@tishlang/tish 2.12.0 → 2.16.13

package/crates/tish_eval/src/eval.rs

@@ -2,6 +2,7 @@
 
 #![allow(clippy::type_complexity, clippy::cloned_ref_to_slice_refs)]
 
+use std::cell::Cell;
 use std::cell::RefCell;
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -21,6 +22,74 @@ use crate::value::{
     eval_object_get, eval_object_has, eval_object_set, EvalObjectData, PropMap, Value,
 };
 
+// #203: cursor cache for O(1)/near-O(1) character indexing in the interpreter. Twin of the one in
+// `tishlang_builtins::string` (used by the native/VM backends); duplicated here because the
+// interpreter has its own `Value`/`Arc<str>` string type rather than `tishlang_core`'s `ArcStr`. tish
+// strings are UTF-8, so `chars().nth(i)` is O(i) — turning indexed/strided scans into O(n^2). For each
+// recently-indexed string we cache whether it is all-ASCII (then a character index equals a byte index
+// → O(1)) plus a forward cursor (so non-ASCII sequential/strided scans advance from the last position).
+// Safety: the entry holds an `Arc<str>` CLONE, keeping the allocation alive so its data pointer can't
+// be reused while cached (no ABA), and since strings are immutable the cached ASCII flag stays valid.
+struct EvalCharCursor {
+    s: Arc<str>,
+    ascii: bool,
+    len_chars: usize,
+    char_idx: usize,
+    byte_off: usize,
+}
+
+thread_local! {
+    static EVAL_INDEX_CURSOR: RefCell<Option<EvalCharCursor>> = const { RefCell::new(None) };
+}
+
+fn with_eval_cursor<R>(s: &Arc<str>, f: impl FnOnce(&mut EvalCharCursor, &Arc<str>) -> R) -> R {
+    EVAL_INDEX_CURSOR.with(|cell| {
+        let mut slot = cell.borrow_mut();
+        let hit = matches!(slot.as_ref(), Some(c)
+            if std::ptr::eq(c.s.as_bytes().as_ptr(), s.as_bytes().as_ptr()) && c.s.len() == s.len());
+        if !hit {
+            let ascii = s.as_bytes().is_ascii();
+            let len_chars = if ascii { s.len() } else { s.chars().count() };
+            *slot = Some(EvalCharCursor {
+                s: Arc::clone(s),
+                ascii,
+                len_chars,
+                char_idx: 0,
+                byte_off: 0,
+            });
+        }
+        f(slot.as_mut().unwrap(), s)
+    })
+}
+
+/// Character (Unicode scalar) at index `idx` via the cursor cache. Identical results to
+/// `s.chars().nth(idx)`, but O(1) for ASCII and near-O(1) for forward/strided scans.
+fn nth_char_cached(s: &Arc<str>, idx: usize) -> Option<char> {
+    with_eval_cursor(s, |c, s| {
+        if c.ascii {
+            return s.as_bytes().get(idx).map(|&b| b as char);
+        }
+        let (base_idx, base_off) = if idx >= c.char_idx {
+            (c.char_idx, c.byte_off)
+        } else {
+            (0, 0)
+        };
+        match s[base_off..].char_indices().nth(idx - base_idx) {
+            Some((rel_off, ch)) => {
+                c.char_idx = idx;
+                c.byte_off = base_off + rel_off;
+                Some(ch)
+            }
+            None => None,
+        }
+    })
+}
+
+/// Character (Unicode scalar) count via the cursor cache — O(1) after the first call on a string.
+fn char_count_cached(s: &Arc<str>) -> usize {
+    with_eval_cursor(s, |c, _| c.len_chars)
+}
+
 pub struct Scope {
     // Scope vars: order is never observed (no Object.keys over a scope), so use a fast
     // unordered aHash map — NOT the object-strings PropMap (an insertion-ordered IndexMap),
@@ -30,6 +99,31 @@ pub struct Scope {
     parent: Option<Rc<std::cell::RefCell<Scope>>>,
 }
 
+// #186 / string_build: amortized O(1) `acc += x`. tish strings are an immutable `Arc<str>`, so the
+// generic `acc = acc + x` allocates a fresh String and copies the whole accumulator each time → O(n^2)
+// over a build loop. Instead we keep the accumulator in a growable `String` ("the pending builder")
+// and `push_str` onto it in O(1), writing it back to the scope slot ("flushing") the moment the
+// variable is observed. JS strings are immutable VALUES, so soundness requires that any read sees the
+// full current string: every read flushes first (see `flush_pending_for` at `Expr::Ident` and the
+// other read sites). The builder is keyed by the EXACT owning scope (captured `Rc`) plus name, so a
+// shadowing inner `acc` never appends onto an outer `acc`'s buffer. Shared across nested evaluators
+// (function calls / closures) via `Rc` so a callee that reads the variable flushes the same buffer.
+struct PendingAppend {
+    /// The exact scope that owns the accumulator variable (not necessarily the current scope).
+    scope: Rc<std::cell::RefCell<Scope>>,
+    name: Arc<str>,
+    /// The true current value of the accumulator while buffered; the scope slot is stale until flush.
+    buf: String,
+}
+
+#[derive(Default)]
+struct StringBuilderState {
+    /// Fast-path guard: a single `Cell<bool>` load lets the hot identifier-read path skip the
+    /// `RefCell` borrow entirely when no builder is active (the case for all non-building programs).
+    active: Cell<bool>,
+    pending: RefCell<Option<PendingAppend>>,
+}
+
 /// A reference-counted lexical scope. A `Value::Function` captures one of these at creation
 /// (the *defining* scope) so calls resolve free variables lexically — real closures.
 pub type ScopeRef = Rc<std::cell::RefCell<Scope>>;
@@ -91,6 +185,30 @@ pub struct Evaluator {
     current_dir: RefCell<Option<PathBuf>>,
     /// Extra `tish:*` builtins from `TishNativeModule::virtual_builtin_modules` (shared across nested evaluators).
     virtual_builtins: Rc<RefCell<HashMap<Arc<str>, Value>>>,
+    /// String-builder state for amortized O(1) `acc += x` (see [`StringBuilderState`]). Shared across
+    /// nested evaluators so a called function/closure that reads the accumulator flushes the buffer.
+    string_builder: Rc<StringBuilderState>,
+    /// Current user-function call depth, SHARED (`Rc`) across every nested call-frame evaluator so it
+    /// tracks total recursion. Past [`Evaluator::max_call_depth`] a call throws a catchable
+    /// `RangeError` instead of growing the stack toward OOM/abort (#381).
+    call_depth: Rc<std::cell::Cell<usize>>,
+    /// Recursion ceiling: past this many nested user-function frames a call throws a catchable
+    /// `RangeError('Maximum call stack size exceeded')`, matching JS, rather than aborting the process.
+    /// Defaults to [`DEFAULT_MAX_CALL_DEPTH`], overridable via `TISH_MAX_CALL_DEPTH`.
+    max_call_depth: usize,
+}
+
+/// Default recursion ceiling: far deeper than any real non-pathological recursion, yet below where
+/// `stacker`'s growth would exhaust memory (the accompanying `stacker::maybe_grow` was verified safe
+/// to depth 20000). Override with `TISH_MAX_CALL_DEPTH`.
+const DEFAULT_MAX_CALL_DEPTH: usize = 20_000;
+
+fn env_max_call_depth() -> usize {
+    std::env::var("TISH_MAX_CALL_DEPTH")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .filter(|&n| n > 0)
+        .unwrap_or(DEFAULT_MAX_CALL_DEPTH)
 }
 
