jz 0.3.1 → 0.5.0

package/module/typedarray.js

@@ -7,7 +7,7 @@
  * @module typed
  */
 
-import { typed, asF64, asI32, asI64, UNDEF_NAN, allocPtr, mkPtrIR, ptrOffsetIR, temp, tempI32, undefExpr } from '../src/ir.js'
+import { typed, asF64, asI32, asI64, toNumF64, UNDEF_NAN, allocPtr, mkPtrIR, ptrOffsetIR, temp, tempI32, tempI64, undefExpr, truthyIR } from '../src/ir.js'
 import { emit } from '../src/emit.js'
 import { valTypeOf, lookupValType, VAL } from '../src/analyze.js'
 import { inc, PTR } from '../src/ctx.js'
@@ -209,8 +209,11 @@ export default (ctx) => {
     __typed_set_idx: ['__ptr_aux', '__ptr_offset'],
   })
 
-  // .map/.filter invoke callbacks with arity 1 internally.
-  ctx.closure.floor = Math.max(ctx.closure.floor ?? 0, 1)
+  // .map invokes with arity 1; .forEach/.find/.some/.every/.filter/.findIndex
+  // invoke with (item, idx) → arity 2. Reduce with (acc, item) → arity 2.
+  // (jz omits the `arr` arg array-spec callbacks normally receive — matches
+  // array.js convention.)
+  ctx.closure.floor = Math.max(ctx.closure.floor ?? 0, 2)
 
   inc('__mkptr', '__alloc', '__len')
 
@@ -335,16 +338,61 @@ export default (ctx) => {
   // ArrayBuffer: first-class byte storage with [-8:byteLen][-4:byteCap][bytes].
   // DataView: passthrough ptr to the same BUFFER — DataView methods operate on raw bytes via offset.
 
-  // new ArrayBuffer(n) → allocate n bytes, return as BUFFER pointer
+  // ToIndex + allocation-ceiling for ArrayBuffer byte lengths: ToInteger (NaN→0,
+  // trunc toward zero), then a RangeError for negatives and for any size jz
+  // cannot represent as an i32 byte count. The ceiling sits just below 2^31 so
+  // the trunc never traps and leaves room for the 8-byte buffer header — this
+  // also rejects the spec's ≥2^53 case and genuinely un-allocatable sizes.
+  ctx.core.stdlib['__ab_len'] = `(func $__ab_len (param $n f64) (result i32)
+    (if (f64.ne (local.get $n) (local.get $n)) (then (local.set $n (f64.const 0))))
+    (local.set $n (f64.trunc (local.get $n)))
+    (if (i32.or
+          (f64.lt (local.get $n) (f64.const 0))
+          (f64.ge (local.get $n) (f64.const 2147483640)))
+      (then (throw $__jz_err (f64.const 0))))
+    (i32.trunc_f64_s (local.get $n)))`
+
+  // new ArrayBuffer(n) → allocate n bytes, return as BUFFER pointer.
+  // Length is ToNumber-coerced (ToIndex) so a Symbol length raises a TypeError;
+  // __ab_len then throws a RangeError on a negative or oversized request.
   const arrayBufferCtor = (sizeExpr) => {
-    const n = asI32(emit(sizeExpr))
+    ctx.runtime.throws = true
+    inc('__ab_len')
+    const n = typed(['call', '$__ab_len', toNumF64(sizeExpr, emit(sizeExpr))], 'i32')
     const out = allocPtr({ type: PTR.BUFFER, len: n, stride: 1, tag: 'ab' })
     return typed(['block', ['result', 'f64'], out.init, out.ptr], 'f64')
   }
   ctx.core.emit['new.ArrayBuffer'] = arrayBufferCtor
 
