@tishlang/tish-lsp 2.38.0 → 2.43.8

package/crates/tish_vm/src/vm.rs

@@ -693,6 +693,16 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
     math.insert("fround".into(), Value::native(|a: &[Value]| math_builtins::fround(a)));
     math.insert("PI".into(), Value::Number(std::f64::consts::PI));
     math.insert("E".into(), Value::Number(std::f64::consts::E));
+    // #539: the remaining ECMAScript Math value constants (were missing → `null`).
+    math.insert("LN2".into(), Value::Number(std::f64::consts::LN_2));
+    math.insert("LN10".into(), Value::Number(std::f64::consts::LN_10));
+    math.insert("LOG2E".into(), Value::Number(std::f64::consts::LOG2_E));
+    math.insert("LOG10E".into(), Value::Number(std::f64::consts::LOG10_E));
+    math.insert("SQRT2".into(), Value::Number(std::f64::consts::SQRT_2));
+    math.insert(
+        "SQRT1_2".into(),
+        Value::Number(std::f64::consts::FRAC_1_SQRT_2),
+    );
     g.insert("Math".into(), value_object_from_map(math));
 
     let mut json = ObjectMap::default();
@@ -860,6 +870,14 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
         "fromEntries".into(),
         Value::native(|args: &[Value]| globals_builtins::object_from_entries(args)),
     );
+    object_methods.insert(
+        "freeze".into(),
+        Value::native(|args: &[Value]| globals_builtins::object_freeze(args)),
+    );
+    object_methods.insert(
+        "isFrozen".into(),
+        Value::native(|args: &[Value]| globals_builtins::object_is_frozen(args)),
+    );
     object_methods.insert(
         "keys".into(),
         Value::native(|args: &[Value]| globals_builtins::object_keys(args)),
@@ -1382,7 +1400,14 @@ mod hof_fusion {
     #[inline]
     fn numeric_snapshot(arr: &Value) -> Option<Vec<f64>> {
         match arr {
-            Value::NumberArray(a) => Some(a.borrow().clone()),
+            Value::NumberArray(a) => match a.borrow().as_packed() {
+                Some(v) => Some(v.clone()),
+                None => a
+                    .borrow()
+                    .as_boxed()
+                    .map(|vs| vs.iter().map(|v| v.as_number()).collect::<Option<Vec<f64>>>())
+                    .unwrap_or(None),
+            },
             Value::Array(a) => {
                 let b = a.borrow();
                 let mut out = Vec::with_capacity(b.len());
@@ -1671,19 +1696,27 @@ impl tishlang_core::Callable for VmClosure {
             native_modules: self.native_modules.clone(),
         };
         #[cfg(not(target_arch = "wasm32"))]
-        let result = {
-            stacker::maybe_grow(128 * 1024, 2 * 1024 * 1024, || {
-                vm.run_chunk(self.chunk.as_ref(), &self.chunk.nested, args, false)
-                    .unwrap_or(Value::Null)
-            })
-        };
+        let run = stacker::maybe_grow(128 * 1024, 2 * 1024 * 1024, || {
+            vm.run_chunk(self.chunk.as_ref(), &self.chunk.nested, args, false)
+        });
         #[cfg(target_arch = "wasm32")]
-        let result = {
-            vm.run_chunk(&self.chunk, &self.chunk.nested, args, false)
-                .unwrap_or(Value::Null)
-        };
+        let run = vm.run_chunk(&self.chunk, &self.chunk.nested, args, false);
         tishlang_core::dec_call_depth();
-        result
+        match run {
+            Ok(v) => v,
+            // A catchable throw is already parked in the pending slot; the caller's
+            // take_pending_throw() surfaces it, so just yield Null here (issue #60).
+            Err(ref e) if e == PENDING_THROW_SENTINEL || tishlang_core::has_pending_throw() => {
+                Value::Null
+            }
+            // A plain runtime error inside the body (Undefined variable, type error, bad index,
+            // call-of-non-function, …) must NOT vanish to null — park it as a catchable error so the
+            // caller propagates it, matching the interpreter and top-level VM.
+            Err(e) => {
+                set_pending_throw(construct_builtin::error_object("Error", &e));
+                Value::Null
+            }
+        }
     }
     fn as_any(&self) -> &dyn std::any::Any {
         self
@@ -1891,15 +1924,91 @@ impl Vm {
                 _ => return OsrResult::LiveInMiss, // a live slot is non-numeric → deopt, keep interpreting
             }
         }
+        // #203: array live-ins → a scratch `Vec<f64>` per array (the matmul lever). `scratch` OWNS the
+        // extracted data; the [`crate::jit::ArrayHandle`]s point into it and are built only AFTER it is
+        // fully populated so no inner buffer reallocates under a live pointer. A live-in that is not an
+        // all-`Number` `Value::Array` (a `NumberArray`, a boxed non-number element, a non-array) bails
+        // to the interpreter — so a misclassified array slot is always correct, just not JIT'd.