 impl Evaluator {
@@ -193,6 +311,7 @@ impl Evaluator {
                 process_obj.insert("exit".into(), Value::Native(natives::process_exit));
                 process_obj.insert("cwd".into(), Value::Native(natives::process_cwd));
                 process_obj.insert("exec".into(), Value::Native(natives::process_exec));
+                process_obj.insert("execFile".into(), Value::Native(natives::process_exec_file));
                 let argv: Vec<Value> = tishlang_core::process_argv()
                     .into_iter()
                     .map(|s| Value::String(s.into()))
@@ -367,6 +486,9 @@ impl Evaluator {
             module_cache: Rc::new(RefCell::new(HashMap::new())),
             current_dir: RefCell::new(None),
             virtual_builtins: Rc::new(RefCell::new(HashMap::new())),
+            string_builder: Rc::new(StringBuilderState::default()),
+            call_depth: Rc::new(std::cell::Cell::new(0)),
+            max_call_depth: env_max_call_depth(),
         }
     }
 
@@ -401,6 +523,9 @@ impl Evaluator {
         for stmt in &program.statements {
             last = self.eval_statement(stmt).map_err(|e| e.to_string())?;
         }
+        // Flush any still-buffered string accumulator so the variable's slot is correct for any
+        // post-run observation (timers, REPL, embedders reading scope state).
+        self.flush_pending();
         Ok(last)
     }
 
@@ -451,7 +576,11 @@ impl Evaluator {
                 self.bind_destruct_pattern(pattern, &value, *mutable)?;
                 Ok(Value::Null)
             }
-            Statement::ExprStmt { expr, .. } => self.eval_expr(expr),
+            Statement::ExprStmt { expr, .. } => {
+                // Statement position: route through the path that keeps statement-position
+                // `acc += x` O(1) (no result materialization) while preserving values otherwise.
+                self.eval_expr_discard(expr)
+            }
             Statement::If {
                 cond,
                 then_branch,
@@ -815,6 +944,33 @@ impl Evaluator {
                         let v = self.eval_expr(e)?;
                         self.scope.borrow_mut().set(Arc::from("default"), v, false);
                     }
+                    // #305: re-export in the running program — load the dep and bind the names locally.
+                    ExportDeclaration::ReExport {
+                        specifiers,
+                        all,
+                        from,
+                        ..
+                    } => {
+                        let dep_val = self.load_module(from.as_ref())?;
+                        let dep = match &dep_val {
+                            Value::Object(m) => m.borrow().clone(),
+                            _ => return Err(EvalError::Error("Module exports must be object".to_string())),
+                        };
+                        if *all {
+                            for (k, v) in dep.strings.iter() {
+                                self.scope.borrow_mut().set(Arc::from(k.as_ref()), v.clone(), false);
+                            }
+                        }
+                        for spec in specifiers {
+                            if let ImportSpecifier::Named { name, alias, .. } = spec {
+                                let v = dep.strings.get(name.as_ref()).ok_or_else(|| {
+                                    EvalError::Error(format!("Module does not export '{}'", name))
+                                })?;
+                                let bind = alias.as_deref().unwrap_or(name.as_ref());
+                                self.scope.borrow_mut().set(Arc::from(bind), v.clone(), false);
+                            }
+                        }
+                    }
                 }
                 Ok(Value::Null)
             }
@@ -880,6 +1036,36 @@ impl Evaluator {
                         self.scope.borrow_mut().set(Arc::from("default"), v, false);
                         export_names.push("default".to_string());
                     }
+                    // #305: re-export — load the dep, pull the requested (or all) exports into this
+                    // module's scope, and re-expose them in `export_names`.
+                    ExportDeclaration::ReExport {
+                        specifiers,
+                        all,
+                        from,
+                        ..
+                    } => {
+                        let dep_val = self.load_module(from.as_ref())?;
+                        let dep = match &dep_val {
+                            Value::Object(m) => m.borrow().clone(),
+                            _ => return Err(EvalError::Error("Module exports must be object".to_string())),
+                        };
+                        if *all {
+                            for (k, v) in dep.strings.iter() {
+                                self.scope.borrow_mut().set(Arc::from(k.as_ref()), v.clone(), false);
+                                export_names.push(k.to_string());
+                            }
+                        }
+                        for spec in specifiers {
+                            if let ImportSpecifier::Named { name, alias, .. } = spec {
+                                let v = dep.strings.get(name.as_ref()).ok_or_else(|| {
+                                    EvalError::Error(format!("Module does not export '{}'", name))
+                                })?;
+                                let bind = alias.as_deref().unwrap_or(name.as_ref());
+                                self.scope.borrow_mut().set(Arc::from(bind), v.clone(), false);
+                                export_names.push(bind.to_string());
+                            }
+                        }
+                    }
                 }
             } else {
                 let _ = self.eval_statement(stmt);
@@ -1057,6 +1243,7 @@ impl Evaluator {
                     exports.insert("exit".into(), Value::Native(natives::process_exit));
                     exports.insert("cwd".into(), Value::Native(natives::process_cwd));
                     exports.insert("exec".into(), Value::Native(natives::process_exec));
+                    exports.insert("execFile".into(), Value::Native(natives::process_exec_file));
                     let argv: Vec<Value> = tishlang_core::process_argv()
                         .into_iter()
                         .map(|s| Value::String(s.into()))
@@ -1076,6 +1263,7 @@ impl Evaluator {
                     process_obj.insert("exit".into(), Value::Native(natives::process_exit));
                     process_obj.insert("cwd".into(), Value::Native(natives::process_cwd));
                     process_obj.insert("exec".into(), Value::Native(natives::process_exec));
+                    process_obj.insert("execFile".into(), Value::Native(natives::process_exec_file));
                     process_obj.insert("argv".into(), Value::Array(Rc::new(RefCell::new(argv))));
                     process_obj.insert("env".into(), Value::object(env_obj));
                     exports.insert(
@@ -1115,6 +1303,177 @@ impl Evaluator {
             })
     }
 
