@tishlang/tish 2.2.7 → 2.8.0

package/crates/tish_runtime/src/lib.rs

@@ -16,7 +16,9 @@ pub use tishlang_core::ArcStr;
 /// Used by native codegen for `f()` / `obj()` dispatch (`Value::Function` or `__call` on objects).
 pub use tishlang_core::value_call;
 /// JS ToInt32/ToUint32 for the emitted bitwise/shift code (modulo 2³², NaN/±Infinity → 0).
-pub use tishlang_core::{to_int32, to_uint32};
+pub use tishlang_core::{
+    to_int32, to_int32_value, to_number_value, to_uint32, to_uint32_value,
+};
 // Re-export the shared-mutable wrapper so the Rust code emitted by
 // `tishlang_compile::codegen` can write `VmRef::new(...)` without needing
 // a direct dependency on `tishlang_core` from the generated crate.
@@ -57,8 +59,9 @@ pub use tishlang_builtins::collections::{
 
 // Re-export array methods from tishlang_builtins
 pub use tishlang_builtins::array::{
-    concat as array_concat_impl, every as array_every, filter as array_filter, find as array_find,
-    find_index as array_find_index, flat as array_flat_impl, flat_map as array_flat_map,
+    at as array_at, concat as array_concat_impl, every as array_every, filter as array_filter,
+    find as array_find, find_index as array_find_index, find_last as array_find_last,
+    find_last_index as array_find_last_index, flat as array_flat_impl, flat_map as array_flat_map,
     for_each as array_for_each, includes as array_includes_impl, index_of as array_index_of_impl,
     join as array_join_impl, map as array_map, pop as array_pop, push as array_push_impl,
     fill as array_fill, reduce as array_reduce, reverse as array_reverse, shift as array_shift,
@@ -71,13 +74,13 @@ pub use tishlang_builtins::array::{
 
 // Re-export string methods from tishlang_builtins
 pub use tishlang_builtins::string::{
-    char_at as string_char_at_impl, char_code_at as string_char_code_at_impl,
+    at as string_at_impl, char_at as string_char_at_impl, char_code_at as string_char_code_at_impl,
     ends_with as string_ends_with_impl, escape_html as string_escape_html_impl,
     includes as string_includes_impl, index_of as string_index_of_impl,
     last_index_of as string_last_index_of_impl, pad_end as string_pad_end_impl,
     pad_start as string_pad_start_impl, repeat as string_repeat_impl,
     replace as string_replace_impl, replace_all as string_replace_all_impl,
-    slice as string_slice_impl, split as string_split_impl,
+    slice as string_slice_impl, split as string_split_impl, split_limit as string_split_limit_impl,
     starts_with as string_starts_with_impl, substr as string_substr_impl,
     substring as string_substring_impl,
     to_lower_case as string_to_lower_case, to_upper_case as string_to_upper_case,
@@ -141,13 +144,23 @@ pub fn string_substr(s: &Value, start: &Value, length: &Value) -> Value {
     string_substr_impl(s, start, length)
 }
 pub fn string_split(s: &Value, sep: &Value) -> Value {
-    // A RegExp separator routes to the regex splitter (matches string_replace's regex handling
-    // and the interpreter/VM), so `"a1b2c".split(RegExp("\\d",""))` works on the rust backend.
+    string_split_limit(s, sep, &Value::Null)
+}
+
+/// `split(sep, limit)` honoring the optional `limit` argument (passed as a `Value` so the VM and
+/// native codegen can forward the raw call argument). A non-numeric / null `limit` means "no limit".
+/// Routes a RegExp separator to the regex splitter (matching string_replace's regex handling and
+/// the interpreter), so `"a1b2c".split(RegExp("\\d",""))` works on the rust backend.
+pub fn string_split_limit(s: &Value, sep: &Value, limit: &Value) -> Value {
+    let max = match limit {
+        Value::Number(n) if *n >= 0.0 => Some(*n as usize),
+        _ => None,
+    };
     #[cfg(feature = "regex")]
     if matches!(sep, Value::RegExp(_)) {
-        return string_split_regex(s, sep, None);
+        return string_split_regex(s, sep, max);
     }
-    string_split_impl(s, sep)
+    string_split_limit_impl(s, sep, max)
 }
 pub fn string_starts_with(s: &Value, search: &Value) -> Value {
     string_starts_with_impl(s, search)
@@ -168,6 +181,17 @@ pub fn string_replace_all(s: &Value, search: &Value, replacement: &Value) -> Val
 pub fn string_char_at(s: &Value, idx: &Value) -> Value {
     string_char_at_impl(s, idx)
 }
+pub fn string_at(s: &Value, idx: &Value) -> Value {
+    string_at_impl(s, idx)
+}
+/// `.at(i)` dispatched on the runtime value — `at` exists on both String and Array, and the native
+/// method match is by name (not receiver type), so route here at runtime. #247
+pub fn value_at(recv: &Value, idx: &Value) -> Value {
+    match recv {
+        Value::String(_) => string_at_impl(recv, idx),
+        _ => array_at(recv, idx),
+    }
+}
 pub fn string_char_code_at(s: &Value, idx: &Value) -> Value {
     string_char_code_at_impl(s, idx)
 }
@@ -509,6 +533,9 @@ pub use tishlang_builtins::math::{
     round as tish_math_round_impl, sign as tish_math_sign_impl, sin as tish_math_sin_impl,
     imul as tish_math_imul_impl,
     sqrt as tish_math_sqrt_impl, tan as tish_math_tan_impl, trunc as tish_math_trunc_impl,
+    // hypot/atan2/asin/acos/atan were missing on the native Math but present on the vm (#247).
+    hypot as tish_math_hypot_impl, atan2 as tish_math_atan2_impl, asin as tish_math_asin_impl,
+    acos as tish_math_acos_impl, atan as tish_math_atan_impl,
 };
 
