js-confuser-vm 0.0.9 → 0.1.1

package/dist/runtime.js

@@ -8,14 +8,17 @@ const TIMING_CHECKS = false;
 // The text above is not included in the compiled output - for type intellisense only
 // @START
 
-function decodeBytecode(s) {
-  if (!ENCODE_BYTECODE) return s;
-  var b = typeof Buffer !== "undefined" ? Buffer.from(s, "base64") : Uint8Array.from(atob(s), function (c) {
+function base64ToBytes(s) {
+  return typeof Buffer !== "undefined" ? Buffer.from(s, "base64") : Uint8Array.from(atob(s), function (c) {
     return c.charCodeAt(0);
   });
-  // Each slot is a u16 stored as 2 little-endian bytes.
-  var r = new Uint16Array(b.length / 2);
-  for (var i = 0; i < r.length; i++) r[i] = b[i * 2] | b[i * 2 + 1] << 8;
+}
+function decodeBytecode(s) {
+  if (!ENCODE_BYTECODE) return s;
+  var b = base64ToBytes(s);
+  // Each slot is a u32 stored as 4 little-endian bytes.
+  var r = new Uint32Array(b.length / 4);
+  for (var i = 0; i < r.length; i++) r[i] = (b[i * 4] | b[i * 4 + 1] << 8 | b[i * 4 + 2] << 16 | b[i * 4 + 3] << 24) >>> 0;
   return r;
 }
 
@@ -24,23 +27,24 @@ function decodeBytecode(s) {
 // inner Closure instead of going through a sub-VM on internal calls.
 var CLOSURE_SYM = Symbol(); // Nameless for obfuscation
 
-// Upvalue
-// While the outer frame is alive: reads/writes go to frame.regs[slot].
+// Upvalue — Lua/CPython style.
+// While the outer frame is alive: reads/writes go to vm._regs[_absSlot].
 // After the outer frame returns (closed): reads/writes hit this._value.
-function Upvalue(frame, slot) {
-  this._frame = frame;
-  this._slot = slot;
+// _absSlot is the absolute index in VM._regs (frame._base + local slot).
+function Upvalue(regs, absSlot) {
+  this._regs = regs; // shared reference to VM._regs flat array
+  this._absSlot = absSlot; // absolute index; stable as long as frame is alive
   this._closed = false;
   this._value = undefined;
 }
 Upvalue.prototype._read = function () {
-  return this._closed ? this._value : this._frame.regs[this._slot];
+  return this._closed ? this._value : this._regs[this._absSlot];
 };
 Upvalue.prototype._write = function (v) {
-  if (this._closed) this._value = v;else this._frame.regs[this._slot] = v;
+  if (this._closed) this._value = v;else this._regs[this._absSlot] = v;
 };
 Upvalue.prototype._close = function () {
-  this._value = this._frame.regs[this._slot];
+  this._value = this._regs[this._absSlot];
   this._closed = true;
 };
 
@@ -50,16 +54,19 @@ function Closure(fn) {
   this.upvalues = [];
   this.prototype = {}; // <- default prototype object for `new`
 }
-function Frame(closure, returnPc, parent, thisVal, retDstReg) {
+
+// Frame — analogous to Lua CallInfo / CPython PyFrameObject.
+// Does NOT own a register array; registers live in VM._regs[_base .. _base+regCount).
+function Frame(closure, returnPc, parent, thisVal, retDstReg, base) {
   this.closure = closure;
-  this.regs = new Array(closure.fn.regCount).fill(undefined);
-  this._pc = closure.fn.startPc; // <- initialize from fn descriptor
-  this._returnPc = returnPc; // pc to resume in parent frame after RETURN
+  this._base = base; // absolute offset into VM._regs for this frame's r0
+  this._pc = closure.fn.startPc;
+  this._returnPc = returnPc;
   this._parent = parent;
   this.thisVal = thisVal !== undefined ? thisVal : undefined;
-  this._retDstReg = retDstReg !== undefined ? retDstReg : 0; // register in parent to write return value
-  this._newObj = null; // <- set by NEW so RETURN can see it
-  this._handlerStack = []; // <- exception handlers pushed by TRY_SETUP
+  this._retDstReg = retDstReg !== undefined ? retDstReg : 0;
+  this._newObj = null;
+  this._handlerStack = [];
 }
 