-  // new DataView(buffer) → same ptr (BUFFER). Its type tag may differ from BUFFER but methods ignore type.
-  ctx.core.emit['new.DataView'] = (bufExpr) => asF64(emit(bufExpr))
+  // new DataView(buffer, byteOffset?, byteLength?) — a first-class view object,
+  // represented exactly like a typed-array subview: a 16-byte descriptor
+  // [byteLen:i32][dataOff:i32][parentOff:i32][pad] behind a TYPED|view pointer.
+  // byteOffset/byteLength are ToIndex-coerced; the no-length form snapshots the
+  // remaining buffer (buffer.byteLength - byteOffset). Because the view extent
+  // lives in the descriptor, .byteLength/.byteOffset/.buffer and the get/set
+  // bounds checks all read it at runtime — correct regardless of how the
+  // receiver variable was assigned, and ArrayBuffer.isView(dv) is now true.
+  ctx.core.emit['new.DataView'] = (bufExpr, offExpr, lenExpr) => {
+    ctx.features.typedarray = true
+    const src = temp('dvs')
+    const parentOff = tempI32('dvp')
+    const off = tempI32('dvo')
+    const dst = tempI32('dvd')
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${src}`, asF64(emit(bufExpr))],
+      ['local.set', `$${parentOff}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${src}`]]]],
+      ['local.set', `$${off}`, offExpr == null ? ['i32.const', 0] : dvIndex(offExpr)],
+      ['local.set', `$${dst}`, ['call', '$__alloc', ['i32.const', 16]]],
+      ['i32.store', ['local.get', `$${dst}`],
+        lenExpr == null
+          ? ['i32.sub', ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${src}`]]], ['local.get', `$${off}`]]
+          : dvIndex(lenExpr)],
+      ['i32.store', ['i32.add', ['local.get', `$${dst}`], ['i32.const', 4]],
+        ['i32.add', ['local.get', `$${parentOff}`], ['local.get', `$${off}`]]],
+      ['i32.store', ['i32.add', ['local.get', `$${dst}`], ['i32.const', 8]],
+        ['local.get', `$${parentOff}`]],
+      mkPtrIR(PTR.TYPED, 8, ['local.get', `$${dst}`])], 'f64')
+  }
 
   // BigInt64Array(buffer) (bare form, legacy): coerce to same data, Float64Array-compatible storage.
   ctx.core.emit['BigInt64Array'] = (bufExpr) => {
@@ -353,13 +401,13 @@ export default (ctx) => {
     return mkPtrIR(PTR.TYPED, typedAux('BigInt64Array'), ['call', '$__ptr_offset', ['i64.reinterpret_f64', va]])
   }
 
-  // .buffer — always aliased (zero-copy). BUFFER/DataView: passthrough.
+  // .buffer — always aliased (zero-copy). BUFFER: passthrough.
   // Owned TYPED: retag as BUFFER at same offset — the byteLen header is shared.
-  // TYPED view: BUFFER at descriptor[8] (root parent data offset).
+  // TYPED view (incl. DataView): BUFFER at descriptor[8] (root parent data offset).
   ctx.core.emit['.buffer'] = (obj) => {
     if (typeof obj === 'string') {
       const ctor = ctx.types.typedElem?.get(obj)
-      if (ctor === 'new.ArrayBuffer' || ctor === 'new.DataView') return asF64(emit(obj))
+      if (ctor === 'new.ArrayBuffer') return asF64(emit(obj))
       if (ctor?.startsWith('new.')) {
         const isView = ctor.endsWith('.view')
         const name = isView ? ctor.slice(4, -5) : ctor.slice(4)
@@ -375,11 +423,12 @@ export default (ctx) => {
     return typed(['call', '$__to_buffer', asI64(emit(obj))], 'f64')
   }
 
-  // .byteLength — BUFFER: raw __len. Owned TYPED: elemCount * stride. View TYPED: descriptor[0].
+  // .byteLength — BUFFER: raw __len. Owned TYPED: elemCount * stride.
+  // View TYPED (incl. DataView): descriptor[0], via the __byte_length fallback.
   ctx.core.emit['.byteLength'] = (obj) => {
     if (typeof obj === 'string') {
       const ctor = ctx.types.typedElem?.get(obj)
-      if (ctor === 'new.ArrayBuffer' || ctor === 'new.DataView') {
+      if (ctor === 'new.ArrayBuffer') {
         return typed(['f64.convert_i32_s', ['call', '$__len', ['i64.reinterpret_f64', asF64(emit(obj))]]], 'f64')
       }
       if (ctor && ctor.startsWith('new.')) {
@@ -433,8 +482,9 @@ export default (ctx) => {
           (i32.load (i32.add (local.get $off) (i32.const 8)))))
       (else (i32.const 0))))`
 