 // Wrapper functions to maintain API (existing callers use math_* naming)
@@ -533,6 +560,21 @@ pub fn math_min(args: &[Value]) -> Value {
 pub fn math_max(args: &[Value]) -> Value {
     tish_math_max_impl(args)
 }
+pub fn math_hypot(args: &[Value]) -> Value {
+    tish_math_hypot_impl(args)
+}
+pub fn math_atan2(args: &[Value]) -> Value {
+    tish_math_atan2_impl(args)
+}
+pub fn math_asin(args: &[Value]) -> Value {
+    tish_math_asin_impl(args)
+}
+pub fn math_acos(args: &[Value]) -> Value {
+    tish_math_acos_impl(args)
+}
+pub fn math_atan(args: &[Value]) -> Value {
+    tish_math_atan_impl(args)
+}
 pub fn math_sin(args: &[Value]) -> Value {
     tish_math_sin_impl(args)
 }
@@ -1288,33 +1330,31 @@ pub fn string_split_regex(s: &Value, separator: &Value, limit: Option<usize>) ->
     match separator {
         Value::RegExp(re) => {
             let re = re.borrow();
+            // JS semantics: split fully, then truncate to `limit` (don't keep the unsplit remainder
+            // in the last slot). `truncate(usize::MAX)` is a no-op, so the no-limit path is unchanged.
             let mut result = Vec::new();
             let mut last_end = 0;
 
             for mat in re.regex.find_iter(input) {
                 match mat {
                     Ok(m) => {
-                        if result.len() >= max - 1 {
-                            break;
-                        }
                         result.push(Value::String(input[last_end..m.start()].into()));
                         last_end = m.end();
                     }
                     Err(_) => break,
                 }
             }
-
-            if result.len() < max {
-                result.push(Value::String(input[last_end..].into()));
-            }
+            result.push(Value::String(input[last_end..].into()));
+            result.truncate(max);
 