 // VM
@@ -68,15 +75,22 @@ function VM(bytecode, mainStartPc, mainRegCount, constants, globals) {
   this.constants = constants;
   this.globals = globals;
   this._frameStack = [];
-  this._openUpvalues = []; // all currently open Upvalue objects across all frames
+  this._openUpvalues = [];
+
+  // ── Flat register file (Lua-style) ────────────────────────────────────────
+  // All frames share a single array.  Each Frame records its _base offset.
+  // _regsTop is the next free slot (= base of the hypothetical next frame).
+  // On CALL:   newBase = _regsTop; _regsTop += fn.regCount
+  // On RETURN: _regsTop = frame._base   (pop the frame's register window)
+  this._regs = new Array(mainRegCount).fill(undefined);
+  this._regsTop = mainRegCount; // main frame occupies [0, mainRegCount)
 
   var mainFn = {
     paramCount: 0,
     regCount: mainRegCount,
-    startPc: mainStartPc // <- where main begins
+    startPc: mainStartPc
   };
-  this._currentFrame = new Frame(new Closure(mainFn), null, null, undefined, 0);
-  this._internals = {};
+  this._currentFrame = new Frame(new Closure(mainFn), null, null, undefined, 0, 0);
 }
 
 // Consume the next slot from the flat bytecode stream and advance the PC.
@@ -85,13 +99,13 @@ VM.prototype._operand = function () {
   return this.bytecode[this._currentFrame._pc++];
 };
 VM.prototype.captureUpvalue = function (frame, slot) {
-  // Reuse existing open upvalue for this frame+slot if one exists.
-  // This is what makes two closures share the same mutable cell.
+  // Dedup by absolute slot — two closures capturing the same local share one Upvalue.
+  var absSlot = frame._base + slot;
   for (var i = 0; i < this._openUpvalues.length; i++) {
     var uv = this._openUpvalues[i];
-    if (uv._frame === frame && uv._slot === slot) return uv;
+    if (!uv._closed && uv._absSlot === absSlot) return uv;
   }
-  var uv = new Upvalue(frame, slot);
+  var uv = new Upvalue(this._regs, absSlot);
   this._openUpvalues.push(uv);
   return uv;
 };
@@ -112,9 +126,7 @@ VM.prototype._constant = function (idxIn, keyIn) {
   if (!key) return v;
   if (typeof v === "number") return v ^ key;
   // String: base64-decode to u16 LE byte pairs, then XOR each code with (key+i).
-  var b = typeof Buffer !== "undefined" ? Buffer.from(v, "base64") : Uint8Array.from(atob(v), function (c) {
-    return c.charCodeAt(0);
-  });
+  var b = base64ToBytes(v);
   var out = "";
   for (var i = 0; i < b.length / 2; i++) {
     var code = b[i * 2] | b[i * 2 + 1] << 8; // u16 LE
@@ -123,16 +135,23 @@ VM.prototype._constant = function (idxIn, keyIn) {
   return out;
 };
 VM.prototype._closeUpvaluesFor = function (frame) {
-  // Called on RETURN - close every upvalue that was pointing into this frame.
-  // After this, closures that captured from the frame read from upvalue.value.
+  // Called on RETURN — close every upvalue whose absolute slot falls within
+  // this frame's register window [_base, _base + regCount).
+  var lo = frame._base;
+  var hi = frame._base + frame.closure.fn.regCount;
   this._openUpvalues = this._openUpvalues.filter(function (uv) {
-    if (uv._frame === frame) {
+    if (!uv._closed && uv._absSlot >= lo && uv._absSlot < hi) {
       uv._close();
       return false;
     }
     return true;
   });
 };
+VM.prototype._ensureRegisterWindow = function (base, regCount) {
+  var end = base + regCount;
+  while (this._regs.length < end) this._regs.push(undefined);
+  for (var i = base; i < end; i++) this._regs[i] = undefined;
+};
 VM.prototype.run = function () {
   var now = () => {
     return performance.now();
@@ -160,24 +179,27 @@ VM.prototype.run = function () {
         // Poison the bytecode
         for (var i = 0; i < this.bytecode.length; i++) this.bytecode[i] = 0;
         // Break the current state
-        frame.regs.fill(undefined);
+        for (var i2 = frame._base; i2 < this._regsTop; i2++) this._regs[i2] = undefined;
         op = OP.JUMP;
         frame._pc = this.bytecode.length; // jump past end to halt
       }
     }
     try {
+      var regs = this._regs;