+    // --- string-builder helpers (#186 / string_build): amortized O(1) `acc += x` ---
+
+    /// Append a value to a builder buffer using the exact JS coercion of `eval_binop`'s `+` (string
+    /// operands push their raw chars; everything else goes through `to_js_string`).
+    fn append_value_to_buf(buf: &mut String, v: &Value) {
+        match v {
+            Value::String(s) => buf.push_str(s),
+            other => buf.push_str(&other.to_js_string()),
+        }
+    }
+
+    /// Walk the scope chain from the current scope and return the exact scope that owns `name`.
+    fn find_var_scope(&self, name: &str) -> Option<Rc<std::cell::RefCell<Scope>>> {
+        let mut cur = Rc::clone(&self.scope);
+        loop {
+            if cur.borrow().vars.contains_key(name) {
+                return Some(cur);
+            }
+            let parent = cur.borrow().parent.clone();
+            match parent {
+                Some(p) => cur = p,
+                None => return None,
+            }
+        }
+    }
+
+    /// Flush the active builder (if any) back into its owning scope slot, restoring the invariant
+    /// that the slot holds the variable's true value. No-op when no builder is active.
+    fn flush_pending(&self) {
+        if !self.string_builder.active.get() {
+            return;
+        }
+        if let Some(p) = self.string_builder.pending.borrow_mut().take() {
+            p.scope
+                .borrow_mut()
+                .vars
+                .insert(Arc::clone(&p.name), Value::String(p.buf.into()));
+        }
+        self.string_builder.active.set(false);
+    }
+
+    /// Flush the builder iff it is buffering `name` (which is about to be read). The `active` guard
+    /// keeps this ~free on the hot identifier-read path when no builder exists.
+    #[inline]
+    fn flush_pending_for(&self, name: &str) {
+        if !self.string_builder.active.get() {
+            return;
+        }
+        let hit = self
+            .string_builder
+            .pending
+            .borrow()
+            .as_ref()
+            .is_some_and(|p| p.name.as_ref() == name);
+        if hit {
+            self.flush_pending();
+        }
+    }
+
+    /// Discard the builder iff it is buffering `name` (which is about to be overwritten by a plain
+    /// assignment) — avoids an unnecessary O(n) flush of a value that is about to be replaced.
+    #[inline]
+    fn discard_pending_for(&self, name: &str) {
+        if !self.string_builder.active.get() {
+            return;
+        }
+        let hit = self
+            .string_builder
+            .pending
+            .borrow()
+            .as_ref()
+            .is_some_and(|p| p.name.as_ref() == name);
+        if hit {
+            *self.string_builder.pending.borrow_mut() = None;
+            self.string_builder.active.set(false);
+        }
+    }
+
+    /// Try to handle `name += rhs` as an amortized-O(1) string append. Returns `true` if it was a
+    /// string append (buffer updated); `false` if `name` is not a (mutable) string accumulator, so
+    /// the caller falls back to the generic `+=`. Any builder for a DIFFERENT slot is flushed first;
+    /// keying by the exact owning scope means a shadowing inner `name` never appends onto an outer
+    /// `name`'s buffer.
+    fn try_string_append(&self, name: &Arc<str>, rhs: &Value) -> bool {
+        let owner = match self.find_var_scope(name) {
+            Some(s) => s,
+            None => return false, // undefined → let the generic path raise the error
+        };
+        // Continue an existing builder for this exact slot.
+        if self.string_builder.active.get() {
+            let same = self
+                .string_builder
+                .pending
+                .borrow()
+                .as_ref()
+                .is_some_and(|p| p.name == *name && Rc::ptr_eq(&p.scope, &owner));
+            if same {
+                if let Some(p) = self.string_builder.pending.borrow_mut().as_mut() {
+                    Self::append_value_to_buf(&mut p.buf, rhs);
+                }
+                return true;
+            }
+            // A different slot is buffered — flush it before starting a new one.
+            self.flush_pending();
+        }
+        // Start a new builder only if the accumulator currently holds a mutable string.
+        let start = {
+            let owner_ref = owner.borrow();
+            if owner_ref.consts.contains(name.as_ref()) {
+                return false; // `const acc += x` must raise the same error as the generic path
+            }
+            match owner_ref.vars.get(name.as_ref()) {
+                Some(Value::String(a)) => Some(a.clone()),
+                _ => None, // non-string accumulator → numeric/other `+=`
+            }
+        };
+        match start {
+            Some(a) => {
+                let mut buf = String::with_capacity(a.len() + 16);
+                buf.push_str(&a);
+                Self::append_value_to_buf(&mut buf, rhs);
+                *self.string_builder.pending.borrow_mut() = Some(PendingAppend {
+                    scope: owner,
+                    name: Arc::clone(name),
+                    buf,
+                });
+                self.string_builder.active.set(true);
+                true
+            }
+            None => false,
+        }
+    }
+
+    /// Evaluate `expr` in statement position. Special-cases `acc += rhs` so the string-builder never
+    /// has to materialize the assignment's result value — the key to keeping the append O(1). In that
+    /// one case the (discarded) statement value is `null`; every other expression returns its real
+    /// value, preserving block/program last-value semantics.
+    fn eval_expr_discard(&self, expr: &Expr) -> Result<Value, EvalError> {
+        if let Expr::CompoundAssign {
+            name,
+            op: tishlang_ast::CompoundOp::Add,
+            value,
+            ..
+        } = expr
+        {
+            // Evaluate rhs FIRST — it may read `name`, which flushes any active builder.
+            let rhs = self.eval_expr(value)?;
+            if self.try_string_append(name, &rhs) {
+                // Statement-position result is discarded; returning null avoids the O(n) flatten.
+                return Ok(Value::Null);
+            }
+            // Not a string accumulator: generic `+=` (numeric/other) — return its real value.
+            self.flush_pending_for(name);
+            let current = self
+                .scope
+                .borrow()
+                .get(name.as_ref())
+                .ok_or_else(|| EvalError::Error(format!("Undefined variable: {}", name)))?;
+            let result = self
+                .eval_binop(&current, BinOp::Add, &rhs)
+                .map_err(EvalError::Error)?;
+            match self.scope.borrow_mut().assign(name.as_ref(), result.clone()) {
+                Ok(true) => Ok(result),
+                Ok(false) => Err(EvalError::Error(format!("Undefined variable: {}", name))),
+                Err(e) => Err(EvalError::Error(e)),
+            }
+        } else {
+            self.eval_expr(expr)
+        }
+    }
+
     fn eval_expr(&self, expr: &Expr) -> Result<Value, EvalError> {
         match expr {
             Expr::Literal { value, .. } => Ok(match value {
@@ -1123,11 +1482,14 @@ impl Evaluator {
                 Literal::Bool(b) => Value::Bool(*b),
                 Literal::Null => Value::Null,
             }),
-            Expr::Ident { name, .. } => self
-                .scope
-                .borrow()
-                .get(name.as_ref())
-                .ok_or_else(|| EvalError::Error(format!("Undefined variable: {}", name))),
+            Expr::Ident { name, .. } => {
+                // Flush any string-builder buffering this variable so the read sees the full string.
+                self.flush_pending_for(name.as_ref());
+                self.scope
+                    .borrow()
+                    .get(name.as_ref())
+                    .ok_or_else(|| EvalError::Error(format!("Undefined variable: {}", name)))
+            }
             Expr::Binary {
                 left,
                 op,
@@ -1313,27 +1675,45 @@ impl Evaluator {
                                         let len = arr_mut.len();
                                         let mut indices: Vec<usize> = (0..len).collect();
                                         let arr_values: Vec<Value> = std::mem::take(&mut *arr_mut);
+                                        // A `throw` from the comparator must propagate (be catchable) and
+                                        // must NOT corrupt the array. Previously the `_ => Equal` arm
+                                        // swallowed the `Err` and wrote a bogus reordering back; now we
+                                        // capture the throw, stop comparing, and restore the original order
+                                        // — matching the vm/native backends and node.
+                                        let mut pending: Option<EvalError> = None;
 