             Value::Array(VmRef::new(result))
         }
         Value::String(sep) => {
-            let parts: Vec<Value> = input
-                .splitn(max, sep.as_str())
+            let mut parts: Vec<Value> = input
+                .split(sep.as_str())
                 .map(|s| Value::String(s.into()))
                 .collect();
+            parts.truncate(max);
             Value::Array(VmRef::new(parts))
         }
         _ => Value::Array(VmRef::new(vec![Value::String(input.into())])),

package/crates/tish_ui/src/jsx.rs

@@ -302,7 +302,7 @@ fn collect_fun_decl_names_expr(expr: &Expr, names: &mut HashSet<String>) {
         Expr::Object { props, .. } => {
             for p in props {
                 match p {
-                    ObjectProp::KeyValue(_, e) | ObjectProp::Spread(e) => {
+                    ObjectProp::KeyValue(_, e, _) | ObjectProp::Spread(e) => {
                         collect_fun_decl_names_expr(e, names);
                     }
                 }
@@ -650,7 +650,7 @@ fn expr_contains_jsx(expr: &Expr) -> bool {
             ArrayElement::Expr(e) | ArrayElement::Spread(e) => expr_contains_jsx(e),
         }),
         Expr::Object { props, .. } => props.iter().any(|p| match p {
-            ObjectProp::KeyValue(_, e) | ObjectProp::Spread(e) => expr_contains_jsx(e),
+            ObjectProp::KeyValue(_, e, _) | ObjectProp::Spread(e) => expr_contains_jsx(e),
         }),
         Expr::ArrowFunction { body, .. } => match body {
             tishlang_ast::ArrowBody::Expr(e) => expr_contains_jsx(e),

package/crates/tish_vm/src/jit.rs

@@ -9,11 +9,13 @@
 //!     frame slot and a block per bytecode jump target; handles for/while/nested loops, if/else,
 //!     early return, break, continue. Enabled by slot-based locals making such functions `slot_based`.
 //!
-//! Anything unsupported (member/index, calls, arrays/objects, non-number constants, pow/shift,
+//! Anything unsupported (member/index, calls, arrays/objects, non-number constants, pow,
 //! booleans in slots, a ternary inside a loop) makes compilation return `None`, and any non-number
 //! argument at call time falls back to the interpreter — so this is purely ADDITIVE and can never
 //! change behaviour (a miss runs the VM). Only a logic bug here could, hence the differential
-//! validation (vm-JIT ≡ interp ≡ node) + `tests/core/jit_loops.tish`.
+//! validation (vm-JIT ≡ interp ≡ node) + `tests/core/jit_loops.tish`, `tests/core/jit_shifts.tish`.
+//! Bitwise `& | ^ ~` and shifts `<< >> >>>` are lowered (JS ToInt32/ToUint32 semantics, bit-exact
+//! with the VM's `eval_binop`); only `**` (pow) still falls back.
 //!
 //! Not compiled for wasm targets (cranelift-jit emits host code).
 
@@ -179,9 +181,15 @@ impl NumericFn {
 
 struct JitGlobal {
     module: JITModule,
-    /// Keyed by the address of the (stable, un-cloned) nested `Chunk`. `None`
-    /// caches "this chunk is not JIT-eligible" so we don't re-analyze it.
-    cache: HashMap<usize, Option<NumericFn>>,
+    /// Keyed by the address of the nested `Chunk`, with a content **fingerprint** alongside the
+    /// result. Within one program run a chunk lives for the whole run, so the address is stable and
+    /// unique. But this cache is a process-global that is never cleared, and a `Chunk` is dropped when
+    /// its program is — so a long-lived process that compiles/drops/recompiles programs (the REPL;
+    /// embedders running multiple scripts) can allocate a *different* chunk at a freed address that is
+    /// still cached. We therefore verify the fingerprint on every hit: a mismatch means the address was
+    /// reused by a different chunk, so we recompile (and overwrite) instead of returning stale native
+    /// code. `None` still caches "not JIT-eligible". See [`chunk_fingerprint`].
+    cache: HashMap<usize, (u64, Option<NumericFn>)>,
     counter: usize,
 }
 