+      var base = frame._base;
+
       /* @SWITCH */
       switch (op) {
         case OP.LOAD_CONST:
           {
             var dst = this._operand();
-            frame.regs[dst] = this._constant();
+            regs[base + dst] = this._constant();
             break;
           }
         case OP.LOAD_INT:
           {
             var dst = this._operand();
-            frame.regs[dst] = this._operand();
+            regs[base + dst] = this._operand();
             break;
           }
         case OP.LOAD_GLOBAL:
@@ -187,221 +209,222 @@ VM.prototype.run = function () {
             if (!(globalName in this.globals)) {
               throw new ReferenceError(`${globalName} is not defined`);
             }
-            frame.regs[dst] = this.globals[globalName];
+            regs[base + dst] = this.globals[globalName];
             break;
           }
         case OP.LOAD_UPVALUE:
           {
             var dst = this._operand();
-            frame.regs[dst] = frame.closure.upvalues[this._operand()]._read();
+            regs[base + dst] = frame.closure.upvalues[this._operand()]._read();
             break;
           }
         case OP.LOAD_THIS:
           {
             var dst = this._operand();
-            frame.regs[dst] = frame.thisVal;
+            regs[base + dst] = frame.thisVal;
             break;
           }
         case OP.MOVE:
           {
             var dst = this._operand();
-            frame.regs[dst] = frame.regs[this._operand()];
+            regs[base + dst] = regs[base + this._operand()];
             break;
           }
         case OP.STORE_GLOBAL:
           {
-            // nameIdx and key are consumed inline so the concealConstants runtime
-            // transform can rewrite this._constant() consistently.
-            this.globals[this._constant()] = frame.regs[this._operand()];
+            // globals[globalName] = regs[src]
+            this.globals[this._constant()] = regs[base + this._operand()];
             break;
           }
         case OP.STORE_UPVALUE:
           {
             var uvIdx = this._operand();
-            frame.closure.upvalues[uvIdx]._write(frame.regs[this._operand()]);
+            frame.closure.upvalues[uvIdx]._write(regs[base + this._operand()]);
             break;
           }
         case OP.GET_PROP:
           {
             // dst = regs[obj][regs[key]]
             var dst = this._operand();
-            var obj = frame.regs[this._operand()];
-            var key = frame.regs[this._operand()];
-            frame.regs[dst] = obj[key];
+            var obj = regs[base + this._operand()];
+            var key = regs[base + this._operand()];
+            regs[base + dst] = obj[key];
             break;
           }
         case OP.SET_PROP:
           {
             // regs[obj][regs[key]] = regs[val]
-            var obj = frame.regs[this._operand()];
-            var key = frame.regs[this._operand()];
-            var val = frame.regs[this._operand()];
-            // Reflect.set performs [[Set]] without throwing on failure,
-            // correctly simulating sloppy-mode assignment from a strict-mode host.
+            var obj = regs[base + this._operand()];
+            var key = regs[base + this._operand()];
+            var val = regs[base + this._operand()];
+            // Reflect.set performs [[Set]] without throwing on failure (non-strict mode behavior)
             Reflect.set(obj, key, val);
             break;
           }
         case OP.DELETE_PROP:
           {
+            // regs[dst] = delete regs[obj][regs[key]]
+            // The delete operator returns true if successful which is most cases
             var dst = this._operand();
-            var obj = frame.regs[this._operand()];
-            var key = frame.regs[this._operand()];
-            frame.regs[dst] = delete obj[key];
+            var obj = regs[base + this._operand()];
+            var key = regs[base + this._operand()];
+            regs[base + dst] = delete obj[key];
             break;
           }
 