+        let mut scratch: Vec<Vec<f64>> = Vec::with_capacity(loopfn.array_slots.len());
+        for &(slot, _writable) in &loopfn.array_slots {
+            match slots.get(slot_base + slot as usize) {
+                Some(Value::Array(a)) => {
+                    let b = a.borrow();
+                    let mut ebuf: Vec<f64> = Vec::with_capacity(b.len());
+                    for el in b.iter() {
+                        match el {
+                            Value::Number(n) => ebuf.push(*n),
+                            _ => return OsrResult::LiveInMiss,
+                        }
+                    }
+                    scratch.push(ebuf);
+                }
+                _ => return OsrResult::LiveInMiss,
+            }
+        }
+        // #203: a WRITABLE array must not alias another array live-in — the region reads/writes a
+        // PRIVATE scratch copy, so aliasing would make one array's writes invisible to the other (the
+        // interpreter shares one backing store). Bail to the interpreter on any such overlap.
+        for (k, &(slot_k, writable_k)) in loopfn.array_slots.iter().enumerate() {
+            if !writable_k {
+                continue;
+            }
+            let ak = match slots.get(slot_base + slot_k as usize) {
+                Some(Value::Array(a)) => a,
+                _ => return OsrResult::LiveInMiss,
+            };
+            for (j, &(slot_j, _)) in loopfn.array_slots.iter().enumerate() {
+                if j == k {
+                    continue;
+                }
+                if let Some(Value::Array(aj)) = slots.get(slot_base + slot_j as usize) {
+                    if VmRef::ptr_eq(ak, aj) {
+                        return OsrResult::LiveInMiss;
+                    }
+                }
+            }
+        }
+        let mut handles: Vec<crate::jit::ArrayHandle> = scratch
+            .iter_mut()
+            .map(|b| crate::jit::ArrayHandle {
+                ptr: b.as_mut_ptr(),
+                len: b.len(),
+            })
+            .collect();
         let mut deopt: u8 = 0;
-        // SAFETY: `buf` is a valid `[f64; used_slots.len()]`; `deopt` is a valid `*mut u8`. The region
-        // was compiled for exactly this chunk+header (fingerprint-checked in the cache).
-        let exit_id = loopfn.call(&mut buf, &mut deopt);
+        // SAFETY: `buf` is a valid `[f64; used_slots.len()]`, `handles` a valid `[ArrayHandle;
+        // array_slots.len()]` whose scratch outlives the call, `deopt` a valid `*mut u8`. The region was
+        // compiled for exactly this chunk+header (fingerprint-checked in the cache) and its ABI matches
+        // `array_slots` (2-pointer when empty, 3-pointer otherwise).
+        let exit_id = loopfn.call(&mut buf, &mut handles, &mut deopt);
+        if deopt != 0 {
+            // An int-slot live-in wasn't an exact in-range integer (#514), OR an array index went
+            // out of bounds mid-region (#203). Either way the region bailed WITHOUT committing — `buf`
+            // and the array scratch are discarded here, the caller's arrays are untouched — so re-
+            // interpreting from the pristine pre-loop slots is correct (no partial result escapes).
+            return OsrResult::LiveInMiss;
+        }
         for (p, &slot) in loopfn.used_slots.iter().enumerate() {
             if let Some(d) = slots.get_mut(slot_base + slot as usize) {
                 *d = Value::Number(buf[p]);
             }
         }
+        // #203: copy each WRITABLE array's (possibly-mutated) scratch back into its `Value::Array`.
+        // Length is unchanged (`SetIndex` can't grow the array; an OOB write deopts above), so this is
+        // a same-length element overwrite — mirroring `try_call_array_jit`'s writeback.
+        for (k, &(slot, writable)) in loopfn.array_slots.iter().enumerate() {
+            if !writable {
+                continue;
+            }
+            if let Some(Value::Array(a)) = slots.get(slot_base + slot as usize) {
+                let mut b = a.borrow_mut();
+                for (j, &v) in scratch[k].iter().enumerate() {
+                    if let Some(el) = b.get_mut(j) {
+                        *el = Value::Number(v);
+                    }
+                }
+            }
+        }
         match loopfn.exits.get(exit_id as usize) {
             Some(&ip) => OsrResult::Compiled(ip),
             // Out-of-range exit id is impossible (the region returns an in-range id), but if it ever
@@ -2265,6 +2374,13 @@ impl Vm {
             std::collections::HashMap::new();
         #[cfg(not(target_arch = "wasm32"))]
         let mut osr_hot: (usize, u32) = (usize::MAX, 0);
+        // #203: `trig header → back-edge count at last OSR attempt`, so an outermost (expanded) region
+        // fires on the FIRST sound entry past the threshold and then re-attempts only every `OSR_RETRY`
+        // back-edges (a `LiveInMiss` cooldown). Its own back-edge is too rare for the modulo cadence the
+        // flag-off path uses. Unused when `TISH_JIT_OSR_ARRAY` is off.