@@ -228,6 +236,65 @@ fn read_u16(code: &[u8], ip: &mut usize) -> Option<u16> {
     Some((a << 8) | b)
 }
 
+/// Content fingerprint of everything `compile_chunk` reads, so a cache entry can be validated against
+/// the chunk currently at a (possibly reused) address. FNV-1a over the compile-relevant fields:
+/// shape (`param_count`, `num_slots`, `rest_param_index`, `slot_based`), the full `code` bytes, and
+/// the `constants` (the JIT emits `f64const`/bool from `LoadConst`, so their values matter). The JIT
+/// makes no cross-chunk calls (`op_size` allows only `SelfCall`, which recurses into *this* function),
+/// so nothing outside the chunk affects the result — this fingerprint is complete. Deterministic
+/// within a process (fixed FNV constants, not a randomized hasher), which is all the cache needs.
+fn chunk_fingerprint(chunk: &Chunk) -> u64 {
+    // Mixes a u64 at a time (FNV-prime multiply + an avalanche shift). Eight bytes per round keeps
+    // this cheap on the hot closure-creation path; correctness only needs determinism + good
+    // distinction, not cryptographic strength.
+    #[inline]
+    fn mix(h: &mut u64, v: u64) {
+        *h ^= v;
+        *h = h.wrapping_mul(0x0000_0100_0000_01b3);
+        *h ^= *h >> 29;
+    }
+    #[inline]
+    fn mix_bytes(h: &mut u64, bytes: &[u8]) {
+        let mut it = bytes.chunks_exact(8);
+        for w in &mut it {
+            mix(h, u64::from_le_bytes(w.try_into().unwrap()));
+        }
+        let rem = it.remainder();
+        if !rem.is_empty() {
+            let mut buf = [0u8; 8];
+            buf[..rem.len()].copy_from_slice(rem);
+            mix(h, u64::from_le_bytes(buf));
+        }
+        mix(h, bytes.len() as u64);
+    }
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    mix(&mut h, chunk.param_count as u64);
+    mix(&mut h, chunk.num_slots as u64);
+    mix(&mut h, chunk.rest_param_index as u64);
+    mix(&mut h, chunk.slot_based as u64);
+    mix_bytes(&mut h, &chunk.code);
+    mix(&mut h, chunk.constants.len() as u64);
+    for c in &chunk.constants {
+        match c {
+            Constant::Number(n) => {
+                mix(&mut h, 1);
+                mix(&mut h, n.to_bits());
+            }
+            Constant::String(s) => {
+                mix(&mut h, 2);
+                mix_bytes(&mut h, s.as_bytes());
+            }
+            Constant::Bool(b) => mix(&mut h, if *b { 4 } else { 3 }),
+            Constant::Null => mix(&mut h, 5),
+            Constant::Closure(idx) => {
+                mix(&mut h, 6);
+                mix(&mut h, *idx as u64);
+            }
+        }
+    }
+    h
+}
+
 /// Get (or compile, then cache) the native numeric function for `chunk`.
 /// Returns `None` if the chunk isn't a straight-line numeric function.
 pub fn try_compile_numeric(chunk: &Chunk) -> Option<NumericFn> {
@@ -239,13 +306,18 @@ pub fn try_compile_numeric(chunk: &Chunk) -> Option<NumericFn> {
         return None;
     }
     let key = chunk as *const Chunk as usize;
+    let fp = chunk_fingerprint(chunk);
     let lock = jit()?;
     let mut g = lock.lock().ok()?;
-    if let Some(cached) = g.cache.get(&key).copied() {
-        return cached;
+    // Hit only counts if the fingerprint matches: otherwise this address was freed and reused by a
+    // *different* chunk, and the cached `NumericFn` is native code for the old one (a miscompile).
+    if let Some(&(cached_fp, cached)) = g.cache.get(&key) {
+        if cached_fp == fp {
+            return cached;
+        }
     }
     let result = compile_chunk(&mut g, chunk);
-    g.cache.insert(key, result);
+    g.cache.insert(key, (fp, result));
     result
 }
 