-        // ── Arithmetic  (dst, src1, src2) ────────────────────────────────────
+        // Arithmetic  (dst, src1, src2)
         case OP.ADD:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a + frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a + regs[base + this._operand()];
             break;
           }
         case OP.SUB:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a - frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a - regs[base + this._operand()];
             break;
           }
         case OP.MUL:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a * frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a * regs[base + this._operand()];
             break;
           }
         case OP.DIV:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a / frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a / regs[base + this._operand()];
             break;
           }
         case OP.MOD:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a % frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a % regs[base + this._operand()];
             break;
           }
         case OP.BAND:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a & frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a & regs[base + this._operand()];
             break;
           }
         case OP.BOR:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a | frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a | regs[base + this._operand()];
             break;
           }
         case OP.BXOR:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a ^ frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a ^ regs[base + this._operand()];
             break;
           }
         case OP.SHL:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a << frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a << regs[base + this._operand()];
             break;
           }
         case OP.SHR:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a >> frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a >> regs[base + this._operand()];
             break;
           }
         case OP.USHR:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a >>> frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a >>> regs[base + this._operand()];
             break;
           }
 
-        // ── Comparison  (dst, src1, src2) ─────────────────────────────────────
+        // Comparison  (dst, src1, src2)
         case OP.LT:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a < frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a < regs[base + this._operand()];
             break;
           }
         case OP.GT:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a > frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a > regs[base + this._operand()];
             break;
           }
         case OP.LTE:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a <= frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a <= regs[base + this._operand()];
             break;
           }
         case OP.GTE:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a >= frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a >= regs[base + this._operand()];
             break;
           }
         case OP.EQ:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a === frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a === regs[base + this._operand()];
             break;
           }
         case OP.NEQ:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a !== frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a !== regs[base + this._operand()];
             break;
           }
         case OP.LOOSE_EQ:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a == frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a == regs[base + this._operand()];
             break;
           }
         case OP.LOOSE_NEQ:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a != frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a != regs[base + this._operand()];
             break;
           }
         case OP.IN:
           {
             var dst = this._operand();
-            var a = frame.regs[this._operand()];
-            frame.regs[dst] = a in frame.regs[this._operand()];
+            var a = regs[base + this._operand()];
+            regs[base + dst] = a in regs[base + this._operand()];
             break;
           }
         case OP.INSTANCEOF:
           {
+            // regs[dst] = regs[obj] instanceof regs[ctor]
             var dst = this._operand();
-            var obj = frame.regs[this._operand()];
-            var ctor = frame.regs[this._operand()];
+            var obj = regs[base + this._operand()];
+            var ctor = regs[base + this._operand()];
             if (typeof ctor === "function") {
-              frame.regs[dst] = obj instanceof ctor;
+              regs[base + dst] = obj instanceof ctor;
             } else {
-              // VM Closure - walk prototype chain for identity with ctor.prototype.
+              // TODO: Why is this needed?
               var proto = ctor.prototype;
               var target = Object.getPrototypeOf(obj);
               var result = false;
@@ -412,60 +435,61 @@ VM.prototype.run = function () {
                 }
                 target = Object.getPrototypeOf(target);
               }
-              frame.regs[dst] = result;
+              regs[base + dst] = result;
             }
             break;
           }
 
-        // ── Unary  (dst, src) ─────────────────────────────────────────────────
+        // Unary  (dst, src)
         case OP.UNARY_NEG:
           {
             var dst = this._operand();
-            frame.regs[dst] = -frame.regs[this._operand()];
+            regs[base + dst] = -regs[base + this._operand()];
             break;
           }
         case OP.UNARY_POS:
           {
             var dst = this._operand();
-            frame.regs[dst] = +frame.regs[this._operand()];
+            regs[base + dst] = +regs[base + this._operand()];
             break;
           }
         case OP.UNARY_NOT:
           {
             var dst = this._operand();
-            frame.regs[dst] = !frame.regs[this._operand()];
+            regs[base + dst] = !regs[base + this._operand()];
             break;
           }
         case OP.UNARY_BITNOT:
           {
             var dst = this._operand();
-            frame.regs[dst] = ~frame.regs[this._operand()];
+            regs[base + dst] = ~regs[base + this._operand()];
             break;
           }
         case OP.TYPEOF:
           {
             var dst = this._operand();
-            frame.regs[dst] = typeof frame.regs[this._operand()];
+            regs[base + dst] = typeof regs[base + this._operand()];
             break;
           }
         case OP.VOID:
           {
             var dst = this._operand();
-            this._operand(); // consume src — evaluated for side-effects by compiler
-            frame.regs[dst] = undefined;
+            this._operand(); // consumes argument (intended)
+            regs[base + dst] = undefined;
             break;
           }
         case OP.TYPEOF_SAFE:
           {
-            // dst, nameConstIdx — safe typeof for potentially-undeclared globals.
+            // regs[dst] = typeof window[name]
+            // Never throws ReferenceError, instead returns undefined for undeclared variables
             var dst = this._operand();
             var name = this._constant();
             var val = Object.prototype.hasOwnProperty.call(this.globals, name) ? this.globals[name] : undefined;
-            frame.regs[dst] = typeof val;
+            regs[base + dst] = typeof val;
             break;
           }
 