+        #[cfg(not(target_arch = "wasm32"))]
+        let mut osr_last_attempt: std::collections::HashMap<usize, u32> =
+            std::collections::HashMap::new();
         // Frame-local string builder for `acc += x` on a slot local (Opcode::AppendLocal): keeps the
         // accumulator in a growable `sb_buf` so appends are amortized O(1) instead of reallocating the
         // whole string each time. `sb_slot` is the slot currently buffered (at most one). The slot's
@@ -2455,6 +2571,23 @@ impl Vm {
                         .ok_or_else(|| format!("Bad MathUnary id: {}", id))?;
                     self.stack.push(Value::Number(mfn.apply(x)));
                 }
+                Opcode::MathBinary => {
+                    // #203 — `Math.<fn>(a, b)` on two numbers. Same reasoning as MathUnary (emitted
+                    // only when `Math` is the global builtin); each non-number coerces to NaN. Args
+                    // were pushed a-then-b, so pop b first.
+                    let id = Self::read_u16(code, &mut ip);
+                    let b = match self.stack.pop() {
+                        Some(Value::Number(n)) => n,
+                        Some(_) | None => f64::NAN,
+                    };
+                    let a = match self.stack.pop() {
+                        Some(Value::Number(n)) => n,
+                        Some(_) | None => f64::NAN,
+                    };
+                    let bfn = tishlang_bytecode::MathBinaryFn::from_u16(id)
+                        .ok_or_else(|| format!("Bad MathBinary id: {}", id))?;
+                    self.stack.push(Value::Number(bfn.apply(a, b)));
+                }
                 Opcode::LoadConst => {
                     let idx = Self::read_u16(code, &mut ip);
                     let c = constants
@@ -2967,8 +3100,10 @@ impl Vm {
                     if chunk.slot_based && Self::osr_enabled() {
                         let region_end = ip;
                         let header_ip = ip.saturating_sub(dist);
-                        // Switch the fast slot only when the active loop changes: stash the old count,
-                        // load this header's (default 0). The hot loop keeps `header_ip == osr_hot.0`.
+                        // Count on the RAW header via the single-entry fast slot — byte-identical to the
+                        // pre-#203 baseline. ALL #203 expansion work is gated behind the threshold below,
+                        // so a loop that is cold *per enclosing call* (e.g. nbody's `advance`, entered
+                        // 200k× with ~5-iteration loops) never reaches the gate and pays ZERO extra cost.
                         if header_ip != osr_hot.0 {
                             if osr_hot.0 != usize::MAX {
                                 osr_counters.insert(osr_hot.0, osr_hot.1);
@@ -2980,25 +3115,87 @@ impl Vm {
                         }
                         if osr_hot.1 != u32::MAX {
                             osr_hot.1 = osr_hot.1.saturating_add(1);
-                            if osr_hot.1 >= OSR_THRESHOLD
-                                && osr_hot
+                            if osr_hot.1 >= OSR_THRESHOLD {
+                                if crate::jit::osr_array_enabled() {
+                                    // #203: this loop is confirmed hot. Find the OUTERMOST enclosing
+                                    // array-indexing loop so an array nest (matmul) marshals its arrays
+                                    // ONCE and runs the whole nest natively, instead of re-marshalling
+                                    // O(array) per inner entry (a wash).
+                                    let (th, te, has_arr, worthy) = crate::jit::osr_expand_cached(
+                                        chunk, header_ip, region_end,
+                                    );
+                                    if th != header_ip {
+                                        // Expanded to an enclosing array loop: THIS inner loop is a
+                                        // marshalling wash. Give up on it and mark the OUTER hot, so the
+                                        // outer fires at its OWN (sound) back-edge on a later iteration —
+                                        // restarting the outer from this inner point would re-run
+                                        // already-completed iterations.
+                                        osr_counters.insert(th, OSR_THRESHOLD);
+                                        osr_hot.1 = u32::MAX;
+                                    } else if has_arr && !worthy {
+                                        // An array loop nested in a NON-array outer loop (k_nucleotide's
+                                        // `seq[i+j]` inner loop): re-entered per outer iteration, so
+                                        // array-OSR would re-marshal the whole array each time — a wash.
+                                        // Leave it to the interpreter, exactly as the flag-off path does
+                                        // (its `GetIndex` bails the numeric OSR there).
+                                        osr_hot.1 = u32::MAX;
+                                    } else {
+                                        // This loop IS the trigger region. An array-WORTHY (outermost)
+                                        // region fires on the FIRST attempt past the threshold, then
+                                        // re-attempts only every OSR_RETRY back-edges (a LiveInMiss
+                                        // cooldown); a pure-numeric region keeps the original modulo
+                                        // sampling cadence.