@@ -561,7 +633,6 @@ fn emit_simple_op(
                     bcx.ins().fsub(l, p)
                 }
                 // Bitwise AND/OR/XOR via JS ToInt32 (modulo 2³², NaN/±∞ → 0) — see [`js_to_int32`].
-                // Shifts / `>>>` stay on the VM (shift-amount edge cases).
                 BinOp::BitAnd | BinOp::BitOr | BinOp::BitXor => {
                     let li = js_to_int32(bcx, l);
                     let ri = js_to_int32(bcx, r);
@@ -573,7 +644,36 @@ fn emit_simple_op(
                     };
                     bcx.ins().fcvt_from_sint(types::F64, res)
                 }
-                // Pow/shifts/`>>>`/In/And/Or: fall back to the VM.
+                // Shifts. JS masks the count to the low 5 bits (`& 31`); the low 5 bits of `ToInt32(r)`
+                // equal `ToUint32(r)`, so `js_to_int32(r)` carries the right amount. We mask explicitly
+                // (`& 31`) so correctness never depends on Cranelift's own amount-masking convention.
+                // `<<`/`>>` are signed-domain (ToInt32 → i32 → signed→f64); `>>>` is logical on the
+                // unsigned bits with an UNSIGNED→f64 convert (result may exceed 2³¹). Bit-for-bit with
+                // vm.rs `eval_binop`: Shl/Shr = `to_int32(l).wrapping_sh*(to_uint32(r))`,
+                // UShr = `to_uint32(l).wrapping_shr(to_uint32(r))`.
+                BinOp::Shl | BinOp::Shr | BinOp::UShr => {
+                    let li = js_to_int32(bcx, l);
+                    let amt = js_to_int32(bcx, r);
+                    let mask = bcx.ins().iconst(types::I32, 31);
+                    let amt = bcx.ins().band(amt, mask);
+                    match bop {
+                        BinOp::Shl => {
+                            let res = bcx.ins().ishl(li, amt);
+                            bcx.ins().fcvt_from_sint(types::F64, res)
+                        }
+                        BinOp::Shr => {
+                            let res = bcx.ins().sshr(li, amt);
+                            bcx.ins().fcvt_from_sint(types::F64, res)
+                        }
+                        // UShr: logical shift on the same 32-bit value bits as ToUint32(l), then
+                        // unsigned→f64 so a result with bit 31 set stays a positive number (JS `>>>`).
+                        _ => {
+                            let res = bcx.ins().ushr(li, amt);
+                            bcx.ins().fcvt_from_uint(types::F64, res)
+                        }
+                    }
+                }
+                // Pow/In/And/Or: fall back to the VM.
                 _ => return SimpleOp::Unsupported,
             };
             stack.push((v, is_cmp));
@@ -1048,3 +1148,105 @@ fn build_body(
     bcx.finalize();
     result
 }
+
+#[cfg(all(test, not(target_arch = "wasm32")))]
+mod tests {
+    use super::*;
+    use tishlang_core::{to_int32, to_uint32};
+
+    /// First arity-2 slot-based numeric nested chunk in compiled `src` (cloned, so the caller owns it).
+    fn fn_chunk(src: &str) -> Chunk {
+        let prog = tishlang_parser::parse(src).expect("parse");
+        let opt = tishlang_opt::optimize(&prog);
+        let top = tishlang_bytecode::compile(&opt).expect("compile");
+        fn find(c: &Chunk) -> Option<Chunk> {
+            for n in &c.nested {
+                if n.slot_based && n.param_count == 2 && n.rest_param_index == NO_REST_PARAM {
+                    return Some(n.clone());
+                }
+                if let Some(x) = find(n) {
+                    return Some(x);
+                }
+            }
+            None
+        }
+        find(&top).expect("expected an arity-2 slot-based fn chunk")
+    }
+
+    /// Compile `src`, then return the first arity-2 pure-numeric function the JIT accepts. Panics if