-        // ── Control flow ──────────────────────────────────────────────────────
+        // Control flow
         case OP.JUMP:
           frame._pc = this._operand();
           break;
@@ -473,7 +497,7 @@ VM.prototype.run = function () {
           {
             var src = this._operand();
             var target = this._operand();
-            if (!frame.regs[src]) frame._pc = target;
+            if (!regs[base + src]) frame._pc = target;
             break;
           }
         case OP.JUMP_IF_TRUE:
@@ -481,28 +505,39 @@ VM.prototype.run = function () {
             // || short-circuit: if truthy, jump over RHS.
             var src = this._operand();
             var target = this._operand();
-            if (frame.regs[src]) frame._pc = target;
+            if (regs[base + src]) frame._pc = target;
             break;
           }
 
-        // ── Calls ─────────────────────────────────────────────────────────────
+        // Calls
         case OP.CALL:
           {
             // dst, calleeReg, argc, [argReg...]
             var dst = this._operand();
-            var callee = frame.regs[this._operand()];
+            var callee = regs[base + this._operand()];
             var argc = this._operand();
             var args = new Array(argc);
-            for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];
+            for (var i = 0; i < argc; i++) args[i] = regs[base + this._operand()];
             if (callee && callee[CLOSURE_SYM]) {
-              var c = callee[CLOSURE_SYM];
-              var f = new Frame(c, frame._pc, frame, this.globals, dst);
-              for (var i = 0; i < args.length; i++) f.regs[i] = args[i];
-              f.regs[c.fn.paramCount] = args;
+              var closure = callee[CLOSURE_SYM];
+              var newBase = this._regsTop;
+              this._ensureRegisterWindow(newBase, closure.fn.regCount);
+              this._regsTop = newBase + closure.fn.regCount;
+              var f = new Frame(closure, frame._pc, frame, this.globals, dst, newBase);
+              if (closure.fn.hasRest) {
+                var restSlot = closure.fn.paramCount - 1;
+                for (var i = 0; i < restSlot; i++) this._regs[newBase + i] = i < args.length ? args[i] : undefined;
+                this._regs[newBase + restSlot] = args.slice(restSlot);
+              } else {
+                for (var i = 0; i < args.length && i < closure.fn.regCount; i++) this._regs[newBase + i] = args[i];
+              }
+              if (closure.fn.paramCount < closure.fn.regCount) {
+                this._regs[newBase + closure.fn.paramCount] = args;
+              }
               this._frameStack.push(this._currentFrame);
               this._currentFrame = f;
             } else {
-              frame.regs[dst] = callee.apply(null, args);
+              regs[base + dst] = callee.apply(null, args);
             }
             break;
           }
@@ -510,20 +545,31 @@ VM.prototype.run = function () {
           {
             // dst, receiverReg, calleeReg, argc, [argReg...]
             var dst = this._operand();
-            var receiver = frame.regs[this._operand()];
-            var callee = frame.regs[this._operand()];
+            var receiver = regs[base + this._operand()];
+            var callee = regs[base + this._operand()];
             var argc = this._operand();
             var args = new Array(argc);
-            for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];
+            for (var i = 0; i < argc; i++) args[i] = regs[base + this._operand()];
             if (callee && callee[CLOSURE_SYM]) {
-              var c = callee[CLOSURE_SYM];
-              var f = new Frame(c, frame._pc, frame, receiver, dst);
-              for (var i = 0; i < args.length; i++) f.regs[i] = args[i];
-              f.regs[c.fn.paramCount] = args;
+              var closure = callee[CLOSURE_SYM];
+              var newBase = this._regsTop;
+              this._ensureRegisterWindow(newBase, closure.fn.regCount);
+              this._regsTop = newBase + closure.fn.regCount;
+              var f = new Frame(closure, frame._pc, frame, receiver, dst, newBase);
+              if (closure.fn.hasRest) {
+                var restSlot = closure.fn.paramCount - 1;
+                for (var i = 0; i < restSlot; i++) this._regs[newBase + i] = i < args.length ? args[i] : undefined;