                                         if let Some((scope, params, body)) = self.create_callback_scope(&cmp_fn) {
                                             indices.sort_by(|&i, &j| {
-                                                let result = self.call_with_scope(&scope, &params, &body, &[arr_values[i].clone(), arr_values[j].clone()]);
-                                                match result {
+                                                if pending.is_some() {
+                                                    return std::cmp::Ordering::Equal;
+                                                }
+                                                match self.call_with_scope(&scope, &params, &body, &[arr_values[i].clone(), arr_values[j].clone()]) {
                                                     Ok(Value::Number(n)) if n < 0.0 => std::cmp::Ordering::Less,
                                                     Ok(Value::Number(n)) if n > 0.0 => std::cmp::Ordering::Greater,
-                                                    _ => std::cmp::Ordering::Equal,
+                                                    Ok(_) => std::cmp::Ordering::Equal,
+                                                    Err(e) => { pending = Some(e); std::cmp::Ordering::Equal }
                                                 }
                                             });
                                         } else {
                                             indices.sort_by(|&i, &j| {
-                                                let result = self.call_func(&cmp_fn, &[arr_values[i].clone(), arr_values[j].clone()]);
-                                                match result {
+                                                if pending.is_some() {
+                                                    return std::cmp::Ordering::Equal;
+                                                }
+                                                match self.call_func(&cmp_fn, &[arr_values[i].clone(), arr_values[j].clone()]) {
                                                     Ok(Value::Number(n)) if n < 0.0 => std::cmp::Ordering::Less,
                                                     Ok(Value::Number(n)) if n > 0.0 => std::cmp::Ordering::Greater,
-                                                    _ => std::cmp::Ordering::Equal,
+                                                    Ok(_) => std::cmp::Ordering::Equal,
+                                                    Err(e) => { pending = Some(e); std::cmp::Ordering::Equal }
                                                 }
                                             });
                                         }
 