+    /// none compiles — so a change that makes the JIT silently *stop* compiling the target (the exact
+    /// "vacuous fixture" miss that motivated this guard) fails loudly instead of passing emptily.
+    ///
+    /// Bypasses [`try_compile_numeric`]'s cache and calls [`compile_chunk`] directly: the cache is
+    /// keyed by chunk address, unique-and-stable in a real run but reused across this test's transient
+    /// chunks. Compiling fresh is correct here and still exercises the real lowering path.
+    fn jit_arity2(src: &str) -> NumericFn {
+        let prog = tishlang_parser::parse(src).expect("parse");
+        let opt = tishlang_opt::optimize(&prog);
+        let chunk = tishlang_bytecode::compile(&opt).expect("compile");
+        fn compile_uncached(c: &Chunk) -> Option<NumericFn> {
+            if !c.slot_based
+                || c.rest_param_index != NO_REST_PARAM
+                || c.param_count == 0
+                || c.param_count > 8
+            {
+                return None;
+            }
+            let lock = jit()?;
+            let mut g = lock.lock().ok()?;
+            compile_chunk(&mut g, c)
+        }
+        fn find(c: &Chunk) -> Option<NumericFn> {
+            for n in &c.nested {
+                if let Some(f) = compile_uncached(n) {
+                    if f.arity == 2 && f.array_param_mask == 0 {
+                        return Some(f);
+                    }
+                }
+                if let Some(f) = find(n) {
+                    return Some(f);
+                }
+            }
+            None
+        }
+        find(&chunk).expect("the JIT must compile this arity-2 numeric fn (did it start bailing?)")
+    }
+
+    /// Regression for the address-reuse stale hit (#247): compile one function, then overwrite the SAME
+    /// heap `Chunk` (same address = the cache key) with a *different* function — what a long-lived
+    /// process (REPL / multi-script embedder) does when a freed chunk address is reused. Before the
+    /// fingerprint check the cache returned the first function's native code for the second.
+    #[test]
+    fn jit_cache_detects_address_reuse() {
+        let mut boxed: Box<Chunk> = Box::new(fn_chunk("const f = (a, b) => a - b\nf(0, 0)\n"));
+        let sub = try_compile_numeric(&boxed).expect("a - b must JIT");
+        assert_eq!(sub.call(&[10.0, 3.0]), 7.0, "sub baseline");
+
+        *boxed = fn_chunk("const f = (a, b) => a * b\nf(0, 0)\n"); // same address, different content
+        let mul = try_compile_numeric(&boxed).expect("a * b must JIT");
+        assert_eq!(
+            mul.call(&[10.0, 3.0]),
+            30.0,
+            "stale cache hit: reused address returned the old (sub) fn instead of mul"
+        );
+    }
+
+    /// Permanent guard for #168: shifts must (a) actually JIT-compile and (b) be bit-exact with the
+    /// VM's `eval_binop` (`to_int32`/`to_uint32` + wrapping shift). Breaking either fails this test.
+    #[test]
+    fn jit_lowers_shifts_bit_exact_to_vm() {
+        let shl = jit_arity2("const f = (a, b) => a << b\nf(0, 0)\n");
+        let shr = jit_arity2("const f = (a, b) => a >> b\nf(0, 0)\n");
+        let ushr = jit_arity2("const f = (a, b) => a >>> b\nf(0, 0)\n");
+        let cases = [
+            (1.0, 4.0), (1.0, 32.0), (1.0, 33.0), (1.0, -1.0), (-8.0, 1.0), (-1.0, 0.0),
+            (-2.0, 1.0), (4294967295.0, 0.0), (3.9, 0.0), (4294967297.0, 0.0),
+            (-123456789.0, 5.0), (65535.0, 16.0),
+        ];
+        for (a, b) in cases {
+            assert_eq!(shl.call(&[a, b]), to_int32(a).wrapping_shl(to_uint32(b)) as f64, "<< {a} {b}");
+            assert_eq!(shr.call(&[a, b]), to_int32(a).wrapping_shr(to_uint32(b)) as f64, ">> {a} {b}");
+            assert_eq!(ushr.call(&[a, b]), to_uint32(a).wrapping_shr(to_uint32(b)) as f64, ">>> {a} {b}");
+        }
+    }
+}