+                this._regs[newBase + restSlot] = args.slice(restSlot);
+              } else {
+                for (var i = 0; i < args.length && i < closure.fn.regCount; i++) this._regs[newBase + i] = args[i];
+              }
+              if (closure.fn.paramCount < closure.fn.regCount) {
+                this._regs[newBase + closure.fn.paramCount] = args;
+              }
               this._frameStack.push(this._currentFrame);
               this._currentFrame = f;
             } else {
-              frame.regs[dst] = callee.apply(receiver, args);
+              regs[base + dst] = callee.apply(receiver, args);
             }
             break;
           }
@@ -531,54 +577,71 @@ VM.prototype.run = function () {
           {
             // dst, calleeReg, argc, [argReg...]
             var dst = this._operand();
-            var callee = frame.regs[this._operand()];
+            var callee = regs[base + this._operand()];
             var argc = this._operand();
             var args = new Array(argc);
-            for (var i = 0; i < argc; i++) args[i] = frame.regs[this._operand()];
+            for (var i = 0; i < argc; i++) args[i] = regs[base + this._operand()];
             if (callee && callee[CLOSURE_SYM]) {
-              var c = callee[CLOSURE_SYM];
-              var newObj = Object.create(c.prototype || null);
-              var f = new Frame(c, frame._pc, frame, newObj, dst);
+              var closure = callee[CLOSURE_SYM];
+              var newObj = Object.create(closure.prototype || null);
+              var newBase = this._regsTop;
+              this._ensureRegisterWindow(newBase, closure.fn.regCount);
+              this._regsTop = newBase + closure.fn.regCount;
+              var f = new Frame(closure, frame._pc, frame, newObj, dst, newBase);
+              if (closure.fn.hasRest) {
+                var restSlot = closure.fn.paramCount - 1;
+                for (var i = 0; i < restSlot; i++) this._regs[newBase + i] = i < args.length ? args[i] : undefined;
+                this._regs[newBase + restSlot] = args.slice(restSlot);
+              } else {
+                for (var i = 0; i < args.length && i < closure.fn.regCount; i++) this._regs[newBase + i] = args[i];
+              }
+              if (closure.fn.paramCount < closure.fn.regCount) {
+                this._regs[newBase + closure.fn.paramCount] = args;
+              }
               f._newObj = newObj;
-              for (var i = 0; i < args.length; i++) f.regs[i] = args[i];
-              f.regs[c.fn.paramCount] = args;
               this._frameStack.push(this._currentFrame);
               this._currentFrame = f;
             } else {
               // Reflect.construct is required - Object.create+apply does NOT set
               // internal slots ([[NumberData]], [[StringData]], etc.) for built-ins.
-              frame.regs[dst] = Reflect.construct(callee, args);
+              regs[base + dst] = Reflect.construct(callee, args);
             }
             break;
           }
         case OP.RETURN:
           {
-            var retVal = frame.regs[this._operand()];
+            var retVal = regs[base + this._operand()];
             this._closeUpvaluesFor(frame); // must happen before frame is abandoned
 
+            // Zero out callee's register window to limit exposing runtime values
+            var hi = frame._base + frame.closure.fn.regCount;
+            for (var i = frame._base; i < hi; i++) this._regs[i] = undefined;
+            this._regsTop = frame._base;
             if (this._frameStack.length === 0) return retVal; // main script returning
 
-            // new-call rule: primitive return -> discard, use the constructed object instead
+            // NewExpression: When invoking from the 'new' keyword, the newly constructed object is returned instead (if the original function doesn't return an object)
             if (frame._newObj !== null) {
               if (typeof retVal !== "object" || retVal === null) retVal = frame._newObj;
             }
             var parentFrame = this._frameStack.pop();
-            parentFrame.regs[frame._retDstReg] = retVal;
+            this._regs[parentFrame._base + frame._retDstReg] = retVal;
             this._currentFrame = parentFrame;
             break;
           }
         case OP.THROW:
-          throw frame.regs[this._operand()];
+          throw regs[base + this._operand()];
 