+                                        let due = if worthy {
+                                            let last = osr_last_attempt
+                                                .get(&header_ip)
+                                                .copied()
+                                                .unwrap_or(0);
+                                            last == 0
+                                                || osr_hot.1.saturating_sub(last) >= OSR_RETRY
+                                        } else {
+                                            osr_hot
+                                                .1
+                                                .saturating_sub(OSR_THRESHOLD)
+                                                .is_multiple_of(OSR_RETRY)
+                                        };
+                                        if due {
+                                            if worthy {
+                                                osr_last_attempt.insert(header_ip, osr_hot.1);
+                                            }
+                                            match Self::run_osr(
+                                                chunk, header_ip, te, &mut slot_locals, 0,
+                                            ) {
+                                                OsrResult::Compiled(exit_ip) => {
+                                                    ip = exit_ip;
+                                                    continue;
+                                                }
+                                                OsrResult::LiveInMiss => {}
+                                                OsrResult::NotCompilable => {
+                                                    osr_hot.1 = u32::MAX
+                                                }
+                                            }
+                                        }
+                                    }
+                                } else if osr_hot
                                     .1
                                     .saturating_sub(OSR_THRESHOLD)
                                     .is_multiple_of(OSR_RETRY)
-                            {
-                                match Self::run_osr(
-                                    chunk,
-                                    header_ip,
-                                    region_end,
-                                    &mut slot_locals,
-                                    0,
-                                ) {
-                                    OsrResult::Compiled(exit_ip) => {
-                                        ip = exit_ip;
-                                        continue;
+                                {
+                                    // Flag OFF: exact pre-#203 threshold+retry-modulo behavior.
+                                    match Self::run_osr(
+                                        chunk,
+                                        header_ip,
+                                        region_end,
+                                        &mut slot_locals,
+                                        0,
+                                    ) {
+                                        OsrResult::Compiled(exit_ip) => {
+                                            ip = exit_ip;
+                                            continue;
+                                        }
+                                        OsrResult::LiveInMiss => {}
+                                        OsrResult::NotCompilable => osr_hot.1 = u32::MAX,
                                     }
-                                    OsrResult::LiveInMiss => {}
-                                    OsrResult::NotCompilable => osr_hot.1 = u32::MAX,
                                 }
                             }
                         }
@@ -3174,6 +3371,7 @@ impl Vm {
                     self.stack.push(Value::Object(VmRef::new(ObjectData {
                         strings: map,
                         symbols: None,
+                        frozen: false,
                     })));
                 }
                 Opcode::EnterTry => {
@@ -3316,12 +3514,13 @@ impl Vm {
                         .unwrap_or(Value::Null);
                     let result = match &arr {
                         Value::NumberArray(a) => {
-                            // All-numeric fast path: operate on raw f64, no boxing/unboxing.
-                            let arr_borrow = a.borrow();
-                            let mapped: Vec<Value> = arr_borrow
-                                .iter()
-                                .map(|&n| {
-                                    let elem = Value::Number(n);
+                            // Fast path over the numeric-origin array (packed or deopted): map each
+                            // element through the const binop.
+                            let mapped: Vec<Value> = a
+                                .borrow()
+                                .to_values()
+                                .into_iter()
+                                .map(|elem| {
                                     let (l, r) = if param_left {
                                         (elem, const_val.clone())
                                     } else {
@@ -3388,21 +3587,31 @@ impl Vm {
                         .unwrap_or(Value::Null);
                     let result = match &arr {
                         Value::NumberArray(a) => {
-                            let arr_borrow = a.borrow();
-                            let filtered: Vec<f64> = arr_borrow
-                                .iter()
-                                .filter(|&&n| {
-                                    let elem = Value::Number(n);
+                            // Numeric-origin filter (packed or deopted): keep elements whose const
+                            // binop is truthy, preserving each element's actual Value.
+                            let kept: Vec<Value> = a
+                                .borrow()
+                                .to_values()
+                                .into_iter()
+                                .filter(|elem| {
                                     let (l, r) = if param_left {
-                                        (elem, const_val.clone())
+                                        (elem.clone(), const_val.clone())
                                     } else {
-                                        (const_val.clone(), elem)
+                                        (const_val.clone(), elem.clone())
                                     };
                                     eval_binop(binop, &l, &r).unwrap_or(Value::Null).is_truthy()
                                 })
-                                .copied()
                                 .collect();
-                            Value::number_array(filtered)
+                            // Stay packed when every kept element is a plain number.
+                            if let Some(nums) = kept
+                                .iter()
+                                .map(|v| v.as_number())
+                                .collect::<Option<Vec<f64>>>()
+                            {
+                                Value::number_array(nums)
+                            } else {
+                                Value::Array(VmRef::new(kept))
+                            }
                         }
                         Value::Array(a) => {
                             let arr_borrow = a.borrow();
@@ -3718,6 +3927,13 @@ fn ic_set_member(
     use std::sync::atomic::Ordering::Relaxed;
     if let Value::Object(od) = obj {
         let mut b = od.borrow_mut();
+        if b.frozen {
+            // #437: writes to a frozen object throw a catchable TypeError (the SetMember handler
+            // routes this Err through `catchable!` → a TypeError).