package/crates/tish_vm/src/vm.rs

@@ -264,7 +264,7 @@ fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str)
                 tishlang_runtime::process_exec(args)
             })),
             "argv" => Some(Value::Array(VmRef::new(
-                std::env::args().map(|s| Value::String(s.into())).collect(),
+                tishlang_core::process_argv().into_iter().map(|s| Value::String(s.into())).collect(),
             ))),
             "env" => Some(value_object_from_map(
                 std::env::vars()
@@ -288,7 +288,7 @@ fn get_builtin_export(enabled: &HashSet<String>, spec: &str, export_name: &str)
                 m.insert(
                     "argv".into(),
                     Value::Array(VmRef::new(
-                        std::env::args().map(|s| Value::String(s.into())).collect(),
+                        tishlang_core::process_argv().into_iter().map(|s| Value::String(s.into())).collect(),
                     )),
                 );
                 m.insert(
@@ -462,12 +462,11 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
             Value::Number(n.ceil())
         }),
     );
+    // round/min/max delegate to the shared builtins (JS round-half-to-+∞, empty → ±∞, NaN
+    // propagation) so the vm never diverges from interp/native on Math semantics (#247).
     math.insert(
         "round".into(),
-        Value::native(|args: &[Value]| {
-            let n = args.first().and_then(|v| v.as_number()).unwrap_or(f64::NAN);
-            Value::Number(n.round())
-        }),
+        Value::native(|args: &[Value]| math_builtins::round(args)),
     );
     math.insert(
         "random".into(),
@@ -475,17 +474,11 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
     );
     math.insert(
         "min".into(),
-        Value::native(|args: &[Value]| {
-            let nums: Vec<f64> = args.iter().filter_map(|v| v.as_number()).collect();
-            Value::Number(nums.into_iter().fold(f64::NAN, |a, b| a.min(b)))
-        }),
+        Value::native(|args: &[Value]| math_builtins::min(args)),
     );
     math.insert(
         "max".into(),
-        Value::native(|args: &[Value]| {
-            let nums: Vec<f64> = args.iter().filter_map(|v| v.as_number()).collect();
-            Value::Number(nums.into_iter().fold(f64::NAN, |a, b| a.max(b)))
-        }),
+        Value::native(|args: &[Value]| math_builtins::max(args)),
     );
     math.insert(
         "pow".into(),
@@ -795,7 +788,7 @@ fn init_globals(enabled: &HashSet<String>) -> ObjectMap {
         process_obj.insert(
             "argv".into(),
             Value::Array(VmRef::new(
-                std::env::args().map(|s| Value::String(s.into())).collect(),
+                tishlang_core::process_argv().into_iter().map(|s| Value::String(s.into())).collect(),
             )),
         );
         process_obj.insert(
@@ -2969,6 +2962,9 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                         "forEach"   => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::for_each(&bv, &cb) }),
                         "find"      => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::find(&bv, &cb) }),
                         "findIndex" => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::find_index(&bv, &cb) }),
+                        "findLast"      => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::find_last(&bv, &cb) }),
+                        "findLastIndex" => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::find_last_index(&bv, &cb) }),
+                        "at"        => make_native_fn(move |args| { let i = args.first().cloned().unwrap_or(Value::Null); arr_builtins::at(&bv, &i) }),
                         "some"      => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::some(&bv, &cb) }),