+                                        if let Some(e) = pending {
+                                            // Comparator threw: leave the array untouched and re-raise.
+                                            *arr_mut = arr_values;
+                                            drop(arr_mut);
+                                            return Err(e);
+                                        }
                                         *arr_mut = indices.into_iter().map(|i| arr_values[i].clone()).collect();
                                     }
                                 } else {
@@ -1416,7 +1796,11 @@ impl Evaluator {
                             }
                             "map" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                // #382-style snapshot: own the elements and DROP the array borrow before
+                                // any callback runs, so a callback that mutates the array (via the `array`
+                                // arg or a capture) can't RefCell-panic. `arr_value` is the JS 3rd arg.
+                                let arr_borrow = arr.borrow().clone();
+                                let arr_value = Value::Array(arr.clone());
                                 let mut result = Vec::with_capacity(arr_borrow.len());
                                 // Try fastest path: simple single-expression callbacks
                                 let first_result = self.eval_simple_callback(&callback, &[arr_borrow.first().cloned().unwrap_or(Value::Null)]);
@@ -1433,21 +1817,49 @@ impl Evaluator {
                                 } else if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     // Reusable scope path
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let mapped = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let mapped = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         result.push(mapped);
                                     }
                                 } else {
                                     // Full call_func path
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let mapped = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let mapped = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         result.push(mapped);
                                     }
                                 }
                                 return Ok(Value::Array(Rc::new(RefCell::new(result))));
                             }
+                            "flatMap" => {
+                                // map + flatten one level (Array.prototype.flatMap). A callback `throw`
+                                // propagates via `?` (catchable), matching vm/native/node — previously
+                                // interp lacked flatMap entirely ("Not a function").
+                                let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
+                                let mut result: Vec<Value> = Vec::with_capacity(arr_borrow.len());
+                                if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
+                                    for (i, v) in arr_borrow.iter().enumerate() {
+                                        let mapped = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
+                                        match mapped {
+                                            Value::Array(inner) => result.extend(inner.borrow().iter().cloned()),
+                                            other => result.push(other),
+                                        }
+                                    }
+                                } else {
+                                    for (i, v) in arr_borrow.iter().enumerate() {
+                                        let mapped = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
+                                        match mapped {
+                                            Value::Array(inner) => result.extend(inner.borrow().iter().cloned()),
+                                            other => result.push(other),
+                                        }
+                                    }
+                                }
+                                return Ok(Value::Array(Rc::new(RefCell::new(result))));
+                            }
                             "filter" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 let mut result = Vec::new();
                                 // Try simple callback fast path
                                 let use_simple = arr_borrow.first().map(|v| {
@@ -1463,14 +1875,14 @@ impl Evaluator {
                                     }
                                 } else if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let keep = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let keep = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if keep.is_truthy() {
                                             result.push(v.clone());
                                         }
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let keep = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let keep = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if keep.is_truthy() {
                                             result.push(v.clone());
                                         }
@@ -1480,7 +1892,8 @@ impl Evaluator {
                             }
                             "reduce" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 4th callback arg
                                 let (mut acc, start_idx) = if arg_vals.len() > 1 {
                                     (arg_vals[1].clone(), 0)
                                 } else if !arr_borrow.is_empty() {
@@ -1490,18 +1903,19 @@ impl Evaluator {
                                 };
                                 if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate().skip(start_idx) {
-                                        acc = self.call_with_scope(&scope, &params, &body, &[acc, v.clone(), Value::Number(i as f64)])?;
+                                        acc = self.call_with_scope(&scope, &params, &body, &[acc, v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate().skip(start_idx) {
-                                        acc = self.call_func(&callback, &[acc, v.clone(), Value::Number(i as f64)])?;
+                                        acc = self.call_func(&callback, &[acc, v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                     }
                                 }
                                 return Ok(acc);
                             }
                             "find" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 // Try simple callback fast path
                                 let use_simple = arr_borrow.first().map(|v| {
                                     self.eval_simple_callback(&callback, &[v.clone()]).is_some()
@@ -1516,14 +1930,14 @@ impl Evaluator {
                                     }
                                 } else if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let found = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let found = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if found.is_truthy() {
                                             return Ok(v.clone());
                                         }
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let found = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let found = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if found.is_truthy() {
                                             return Ok(v.clone());
                                         }
@@ -1533,17 +1947,18 @@ impl Evaluator {
                             }
                             "findIndex" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let found = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let found = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if found.is_truthy() {
                                             return Ok(Value::Number(i as f64));
                                         }
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let found = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let found = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if found.is_truthy() {
                                             return Ok(Value::Number(i as f64));
                                         }
@@ -1552,13 +1967,14 @@ impl Evaluator {
                                 return Ok(Value::Number(-1.0));
                             }
                             "findLast" => {
-                                // Like find, from the end (#247). Callback gets (value, original index).
+                                // Like find, from the end (#247). Callback gets (value, original index, array).
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 let scoped = self.create_callback_scope(&callback);
                                 for i in (0..arr_borrow.len()).rev() {
                                     let v = arr_borrow[i].clone();
-                                    let args = [v.clone(), Value::Number(i as f64)];
+                                    let args = [v.clone(), Value::Number(i as f64), arr_value.clone()];
                                     let found = match &scoped {
                                         Some((scope, params, body)) => self.call_with_scope(scope, params, body, &args)?,
                                         None => self.call_func(&callback, &args)?,
@@ -1571,10 +1987,11 @@ impl Evaluator {
                             }
                             "findLastIndex" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 let scoped = self.create_callback_scope(&callback);
                                 for i in (0..arr_borrow.len()).rev() {
-                                    let args = [arr_borrow[i].clone(), Value::Number(i as f64)];
+                                    let args = [arr_borrow[i].clone(), Value::Number(i as f64), arr_value.clone()];
                                     let found = match &scoped {
                                         Some((scope, params, body)) => self.call_with_scope(scope, params, body, &args)?,
                                         None => self.call_func(&callback, &args)?,
@@ -1601,21 +2018,23 @@ impl Evaluator {
                             }
                             "forEach" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                     }
                                 }
                                 return Ok(Value::Null);
                             }
                             "some" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 // Try simple callback fast path
                                 let use_simple = arr_borrow.first().map(|v| {
                                     self.eval_simple_callback(&callback, &[v.clone()]).is_some()
@@ -1630,14 +2049,14 @@ impl Evaluator {
                                     }
                                 } else if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let result = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let result = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if result.is_truthy() {
                                             return Ok(Value::Bool(true));