+            return Err(format!(
+                "Cannot assign to read only property '{key}' of a frozen object"
+            ));
+        }
         let shape = b.strings.shape();
         let cell = chunk.inline_caches.0.get(name_idx as usize);
         if shape != tishlang_core::DICT_SHAPE {
@@ -3769,11 +3985,7 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
             let key_s = key.as_ref();
             // Numeric index fast path.
             if let Ok(idx) = key_s.parse::<usize>() {
-                return Ok(a
-                    .borrow()
-                    .get(idx)
-                    .map(|&n| Value::Number(n))
-                    .unwrap_or(Value::Null));
+                return Ok(a.borrow().get(idx).unwrap_or(Value::Null));
             }
             if key_s == "length" {
                 return Ok(Value::Number(a.borrow().len() as f64));
@@ -3782,135 +3994,177 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
             let a_clone = a.clone();
             let method: ArrayMethodFn = match key_s {
                 "push" => make_native_fn(move |args: &[Value]| {
-                    let mut arr = a_clone.borrow_mut();
+                    let mut b = a_clone.borrow_mut();
                     for v in args {
-                        match v {
-                            Value::Number(n) => arr.push(*n),
-                            _ => {
-                                arr.push(f64::NAN); // hole-marker for non-numeric
-                            }
+                        match (b.as_packed_mut(), v) {
+                            (Some(nums), Value::Number(n)) => nums.push(*n),
+                            // First non-numeric (or already deopted) → upgrade in place, push Value.
+                            _ => b.deopt().push(v.clone()),
                         }
                     }
-                    Value::Number(arr.len() as f64)
+                    Value::Number(b.len() as f64)
                 }),
                 "pop" => make_native_fn(move |_: &[Value]| {
-                    a_clone
-                        .borrow_mut()
-                        .pop()
-                        .map(|n| {
-                            if n.is_nan() {
-                                Value::Null
-                            } else {
-                                Value::Number(n)
-                            }
-                        })
-                        .unwrap_or(Value::Null)
+                    let mut b = a_clone.borrow_mut();
+                    match b.as_packed_mut() {
+                        Some(nums) => nums
+                            .pop()
+                            .map(|n| if n.is_nan() { Value::Null } else { Value::Number(n) })
+                            .unwrap_or(Value::Null),
+                        None => b.deopt().pop().unwrap_or(Value::Null),
+                    }
                 }),
                 "shift" => make_native_fn(move |_: &[Value]| {
-                    let mut arr = a_clone.borrow_mut();
-                    if arr.is_empty() {
-                        Value::Null
-                    } else {
-                        let n = arr.remove(0);
-                        if n.is_nan() {
-                            Value::Null
-                        } else {
-                            Value::Number(n)
+                    let mut b = a_clone.borrow_mut();
+                    if b.is_empty() {
+                        return Value::Null;
+                    }
+                    match b.as_packed_mut() {
+                        Some(nums) => {
+                            let n = nums.remove(0);
+                            if n.is_nan() { Value::Null } else { Value::Number(n) }
                         }
+                        None => b.deopt().remove(0),
                     }
                 }),
                 "unshift" => make_native_fn(move |args: &[Value]| {
-                    let mut arr = a_clone.borrow_mut();
-                    for (i, v) in args.iter().enumerate() {
-                        let n = match v {
-                            Value::Number(n) => *n,
-                            _ => f64::NAN,
-                        };
-                        arr.insert(i, n);
+                    let mut b = a_clone.borrow_mut();
+                    let all_num = args.iter().all(|v| matches!(v, Value::Number(_)));
+                    if all_num && b.as_packed().is_some() {
+                        let nums = b.as_packed_mut().unwrap();
+                        for (i, v) in args.iter().enumerate() {
+                            if let Value::Number(n) = v {
+                                nums.insert(i, *n);
+                            }
+                        }
+                    } else {
+                        let boxed = b.deopt();
+                        for (i, v) in args.iter().enumerate() {
+                            boxed.insert(i, v.clone());
+                        }
                     }
-                    Value::Number(arr.len() as f64)
+                    Value::Number(b.len() as f64)
                 }),
+                // #502: `fill` mutates IN PLACE, but the packed block routed it through the
+                // materialize-to-boxed fallback below — which fills a THROWAWAY copy, so the
+                // original array was untouched (a silent no-op). A numeric fill value writes
+                // straight into the Vec<f64>; a non-numeric value can't live in a packed array
+                // (the documented rep limit, #199) so it deopts: materialize, fill the boxed copy,
+                // and write the numeric elements back (non-numeric slots become NaN holes — the
+                // same lossy edge splice/set-index already have on packed).
+                "fill" => {
+                    let a2 = a_clone.clone();
+                    make_native_fn(move |args: &[Value]| {
+                        let len = a2.borrow().len() as i64;
+                        let norm = |v: Option<&Value>, dflt: i64| -> i64 {
+                            match v {
+                                Some(Value::Number(n)) => {
+                                    let i = *n as i64;
+                                    if i < 0 { (len + i).max(0) } else { i.min(len) }
+                                }
+                                _ => dflt,
+                            }
+                        };
+                        let start = norm(args.get(1), 0);
+                        let end = norm(args.get(2), len);
+                        let fill_v = args.first().cloned().unwrap_or(Value::Null);
+                        let mut b = a2.borrow_mut();
+                        match (b.as_packed_mut(), &fill_v) {
+                            // Numeric fill stays packed — write straight into the Vec<f64>.
