINE_TEST_MODULE = new Uint8Array([
+  0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
+  0x01, 0x05, 0x01, 0x60, 0x00, 0x01, 0x7f,
+  0x03, 0x02, 0x01, 0x00,
+  0x05, 0x03, 0x01, 0x00, 0x01,
+  0x0a, 0x16, 0x01, 0x14, 0x00, 0x41, 0x00, 0x41, 0x00, 0x41, 0x00, 0xfc, 0x0a, 0x00, 0x00,
+  0x43, 0x00, 0x00, 0x00, 0x00, 0xfc, 0x00, 0xc0, 0x0b
+]);
+
+const IS_WEB_ASSEMBLY_BASELINE_SUPPORTED = isWebAssemblyFeatureSupported(BASELINE_TEST_MODULE);
+
+export default IS_WEB_ASSEMBLY_BASELINE_SUPPORTED;

src/environment/webAssemblyFeatureSupport.ts

@@ -0,0 +1,9 @@
+import IS_WEB_ASSEMBLY_SUPPORTED from '@environment/webAssemblySupport';
+
+// Feature probes are minimal modules built from the opcodes they test for.
+// validate() stays synchronous and does not compile or execute application code.
+export default function isWebAssemblyFeatureSupported(testModule: BufferSource) {
+  return IS_WEB_ASSEMBLY_SUPPORTED &&
+    typeof(WebAssembly.validate) === 'function' &&
+    WebAssembly.validate(testModule);
+}

src/environment/webAssemblySimdSupport.ts

@@ -1,16 +1,13 @@
-import IS_WEB_ASSEMBLY_SUPPORTED from '@environment/webAssemblySupport';
+import isWebAssemblyFeatureSupported from '@environment/webAssemblyFeatureSupport';
 
-// A minimal module returning v128 and using SIMD opcodes. validate() stays
-// synchronous and does not compile or execute application code.
+// A minimal module returning v128 and using SIMD opcodes.
 const SIMD_TEST_MODULE = new Uint8Array([
   0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00,
   0x01, 0x05, 0x01, 0x60, 0x00, 0x01, 0x7b,
   0x03, 0x02, 0x01, 0x00,
   0x0a, 0x0a, 0x01, 0x08, 0x00, 0x41, 0x00, 0xfd, 0x0f, 0xfd, 0x62, 0x0b
 ]);
 
-const IS_WEB_ASSEMBLY_SIMD_SUPPORTED = IS_WEB_ASSEMBLY_SUPPORTED &&
-  typeof(WebAssembly.validate) === 'function' &&
-  WebAssembly.validate(SIMD_TEST_MODULE);
+const IS_WEB_ASSEMBLY_SIMD_SUPPORTED = isWebAssemblyFeatureSupported(SIMD_TEST_MODULE);
 
 export default IS_WEB_ASSEMBLY_SIMD_SUPPORTED;

src/lib/lottie/lottieLoader.ts

@@ -8,14 +8,22 @@ import LottiePlayer, {LottieOptions} from '@lib/lottie/lottiePlayer';
 import blobConstruct from '@helpers/blob/blobConstruct';
 import apiManagerProxy from '@lib/apiManagerProxy';
 import IS_WEB_ASSEMBLY_SIMD_SUPPORTED from '@environment/webAssemblySimdSupport';
+import IS_WEB_ASSEMBLY_BASELINE_SUPPORTED from '@environment/webAssemblyBaselineSupport';
 import makeError from '@helpers/makeError';
 import rootScope from '@lib/rootScope';
 import toArray from '@helpers/array/toArray';
 import lottieMessagePort from '@lib/lottie/lottieMessagePort';
 import SHOULD_RENDER_OFFSCREEN from '@lib/lottie/shouldRenderOffscreen';
 import tlottieWasmAssetUrl from '@vendor/tlottie/tlottie.wasm?url';
+import tlottieNoSimdWasmAssetUrl from '@vendor/tlottie/tlottie.nosimd.wasm?url';
 
-const TLOTTIE_WASM_URL = new URL(tlottieWasmAssetUrl, location.href).href;
+// tlottie builds the same renderer twice - the SIMD build is the fast path, the scalar
+// one keeps stickers animated on browsers without WebAssembly SIMD (Chrome 75-90,
+// Firefox 79-88, Safari 15-16.3). Both render frame-identical output.
+const TLOTTIE_WASM_URL = new URL(
+  IS_WEB_ASSEMBLY_SIMD_SUPPORTED ? tlottieWasmAssetUrl : tlottieNoSimdWasmAssetUrl,
+  location.href
+).href;
 
 export type LottieAssetName =
   | 'EmptyFolder'
@@ -116,7 +124,7 @@ export class LottieLoader {
   }
 
   public loadLottieWorkers() {
-    if(!IS_WEB_ASSEMBLY_SIMD_SUPPORTED) {
+    if(!IS_WEB_ASSEMBLY_BASELINE_SUPPORTED) {
       // This method is also used as a fire-and-forget preload. Unsupported
       // browsers should stay on their static fallback without an unhandled
       // rejection; actual animation loads still reject with NO_WASM below.
@@ -164,7 +172,7 @@ export class LottieLoader {
   public loadAnimationDataFromURL(url: string, method: 'json'): Promise<any>;
   public loadAnimationDataFromURL(url: string, method?: 'blob'): Promise<Blob>;
   public loadAnimationDataFromURL(url: string, method: 'json' | 'blob' = 'blob'): Promise<Blob | any> {
-    if(!IS_WEB_ASSEMBLY_SIMD_SUPPORTED) {
+    if(!IS_WEB_ASSEMBLY_BASELINE_SUPPORTED) {
       return Promise.reject(makeError('NO_WASM'));
     }
 
@@ -223,7 +231,7 @@ export class LottieLoader {
   }
 
   public async loadAnimationWorker(params: LottieOptions): Promise<LottiePlayer> {
-    if(!IS_WEB_ASSEMBLY_SIMD_SUPPORTED) {
+    if(!IS_WEB_ASSEMBLY_BASELINE_SUPPORTED) {
       throw makeError('NO_WASM');
     }
 
@@ -309,7 +317,7 @@ export class LottieLoader {
   }
 
   public destroyWorkers() {
-    if(!IS_WEB_ASSEMBLY_SIMD_SUPPORTED) {
+    if(!IS_WEB_ASSEMBLY_BASELINE_SUPPORTED) {
       return;
     }