                                         }
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let result = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let result = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if result.is_truthy() {
                                             return Ok(Value::Bool(true));
                                         }
@@ -1647,7 +2066,8 @@ impl Evaluator {
                             }
                             "every" => {
                                 let callback = arg_vals.first().cloned().unwrap_or(Value::Null);
-                                let arr_borrow = arr.borrow();
+                                let arr_borrow = arr.borrow().clone(); // snapshot; drop borrow before callbacks
+                                let arr_value = Value::Array(arr.clone()); // JS 3rd callback arg
                                 // Try simple callback fast path
                                 let use_simple = arr_borrow.first().map(|v| {
                                     self.eval_simple_callback(&callback, &[v.clone()]).is_some()
@@ -1662,14 +2082,14 @@ impl Evaluator {
                                     }
                                 } else if let Some((scope, params, body)) = self.create_callback_scope(&callback) {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let result = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64)])?;
+                                        let result = self.call_with_scope(&scope, &params, &body, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if !result.is_truthy() {
                                             return Ok(Value::Bool(false));
                                         }
                                     }
                                 } else {
                                     for (i, v) in arr_borrow.iter().enumerate() {
-                                        let result = self.call_func(&callback, &[v.clone(), Value::Number(i as f64)])?;
+                                        let result = self.call_func(&callback, &[v.clone(), Value::Number(i as f64), arr_value.clone()])?;
                                         if !result.is_truthy() {
                                             return Ok(Value::Bool(false));
                                         }
@@ -1882,12 +2302,12 @@ impl Evaluator {
                                 return Ok(Value::String(s.replace(&search, &replacement).into()));
                             }
                             "charAt" => {
+                                // Cursor cache instead of collecting a fresh Vec<char> each call (#203).
                                 let idx = match arg_vals.first() {
                                     Some(Value::Number(n)) => *n as usize,
                                     _ => 0,
                                 };
-                                let chars: Vec<char> = s.chars().collect();
-                                return Ok(chars.get(idx)
+                                return Ok(nth_char_cached(s, idx)
                                     .map(|c| Value::String(c.to_string().into()))
                                     .unwrap_or(Value::String("".into())));
                             }
@@ -1897,11 +2317,11 @@ impl Evaluator {
                                     Some(Value::Number(n)) => *n as i64,
                                     _ => 0,
                                 };
-                                let chars: Vec<char> = s.chars().collect();
-                                let len = chars.len() as i64;
-                                let idx = if i < 0 { len + i } else { i };
-                                if idx >= 0 && idx < len {
-                                    return Ok(Value::String(chars[idx as usize].to_string().into()));
+                                let idx = if i < 0 { s.chars().count() as i64 + i } else { i };
+                                if idx >= 0 {
+                                    if let Some(c) = nth_char_cached(s, idx as usize) {
+                                        return Ok(Value::String(c.to_string().into()));
+                                    }
                                 }
                                 return Ok(Value::Null);
                             }
@@ -1910,9 +2330,8 @@ impl Evaluator {
                                     Some(Value::Number(n)) => *n as usize,
                                     _ => 0,
                                 };
-                                let chars: Vec<char> = s.chars().collect();
-                                return Ok(chars.get(idx)
-                                    .map(|c| Value::Number(*c as u32 as f64))
+                                return Ok(nth_char_cached(s, idx)
+                                    .map(|c| Value::Number(c as u32 as f64))
                                     .unwrap_or(Value::Number(f64::NAN)));
                             }
                             "repeat" => {
@@ -2158,6 +2577,9 @@ impl Evaluator {
             }
             Expr::Assign { name, value, .. } => {
                 let v = self.eval_expr(value)?;
+                // A plain assignment overwrites the variable, so drop any builder buffering it (the
+                // buffered value is about to be replaced). `value` may itself have read+flushed it.
+                self.discard_pending_for(name.as_ref());
                 match self.scope.borrow_mut().assign(name.as_ref(), v.clone()) {
                     Ok(true) => Ok(v),
                     Ok(false) => Err(EvalError::Error(format!("Undefined variable: {}", name))),
@@ -2306,6 +2728,10 @@ impl Evaluator {
                 }
             }
             Expr::CompoundAssign { name, op, value, .. } => {
+                // Expression-position `+=` (result is used): flush any builder so `current` is the
+                // full string, then take the generic path. The O(1) builder fast path is reserved
+                // for statement position (see `eval_expr_discard`).
+                self.flush_pending_for(name.as_ref());
                 let current = self.scope.borrow().get(name.as_ref())
                     .ok_or_else(|| EvalError::Error(format!("Undefined variable: {}", name)))?;
                 let rhs = self.eval_expr(value)?;
@@ -2324,6 +2750,7 @@ impl Evaluator {
                 }
             }
             Expr::LogicalAssign { name, op, value, .. } => {
+                self.flush_pending_for(name.as_ref());
                 let current = self.scope.borrow().get(name.as_ref())
                     .ok_or_else(|| EvalError::Error(format!("Undefined variable: {}", name)))?;
                 let result = match op {
@@ -2750,6 +3177,9 @@ impl Evaluator {
             module_cache: Rc::clone(&self.module_cache),
             current_dir: RefCell::new(self.current_dir.borrow().clone()),
             virtual_builtins: Rc::clone(&self.virtual_builtins),
+            string_builder: Rc::clone(&self.string_builder),
+            call_depth: Rc::clone(&self.call_depth),
+            max_call_depth: self.max_call_depth,
         };
         match eval.eval_statement(body) {
             Ok(v) => Ok(v),
@@ -3018,6 +3448,9 @@ impl Evaluator {
                     module_cache: Rc::clone(&self.module_cache),
                     current_dir: RefCell::new(self.current_dir.borrow().clone()),
                     virtual_builtins: Rc::clone(&self.virtual_builtins),
+            string_builder: Rc::clone(&self.string_builder),
+                    call_depth: Rc::clone(&self.call_depth),
+                    max_call_depth: self.max_call_depth,
                 };
                 {
                     let mut s = scope.borrow_mut();
@@ -3074,6 +3507,20 @@ impl Evaluator {
                 // VM's single `run_chunk` re-entry. 128 KiB is smaller than one level's chain, so the
                 // stack overflows BETWEEN checks; 1 MiB comfortably covers a level (verified to depth
                 // 20000 in both debug and release). 16 MiB segments keep grow frequency low.
+                // #381: bound recursion with a catchable `RangeError` instead of letting `stacker`
+                // grow the stack toward OOM/abort. The counter is shared (`Rc`) across every call
+                // frame, so it measures true nesting depth; it is decremented on the way out (both
+                // the Ok and Err paths) via the explicit `set` below so a caught throw doesn't leak
+                // depth.
+                let depth = eval.call_depth.get() + 1;
+                if depth > eval.max_call_depth {
+                    let err = crate::natives::range_error_construct(&[Value::String(
+                        "Maximum call stack size exceeded".into(),
+                    )])
+                    .unwrap_or(Value::Null);
+                    return Err(EvalError::Throw(err));
+                }
+                eval.call_depth.set(depth);
                 let body_result = {
                     #[cfg(not(target_arch = "wasm32"))]
                     {
@@ -3086,6 +3533,7 @@ impl Evaluator {
                         eval.eval_statement(body)
                     }
                 };
+                eval.call_depth.set(depth - 1);
                 match body_result {
                     Ok(v) => Ok(v),
                     Err(EvalError::Return(v)) => Ok(v),
@@ -3566,7 +4014,7 @@ impl Evaluator {
             }
             Value::String(s) => {
                 if key == "length" {
-                    Ok(Value::Number(s.chars().count() as f64))
+                    Ok(Value::Number(char_count_cached(s) as f64))
                 } else {
                     Ok(Value::Null)
                 }
@@ -3623,6 +4071,11 @@ impl Evaluator {
                     _ => Ok(Value::Null),
                 }
             }
+            // Reading a property of the nullish value throws a catchable `TypeError`, matching the
+            // bytecode VM (`get_member`'s `_` arm), cranelift/wasi, and node — not a silent `null`.
+            // The tree-walker used to fall through to `_ => Ok(Value::Null)`, so `null.length` read
+            // back as `null` on interp while every other backend threw (a pure interp≠vm bug).
+            Value::Null => Err(format!("Cannot read property '{}' of null", key)),
             _ => Ok(Value::Null),
         }
     }
@@ -3644,9 +4097,7 @@ impl Evaluator {
                     Value::Number(n) if *n >= 0.0 && n.fract() == 0.0 => *n as usize,
                     _ => return Ok(Value::Null),
                 };
-                Ok(s
-                    .chars()
-                    .nth(idx)
+                Ok(nth_char_cached(s, idx)
                     .map(|c| Value::String(c.to_string().into()))
                     .unwrap_or(Value::Null))
             }
@@ -3659,6 +4110,9 @@ impl Evaluator {
                 };
                 self.get_prop(obj, key)
             }
+            // Indexing the nullish value throws a catchable `TypeError` (like `get_prop` above and
+            // the VM/cranelift/wasi/node) rather than silently reading back `null`.
+            Value::Null => Err(format!("Cannot read property '{}' of null", index)),
             _ => Ok(Value::Null),
         }
     }
@@ -3677,8 +4131,13 @@ impl Evaluator {
         }
     }
 