+                            (Some(nums), Value::Number(fv)) => {
+                                let mut i = start;
+                                while i < end && (i as usize) < nums.len() {
+                                    nums[i as usize] = *fv;
+                                    i += 1;
+                                }
+                            }
+                            // Non-numeric fill (or already deopted): upgrade in place and fill the
+                            // boxed Vec with the actual Value — no NaN-hole loss (#199 sound).
+                            _ => {
+                                let boxed = b.deopt();
+                                let mut i = start;
+                                while i < end && (i as usize) < boxed.len() {
+                                    boxed[i as usize] = fill_v.clone();
+                                    i += 1;
+                                }
+                            }
+                        }
+                        drop(b);
+                        Value::NumberArray(a2.clone())
+                    })
+                }
                 "reverse" => make_native_fn(move |_: &[Value]| {
-                    a_clone.borrow_mut().reverse();
+                    let mut b = a_clone.borrow_mut();
+                    match b.as_packed_mut() {
+                        Some(nums) => nums.reverse(),
+                        None => b.deopt().reverse(),
+                    }
+                    drop(b);
                     Value::NumberArray(a_clone.clone())
                 }),
                 "splice" => {
                     let a2 = a_clone.clone();
                     make_native_fn(move |args: &[Value]| {
-                        // Check if there are non-numeric items to insert (args[2..]).
-                        let has_non_numeric = args
-                            .get(2..)
-                            .unwrap_or(&[])
-                            .iter()
-                            .any(|v| !matches!(v, Value::Number(_)));
-                        if has_non_numeric {
-                            // Deopt: materialise, splice on the boxed array, then write numeric
-                            // elements back to the original Vec<f64>. This preserves the VmRef
-                            // identity for subsequent accesses. The array may have non-numeric
-                            // elements after this splice — they become NaN holes in the VmRef.
-                            let boxed = Value::materialize_number_array(&a2);
-                            let result = arr_builtins::splice(
-                                &boxed,
-                                args.first().unwrap_or(&Value::Null),
-                                args.get(1),
-                                args.get(2..).unwrap_or(&[]),
-                            );
-                            // Sync the modified boxed Vec back into the original VmRef.
-                            if let Value::Array(boxed_vmref) = &boxed {
-                                let mut packed = a2.borrow_mut();
-                                *packed = boxed_vmref
-                                    .borrow()
-                                    .iter()
-                                    .map(|v| match v {
-                                        Value::Number(n) => *n,
-                                        _ => f64::NAN,
-                                    })
-                                    .collect();
+                        let inserts = args.get(2..).unwrap_or(&[]);
+                        let all_num = inserts.iter().all(|v| matches!(v, Value::Number(_)));
+                        let mut b = a2.borrow_mut();
+                        let len = b.len() as i64;
+                        let start = match args.first() {
+                            Some(Value::Number(n)) => {
+                                let sn = *n as i64;
+                                if sn < 0 { (len + sn).max(0) as usize } else { (sn as usize).min(b.len()) }
                             }
-                            result
-                        } else {
-                            let mut arr = a2.borrow_mut();
-                            let len = arr.len() as i64;
-                            let start = match args.first() {
-                                Some(Value::Number(n)) => {
-                                    let s = *n as i64;
-                                    if s < 0 {
-                                        (len + s).max(0) as usize
-                                    } else {
-                                        (s as usize).min(arr.len())
-                                    }
-                                }
-                                _ => 0,
-                            };
-                            let del = match args.get(1) {
-                                Some(Value::Number(n)) => (*n as i64).max(0) as usize,
-                                _ => arr.len().saturating_sub(start),
-                            };
-                            let del = del.min(arr.len().saturating_sub(start));
-                            let new_nums: Vec<f64> = args
-                                .get(2..)
-                                .unwrap_or(&[])
+                            _ => 0,
+                        };
+                        let del = match args.get(1) {
+                            Some(Value::Number(n)) => (*n as i64).max(0) as usize,
+                            _ => b.len().saturating_sub(start),
+                        };
+                        let del = del.min(b.len().saturating_sub(start));
+                        if all_num && b.as_packed().is_some() {
+                            // Stay packed: splice the Vec<f64>, return the removed f64s.
+                            let nums = b.as_packed_mut().unwrap();
+                            let new_nums: Vec<f64> = inserts
                                 .iter()
-                                .map(|v| match v {
-                                    Value::Number(n) => *n,
-                                    _ => f64::NAN,
-                                })
+                                .map(|v| if let Value::Number(n) = v { *n } else { f64::NAN })
                                 .collect();
-                            let removed: Vec<f64> =
-                                arr.splice(start..start + del, new_nums).collect();
+                            let removed: Vec<f64> = nums.splice(start..start + del, new_nums).collect();
                             Value::number_array(removed)
+                        } else {
+                            // #506: non-numeric inserts (or already deopted) — upgrade in place and
+                            // splice the boxed Vec. The array genuinely holds the inserted values and
+                            // the removed elements are correct (no NaN loss).