-        // ── Closures ──────────────────────────────────────────────────────────
+        // Closures
         case OP.MAKE_CLOSURE:
           {
-            // dst, startPc, paramCount, regCount, uvCount, [isLocal, idx, ...]
+            // dst, startPc, paramCount, regCount, uvCount, hasRest, [isLocal, idx, ...]
             var dst = this._operand();
             var startPc = this._operand();
             var paramCount = this._operand();
             var regCount = this._operand();
             var uvCount = this._operand();
+            var hasRest = this._operand(); // 1 if last param is a rest element
+
             var uvDescs = new Array(uvCount);
             for (var i = 0; i < uvCount; i++) {
               var isLocalRaw = this._operand();
@@ -592,7 +655,8 @@ VM.prototype.run = function () {
               paramCount: paramCount,
               regCount: regCount,
               startPc: startPc,
-              upvalueDescriptors: uvDescs
+              upvalueDescriptors: uvDescs,
+              hasRest: hasRest
             };
             var closure = new Closure(fn);
             for (var i = 0; i < uvDescs.length; i++) {
@@ -612,28 +676,36 @@ VM.prototype.run = function () {
               return function () {
                 var args = Array.prototype.slice.call(arguments);
                 var sub = new VM(self.bytecode, 0, c.fn.regCount, self.constants, self.globals);
-                var f = new Frame(c, null, null, this == null ? self.globals : this, 0);
-                for (var i = 0; i < args.length; i++) f.regs[i] = args[i];
-                f.regs[c.fn.paramCount] = args;
+                var f = new Frame(c, null, null, this == null ? self.globals : this, 0, 0);
                 sub._currentFrame = f;
+                if (c.fn.hasRest) {
+                  var restSlot = c.fn.paramCount - 1;
+                  for (var i = 0; i < restSlot; i++) sub._regs[i] = i < args.length ? args[i] : undefined;
+                  sub._regs[restSlot] = args.slice(restSlot);
+                } else {
+                  for (var i = 0; i < args.length && i < c.fn.regCount; i++) sub._regs[i] = args[i];
+                }
+                if (c.fn.paramCount < c.fn.regCount) {
+                  sub._regs[c.fn.paramCount] = args;
+                }
                 return sub.run();
               };
             }(closure);
             shell[CLOSURE_SYM] = closure;
             shell.prototype = closure.prototype; // unified prototype for new/instanceof
-            frame.regs[dst] = shell;
+            regs[base + dst] = shell;
             break;
           }
 
-        // ── Collections ───────────────────────────────────────────────────────
+        // Collections
         case OP.BUILD_ARRAY:
           {
             // dst, count, [elemReg...]
             var dst = this._operand();
             var count = this._operand();
             var elems = new Array(count);
-            for (var i = 0; i < count; i++) elems[i] = frame.regs[this._operand()];
-            frame.regs[dst] = elems;
+            for (var i = 0; i < count; i++) elems[i] = regs[base + this._operand()];
+            regs[base + dst] = elems;
             break;
           }
         case OP.BUILD_OBJECT:
@@ -643,21 +715,21 @@ VM.prototype.run = function () {
             var pairCount = this._operand();
             var o = {};
             for (var i = 0; i < pairCount; i++) {
-              var key = frame.regs[this._operand()];
-              var val = frame.regs[this._operand()];
+              var key = regs[base + this._operand()];
+              var val = regs[base + this._operand()];
               o[key] = val;
             }
-            frame.regs[dst] = o;
+            regs[base + dst] = o;
             break;
           }
 