-    fn json_stringify_value(v: &Value) -> String {
-        match v {
+    /// #381 — ancestor-guarded like `tishlang_core::json_stringify_into_guarded`: a back-edge to an
+    /// ancestor (`a.self = a`) is a cycle and returns `Err(())` instead of recursing forever (this
+    /// was an unguarded native-stack overflow → uncatchable abort; core's guard from #389 never
+    /// covered the interpreter's own stringifier). Ancestor-path only, not all-visited: a node
+    /// repeated across sibling branches is a legal DAG and must serialize twice.
+    fn json_stringify_value(v: &Value, ancestors: &mut Vec<*const ()>) -> Result<String, ()> {
+        Ok(match v {
             Value::Null => "null".to_string(),
             Value::Bool(b) => b.to_string(),
             Value::Number(n) => {
@@ -3698,28 +4157,39 @@ impl Evaluator {
                     .replace('\t', "\\t")
             ),
             Value::Array(arr) => {
-                let inner: Vec<String> = arr
-                    .borrow()
-                    .iter()
-                    .map(Self::json_stringify_value)
-                    .collect();
+                let ptr = Rc::as_ptr(arr) as *const ();
+                if ancestors.contains(&ptr) {
+                    return Err(());
+                }
+                ancestors.push(ptr);
+                let borrowed = arr.borrow();
+                let mut inner: Vec<String> = Vec::with_capacity(borrowed.len());
+                for item in borrowed.iter() {
+                    inner.push(Self::json_stringify_value(item, ancestors)?);
+                }
+                drop(borrowed);
+                ancestors.pop();
                 format!("[{}]", inner.join(","))
             }
             Value::Object(map) => {
+                let ptr = Rc::as_ptr(map) as *const ();
+                if ancestors.contains(&ptr) {
+                    return Err(());
+                }
+                ancestors.push(ptr);
                 // Insertion order (PropMap is an IndexMap) — matches JS/Node and the
                 // VM/rust backends. No key sort.
-                let entries: Vec<String> = map
-                    .borrow()
-                    .strings
-                    .iter()
-                    .map(|(k, v)| {
-                        format!(
-                            "\"{}\":{}",
-                            k.replace('\\', "\\\\").replace('"', "\\\""),
-                            Self::json_stringify_value(v)
-                        )
-                    })
-                    .collect();
+                let borrowed = map.borrow();
+                let mut entries: Vec<String> = Vec::with_capacity(borrowed.strings.len());
+                for (k, v) in borrowed.strings.iter() {
+                    entries.push(format!(
+                        "\"{}\":{}",
+                        k.replace('\\', "\\\\").replace('"', "\\\""),
+                        Self::json_stringify_value(v, ancestors)?
+                    ));
+                }
+                drop(borrowed);
+                ancestors.pop();
                 format!("{{{}}}", entries.join(","))
             }
             Value::Symbol(_) => "null".to_string(),
@@ -3738,7 +4208,7 @@ impl Evaluator {
             #[cfg(feature = "regex")]
             Value::RegExp(_) => "null".to_string(),
             Value::Opaque(_) | Value::OpaqueMethod(_, _) => "null".to_string(),
-        }
+        })
     }
 