+                            let boxed = b.deopt();
+                            let removed: Vec<Value> =
+                                boxed.splice(start..start + del, inserts.iter().cloned()).collect();
+                            Value::Array(VmRef::new(removed))
                         }
                     })
                 }
                 "sort" => make_native_fn(move |args: &[Value]| {
-                    let arr_val = Value::NumberArray(a_clone.clone());
                     let cmp = args.first();
                     if let Some(Value::Function(_)) = cmp {
                         // Comparator sort: materialise first (comparator may return non-numeric).
                         let boxed = Value::materialize_number_array(&a_clone);
                         arr_builtins::sort_with_comparator(&boxed, cmp.unwrap())
                     } else {
-                        arr_builtins::sort_numeric_asc(&arr_val)
+                        // JS default `sort()` is LEXICOGRAPHIC — String(element), NOT numeric — so
+                        // `[10, 9, 100].sort()` is `[10, 100, 9]`. The boxed path already does this
+                        // (arr_builtins::sort_default); match it on the packed vec by comparing each
+                        // number's display string. (Pre-existing packed bug: it sorted numerically.)
+                        let mut b = a_clone.borrow_mut();
+                        match b.as_packed_mut() {
+                            Some(nums) => nums.sort_by(|x, y| {
+                                Value::Number(*x)
+                                    .to_display_string()
+                                    .cmp(&Value::Number(*y).to_display_string())
+                            }),
+                            None => b.deopt().sort_by(|x, y| {
+                                x.to_display_string().cmp(&y.to_display_string())
+                            }),
+                        }
+                        drop(b);
+                        Value::NumberArray(a_clone.clone())
                     }
                 }),
                 _ => {
@@ -4506,6 +4760,11 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
 fn set_member(obj: &Value, key: &Arc<str>, val: Value) -> Result<(), String> {
     match obj {
         Value::Object(m) => {
+            if m.borrow().frozen {
+                return Err(format!(
+                    "Cannot assign to read only property '{key}' of a frozen object"
+                ));
+            }
             m.borrow_mut().strings.insert(Arc::clone(key), val);
             Ok(())
         }
@@ -4531,7 +4790,11 @@ fn set_member(obj: &Value, key: &Arc<str>, val: Value) -> Result<(), String> {
             if key.as_ref() == "length" {
                 let new_len = array_length_arg(&val)?;
                 // NaN is the packed-array hole marker (read back as Null), matching get_index.
-                a.borrow_mut().resize(new_len, f64::NAN);
+                let mut b = a.borrow_mut();
+                match b.as_packed_mut() {
+                    Some(nums) => nums.resize(new_len, f64::NAN),
+                    None => b.deopt().resize(new_len, Value::Null),
+                }
                 return Ok(());
             }
             Err(format!("Cannot set property of {}", obj.type_name()))
@@ -4566,12 +4829,9 @@ fn get_index(obj: &Value, idx: &Value) -> Result<Value, String> {
             // NaN is used as the hole marker (sparse-array positions); reads return Null.
             Ok(a.borrow()
                 .get(i)
-                .map(|&n| {
-                    if n.is_nan() {
-                        Value::Null
-                    } else {
-                        Value::Number(n)
-                    }
+                .map(|v| match v {
+                    Value::Number(n) if n.is_nan() => Value::Null,
+                    other => other,
                 })
                 .unwrap_or(Value::Null))
         }
@@ -4661,6 +4921,23 @@ fn delete_index(obj: &Value, key: &Value) {
                 }
             }
         }
+        // #504: `delete arr[i]` on a packed array — the Vec<f64> can't hold Null, but NaN is the
+        // rep's own hole marker (GetIndex reads a NaN element back as Null, matching a boxed hole),
+        // so a delete writes NaN. Length is unchanged, exactly like the boxed arm's `= Null`.
+        Value::NumberArray(a) => {
+            if let Value::Number(n) = key {
+                let n = *n;
+                if n >= 0.0 && n.fract() == 0.0 {
+                    let i = n as usize;
+                    let mut b = a.borrow_mut();
+                    if i < b.len() {
+                        // Deopt so the hole is a real Null (matches the boxed arm exactly, and keeps
+                        // a genuinely-stored NaN element distinct from a deleted slot).
+                        b.deopt()[i] = Value::Null;
+                    }
+                }
+            }
+        }
         _ => {}
     }
 }
@@ -4688,27 +4965,23 @@ fn set_index(obj: &Value, idx: &Value, val: Value) -> Result<(), String> {
             // a sentinel error — the caller (SetIndex opcode) does NOT handle deopt.
             // Instead we only do in-bounds-or-next-element numeric assignments here;
             // anything that creates holes (i > len) or sets a non-number is unsupported.
-            match val {
-                Value::Number(n) => {
-                    let mut arr = a.borrow_mut();
-                    // Extend with NaN "holes" if needed (NaN = sparse hole; read back as Null).
-                    while arr.len() <= i {
-                        arr.push(f64::NAN);
+            let mut b = a.borrow_mut();
+            match (b.as_packed_mut(), &val) {
+                // Numeric assignment stays packed — NaN-extend to a sparse hole if past the end.