                         "every"     => make_native_fn(move |args| { let cb = args.first().cloned().unwrap_or(Value::Null); arr_builtins::every(&bv, &cb) }),
                         "join"      => make_native_fn(move |args| { let sep = args.first().cloned().unwrap_or(Value::Null); arr_builtins::join(&bv, &sep) }),
@@ -3073,6 +3069,18 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                     let cb = args.first().cloned().unwrap_or(Value::Null);
                     arr_builtins::find_index(&Value::Array(a_clone.clone()), &cb)
                 }),
+                "findLast" => make_native_fn(move |args: &[Value]| {
+                    let cb = args.first().cloned().unwrap_or(Value::Null);
+                    arr_builtins::find_last(&Value::Array(a_clone.clone()), &cb)
+                }),
+                "findLastIndex" => make_native_fn(move |args: &[Value]| {
+                    let cb = args.first().cloned().unwrap_or(Value::Null);
+                    arr_builtins::find_last_index(&Value::Array(a_clone.clone()), &cb)
+                }),
+                "at" => make_native_fn(move |args: &[Value]| {
+                    let i = args.first().cloned().unwrap_or(Value::Null);
+                    arr_builtins::at(&Value::Array(a_clone.clone()), &i)
+                }),
                 "some" => make_native_fn(move |args: &[Value]| {
                     let cb = args.first().cloned().unwrap_or(Value::Null);
                     arr_builtins::some(&Value::Array(a_clone.clone()), &cb)
@@ -3159,15 +3167,24 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                 }),
                 "split" => make_native_fn(move |args: &[Value]| {
                     let sep = args.first().unwrap_or(&Value::Null);
+                    let limit = args.get(1).unwrap_or(&Value::Null);
+                    let max = match limit {
+                        Value::Number(n) if *n >= 0.0 => Some(*n as usize),
+                        _ => None,
+                    };
+                    // A RegExp separator needs the runtime's regex path — but a `Value::RegExp` can
+                    // only exist with the `regex` feature, which is also what pulls in the optional
+                    // `tishlang_runtime`. String separators use the always-available builtin, so
+                    // `tish_vm` still compiles (and tests) without the optional runtime crate.
                     #[cfg(feature = "regex")]
                     if matches!(sep, Value::RegExp(_)) {
-                        return tishlang_runtime::string_split_regex(
+                        return tishlang_runtime::string_split_limit(
                             &Value::String(s_clone.clone()),
                             sep,
-                            None,
+                            limit,
                         );
                     }
-                    str_builtins::split(&Value::String(s_clone.clone()), sep)
+                    str_builtins::split_limit(&Value::String(s_clone.clone()), sep, max)
                 }),
                 "trim" => make_native_fn(move |_args: &[Value]| {
                     str_builtins::trim(&Value::String(s_clone.clone()))
@@ -3224,6 +3241,10 @@ fn get_member(obj: &Value, key: &Arc<str>) -> Result<Value, String> {
                     let idx = args.first().unwrap_or(&Value::Null);
                     str_builtins::char_at(&Value::String(s_clone.clone()), idx)
                 }),
+                "at" => make_native_fn(move |args: &[Value]| {
+                    let idx = args.first().unwrap_or(&Value::Null);
+                    str_builtins::at(&Value::String(s_clone.clone()), idx)
+                }),
                 "charCodeAt" => make_native_fn(move |args: &[Value]| {
                     let idx = args.first().unwrap_or(&Value::Null);
                     str_builtins::char_code_at(&Value::String(s_clone.clone()), idx)