     // Static native wrapper functions (these need to be fn pointers, not closures with &self)
@@ -3749,7 +4219,13 @@ impl Evaluator {
 
     fn json_stringify_native(args: &[Value]) -> Result<Value, String> {
         let v = args.first().cloned().unwrap_or(Value::Null);
-        Ok(Value::String(Self::json_stringify_value(&v).into()))
+        let mut ancestors: Vec<*const ()> = Vec::new();
+        match Self::json_stringify_value(&v, &mut ancestors) {
+            Ok(s) => Ok(Value::String(s.into())),
+            // Surfaced by `call_func` as `EvalError::Error`, which the Try handler boxes as
+            // `{ name: "TypeError", message }` — node-identical for the circular case (#381).
+            Err(()) => Err("Converting circular structure to JSON".to_string()),
+        }
     }
 
     fn object_keys(args: &[Value]) -> Result<Value, String> {
@@ -4214,3 +4690,126 @@ impl std::fmt::Display for EvalError {
 }
 
 impl std::error::Error for EvalError {}
+
+#[cfg(test)]
+mod recursion_limit_tests_381 {
+    use super::Evaluator;
+    use tishlang_parser::parse;
+
+    fn run_with_depth(src: &str, max_depth: usize) -> String {
+        let program = parse(src).unwrap();
+        let mut eval = Evaluator::new();
+        eval.max_call_depth = max_depth;
+        eval.eval_program(&program).unwrap().to_string()
+    }
+
+    #[test]
+    fn deep_recursion_throws_catchable_range_error() {
+        // Infinite (non-tail) recursion past the limit must throw a CATCHABLE RangeError, not abort:
+        // try/catch recovers and the program keeps running.
+        let src = "fn rec(n) { return 1 + rec(n + 1) }\n\
+                   let name = 'none'\n\
+                   try { rec(0) } catch (e) { name = e.name }\n\
+                   name";
+        assert_eq!(run_with_depth(src, 200), "RangeError");
+    }
+
+    #[test]
+    fn normal_recursion_is_unaffected() {
+        let src = "fn fib(n) { if (n < 2) { return n } return fib(n - 1) + fib(n - 2) }\nfib(12)";
+        assert_eq!(run_with_depth(src, 20000), "144");
+    }
+}
+
+#[cfg(test)]
+mod null_member_access_tests {
+    // Reading a property or index of the nullish value throws a catchable `TypeError`, matching the
+    // bytecode VM / cranelift / wasi / node. The tree-walker used to fall through to `Ok(Null)`, so
+    // `null.length` read back as `null` on interp while every other backend threw (a pure interp≠vm
+    // divergence). These lock the interpreter to the throwing behavior.
+    use super::Evaluator;
+    use tishlang_parser::parse;
+
+    fn run(src: &str) -> String {
+        let program = parse(src).unwrap();
+        let mut eval = Evaluator::new();
+        eval.eval_program(&program).unwrap().to_string()
+    }
+
+    #[test]
+    fn null_property_read_throws_type_error() {
+        let src = "let name = 'none'\n\
+                   try { let z = null; z.length } catch (e) { name = e.name }\n\
+                   name";
+        assert_eq!(run(src), "TypeError");
+    }
+
+    #[test]
+    fn null_index_read_throws_type_error() {
+        let src = "let name = 'none'\n\
+                   try { let z = null; z[0] } catch (e) { name = e.name }\n\
+                   name";
+        assert_eq!(run(src), "TypeError");
+    }
+
+    #[test]
+    fn object_missing_property_still_reads_null() {
+        // Guard against over-reach: a MISSING property of a real object is `null`, not a throw.
+        let src = "let o = { a: 1 }\nString(o.b === null)";
+        assert_eq!(run(src), "true");
+    }
+
+    #[test]
+    fn array_oob_index_still_reads_null() {
+        // Out-of-bounds array index stays nullish (only a null/undefined *receiver* throws).
+        let src = "let a = [1, 2, 3]\nString(a[9] === null)";
+        assert_eq!(run(src), "true");
+    }
+}
+
+#[cfg(test)]
+mod array_hof_callback_arg_tests {
+    // Array HOFs pass the source array as the trailing callback arg (JS `(element, index, array)`,
+    // reduce `(acc, element, index, array)`). The inline interp loops snapshot the backing store and
+    // drop the borrow before any callback, so a callback that MUTATES the array via the `array` arg
+    // (or a capture) can't RefCell-panic — it iterates the pre-call snapshot, matching JS + the shared
+    // #382 builtins path.
+    use super::Evaluator;
+    use tishlang_parser::parse;
+
+    fn run(src: &str) -> String {
+        let program = parse(src).unwrap();
+        let mut eval = Evaluator::new();
+        eval.eval_program(&program).unwrap().to_string()
+    }
+
+    #[test]
+    fn map_receives_array_as_third_arg() {
+        assert_eq!(run("[5, 3, 8].map((x, i, arr) => arr.length).join(',')"), "3,3,3");
+    }
+
+    #[test]
+    fn reduce_receives_array_as_fourth_arg() {
+        assert_eq!(run("[1, 2, 3].reduce((a, x, i, arr) => a + arr.length, 0)"), "9");
+    }
+
+    #[test]
+    fn callback_may_index_the_array_arg() {
+        assert_eq!(run("[10, 20, 30].map((x, i, arr) => arr[i] * 2).join(',')"), "20,40,60");
+    }
+
+    #[test]
+    fn callback_mutating_the_array_arg_does_not_panic() {
+        // Pre-snapshot this RefCell-panicked (map held the borrow across the loop). Now iteration is
+        // over the snapshot (3 elements); the 3 pushes land on the live array → final length 6, matching
+        // JS forEach semantics (does not visit elements appended during iteration).
+        let src = "let a = [1, 2, 3]\na.forEach((x, i, arr) => { arr.push(x) })\na.length";
+        assert_eq!(run(src), "6");
+    }
+
+    #[test]
+    fn one_and_two_arg_callbacks_unchanged() {
+        assert_eq!(run("[5, 3, 8].map(x => x * 2).join(',')"), "10,6,16");
+        assert_eq!(run("[5, 3, 8].map((x, i) => x + i).join(',')"), "5,4,10");
+    }
+}