+                (Some(nums), Value::Number(n)) => {
+                    while nums.len() <= i {
+                        nums.push(f64::NAN);
                     }
-                    arr[i] = n;
+                    nums[i] = *n;
                 }
-                // Non-numeric set: the Vec<f64> can't represent this type. Extend with NaN holes
-                // up to the index, then leave the slot as NaN (the value is lost). This is a
-                // known limitation of NumberArray; the uncommon mixed-type path should not produce
-                // a NumberArray in the first place. The caller will see the correct index reads for
-                // numeric elements and Null for the NaN holes.
+                // Non-numeric (or already deopted): upgrade in place and store the real Value —
+                // the array genuinely becomes heterogeneous, no data loss (#199 sound).
                 _ => {
-                    let mut arr = a.borrow_mut();
-                    while arr.len() <= i {
-                        arr.push(f64::NAN);
+                    let boxed = b.deopt();
+                    while boxed.len() <= i {
+                        boxed.push(Value::Null);
                     }
-                    // arr[i] is already NaN (hole); we can't store the non-numeric value — acceptable
-                    // for the experimental TISH_PACKED_ARRAYS path.
+                    boxed[i] = val;
                 }
             }
             Ok(())
@@ -4735,7 +5008,15 @@ fn set_index(obj: &Value, idx: &Value, val: Value) -> Result<(), String> {
             arr[i] = val;
             Ok(())
         }
-        Value::Object(_) => object_set(obj, idx, val),
+        Value::Object(m) => {
+            if m.borrow().frozen {
+                return Err(format!(
+                    "Cannot assign to read only property '{}' of a frozen object",
+                    idx.to_display_string()
+                ));
+            }
+            object_set(obj, idx, val)
+        }
         _ => Err(format!("Cannot set property of {}", obj.type_name())),
     }
 }
@@ -4837,3 +5118,84 @@ mod recursion_limit_tests_381 {
         );
     }
 }
+
+#[cfg(test)]
+mod undeclared_var_in_fn_tests {
+    use tishlang_core::Value;
+
+    fn run_src(src: &str) -> Result<Value, String> {
+        let program = tishlang_parser::parse(src).expect("parse");
+        let chunk = tishlang_bytecode::compile(&program).expect("compile");
+        super::run(&chunk)
+    }
+
+    // A free/undeclared identifier read INSIDE a called function must surface as an error, not be
+    // swallowed to null (regression: closure calls used to `run_chunk(..).unwrap_or(Value::Null)`,
+    // so any error in a callee body vanished — the VM returned null where the interpreter throws).
+    #[test]
+    fn undeclared_read_in_fn_errors_not_null() {
+        let out = run_src("fn f() { return zzznotdeclared }\nf()");
+        assert!(
+            out.is_err(),
+            "undeclared read in a function body must error, got: {out:?}"
+        );
+        assert!(
+            out.as_ref().unwrap_err().contains("zzznotdeclared"),
+            "error must name the missing variable: {out:?}"
+        );
+    }
+
+    // `undefined` is just a specific undeclared identifier — same rejection, since tish has no
+    // `undefined` value.
+    #[test]
+    fn undefined_ident_in_fn_errors_not_null() {
+        let out = run_src("fn f() { return undefined }\nf()");
+        assert!(
+            out.is_err() && out.as_ref().unwrap_err().contains("undefined"),
+            "free `undefined` in a function body must error: {out:?}"
+        );
+    }
+
+    // The propagated error is catchable, matching the interpreter.
+    // Object.freeze marks an object frozen and a subsequent property write throws a catchable
+    // TypeError (#437 — tish's own stricter spec; node's sloppy mode silently ignores it).
+    #[test]
+    fn frozen_write_throws_catchable_typeerror() {
+        // Uncaught: the frozen write propagates as an error.
+        let uncaught = run_src("let o = { a: 1 }\nObject.freeze(o)\no.a = 2");
+        assert!(
+            uncaught.is_err(),
+            "a write to a frozen object must throw, not silently succeed: {uncaught:?}"
+        );
+        // Caught: try/catch recovers it, and the value is unchanged.
+        let caught = run_src(
+            "let o = { a: 1 }\n\
+             Object.freeze(o)\n\
+             try { o.a = 2 } catch (e) { }\n\
+             o.a",
+        );
+        assert!(
+            caught.is_ok(),
+            "the frozen write must be catchable (try/catch recovers): {caught:?}"
+        );
+    }
+
+    // The propagated error is catchable, matching the interpreter (issue #437 bucket-A).
+    #[test]
+    fn undeclared_read_in_fn_is_catchable() {
+        // If the callee error weren't catchable it would propagate as an Err from run_src; a caught
+        // throw lets the program complete normally (Ok). An uncaught baseline (below) confirms the
+        // try/catch is what recovers it, not that the error silently vanished.
+        let caught = run_src(
+            "fn f() { return zzz }\n\
+             try { f() } catch (e) { }\n\
+             1",
+        );
+        assert!(caught.is_ok(), "callee error must be catchable: {caught:?}");
+        let uncaught = run_src("fn f() { return zzz }\nf()");
+        assert!(
+            uncaught.is_err(),
+            "without a catch the same error must propagate, not vanish: {uncaught:?}"
+        );
+    }
+}