-        // ── Property definitions (getters / setters) ──────────────────────────
+        // Object methods (getters / setters)
         case OP.DEFINE_GETTER:
           {
             // obj, key, fn
-            var obj = frame.regs[this._operand()];
-            var key = frame.regs[this._operand()];
-            var getterFn = frame.regs[this._operand()];
+            var obj = regs[base + this._operand()];
+            var key = regs[base + this._operand()];
+            var getterFn = regs[base + this._operand()];
             var existingDesc = Object.getOwnPropertyDescriptor(obj, key);
             var getDesc = {
               get: getterFn,
@@ -673,9 +745,9 @@ VM.prototype.run = function () {
         case OP.DEFINE_SETTER:
           {
             // obj, key, fn
-            var obj = frame.regs[this._operand()];
-            var key = frame.regs[this._operand()];
-            var setterFn = frame.regs[this._operand()];
+            var obj = regs[base + this._operand()];
+            var key = regs[base + this._operand()];
+            var setterFn = regs[base + this._operand()];
             var existingDesc = Object.getOwnPropertyDescriptor(obj, key);
             var setDesc = {
               set: setterFn,
@@ -694,7 +766,7 @@ VM.prototype.run = function () {
           {
             // dst, src — build iterator object from enumerable keys of regs[src]
             var dst = this._operand();
-            var obj = frame.regs[this._operand()];
+            var obj = regs[base + this._operand()];
             var keys = [];
             if (obj !== null && obj !== undefined) {
               var seen = Object.create(null);
@@ -714,7 +786,7 @@ VM.prototype.run = function () {
                 cur = Object.getPrototypeOf(cur);
               }
             }
-            frame.regs[dst] = {
+            regs[base + dst] = {
               _keys: keys,
               i: 0
             };
@@ -725,12 +797,12 @@ VM.prototype.run = function () {
             // dst, iterReg, exitTarget
             // Advances iterator; writes next key to dst, or jumps to exitTarget when done.
             var dst = this._operand();
-            var iter = frame.regs[this._operand()];
+            var iter = regs[base + this._operand()];
             var exitTarget = this._operand();
             if (iter.i >= iter._keys.length) {
               frame._pc = exitTarget;
             } else {
-              frame.regs[dst] = iter._keys[iter.i++];
+              regs[base + dst] = iter._keys[iter.i++];
             }
             break;
           }
@@ -753,7 +825,7 @@ VM.prototype.run = function () {
             break;
           }
 
-        // ── Self-modifying bytecode ───────────────────────────────────────────
+        // Self-modifying bytecode
         case OP.PATCH:
           {
             // destPc, sliceStart, sliceEnd
@@ -765,6 +837,12 @@ VM.prototype.run = function () {
             }
             break;
           }
+        case OP.JUMP_REG:
+          {
+            // Indirect jump: allows VM to jump based on runtime values.
+            frame._pc = regs[base + this._operand()];
+            break;
+          }
         case OP.DEBUGGER:
           {
             debugger;
@@ -774,9 +852,8 @@ VM.prototype.run = function () {
           throw new Error("Unknown opcode: " + op + " at pc " + (frame._pc - 1));
       }
     } catch (err) {
-      // Exception handler unwinding (CPython-style frame walk, Lua-style upvalue close).
-      // Walk from the current frame upward until we find a frame that has an open
-      // exception handler (TRY_SETUP without a matching TRY_END).
+      // Exception handler unwinding
+      // Walk from the current frame upward until we find a frame that has an open exception handler (TRY_SETUP without a matching TRY_END).
       // For every frame we abandon along the way, close its captured upvalues.
       var handledFrame = null;
       var searchFrame = this._currentFrame;
@@ -787,25 +864,27 @@ VM.prototype.run = function () {
         }
         // No handler in this frame — abandon it and walk up.
         this._closeUpvaluesFor(searchFrame);
+        this._regsTop = searchFrame._base;
         if (this._frameStack.length === 0) break;
         searchFrame = this._frameStack.pop();
         this._currentFrame = searchFrame;
       }
-      if (!handledFrame) throw err; // no handler anywhere — propagate to host
+      if (!handledFrame) throw err; // if there's no handler, propagate back to host
 
       var h = handledFrame._handlerStack.pop();
       // Discard any call-frames that were pushed inside the try body.
       this._frameStack.length = h.frameStackDepth;
       // Write the caught exception directly into the designated register.
-      handledFrame.regs[h.exceptionReg] = err;
+      this._regs[handledFrame._base + h.exceptionReg] = err;
       // Jump to the catch block.
       handledFrame._pc = h.handlerPc;
+      this._regsTop = handledFrame._base + handledFrame.closure.fn.regCount;
       this._currentFrame = handledFrame;
     }
   }
 };
 
-// Boot
+/* @BOOT */ // <- This comment can't be removed!
 var globals = {}; // global object for globals
 
 // Always pull built-ins from globalThis so eval() scoping can't shadow them