-  // ArrayBuffer.isView(x) — true iff x is a TYPED pointer. (DataView passthrough cannot be
-  // distinguished from ArrayBuffer since both are BUFFER pointers; both report false.)
+  // ArrayBuffer.isView(x) — true iff x is a TYPED pointer. Typed arrays and
+  // DataViews are both TYPED-tagged (a DataView is a TYPED|view descriptor), so
+  // both report true; a bare ArrayBuffer is BUFFER-tagged and reports false.
   ctx.core.emit['ArrayBuffer.isView'] = (v) => {
     if (v === undefined) return typed(['f64.const', 0], 'f64')
     const va = asF64(emit(v))
@@ -442,6 +492,19 @@ export default (ctx) => {
       ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', va]], ['i32.const', PTR.TYPED]]], 'f64')
   }
 
+  // x instanceof Float64Array | Int32Array | … — typed-pointer predicate emitted
+  // by jzify. NaN-check first, then __ptr_type === PTR.TYPED. Aux-byte ctor
+  // discrimination (Float64 vs Int32) lives downstream in typedElem analysis —
+  // this predicate only asserts "is some TypedArray". Result i32 (boolean).
+  ctx.core.emit['__is_typed'] = (x) => {
+    if (x === undefined) return typed(['i32.const', 0], 'i32')
+    const v = asF64(emit(x))
+    const t = temp('ityp')
+    return typed(['i32.and',
+      ['f64.ne', ['local.tee', `$${t}`, v], ['local.get', `$${t}`]],
+      ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]], ['i32.const', PTR.TYPED]]], 'i32')
+  }
+
   // buf.slice(begin?, end?) on a BUFFER → fresh BUFFER with the byte range copied.
   // Only dispatches statically when obj is a tracked ArrayBuffer/DataView variable.
   ctx.core.emit['.buf:slice'] = (obj, beginExpr, endExpr) => {
@@ -470,44 +533,268 @@ export default (ctx) => {
       out.ptr], 'f64')
   }
 
-  // DataView set methods: extract i32 offset from f64 ptr, store value
+  // DataView endianness — wasm memory is natively little-endian. The DV `littleEndian`
+  // arg defaults to `false` per ECMA-262 (big-endian); when LE is false we have to
+  // byte-swap. `staticLE` peels a literal `[null, x]` AST node and returns:
+  //   true/false  — known endianness, no runtime branch needed
+  //   null        — dynamic, emit `if le (native) else (bswap)`
+  // We treat `undefined`/`null`/`0`/`''` as falsy (BE) per ToBoolean.
+  const staticLE = (node) => {
+    if (node === undefined) return false                              // arg omitted → BE
+    if (Array.isArray(node) && node[0] == null) {
+      // [] → undefined, [null, x] → literal x
+      if (node.length === 1) return false
+      const v = node[1]
+      if (v === undefined || v === null) return false
+      if (typeof v === 'boolean' || typeof v === 'number' || typeof v === 'string') return !!v
+    }
+    return null  // dynamic
+  }
+
+  // bswap16: i32 bytes [b0 b1] → [b1 b0]. Result is unsigned 16-bit; signed-16
+  // sign-extension is applied by the load op (i32.load16_s) at the call site.
+  const bswap16I32 = (v) => {
+    const t = tempI32('bs16')
+    return ['block', ['result', 'i32'],
+      ['local.set', `$${t}`, v],
+      ['i32.or',
+        ['i32.shl', ['i32.and', ['local.get', `$${t}`], ['i32.const', 0xff]], ['i32.const', 8]],
+        ['i32.and', ['i32.shr_u', ['local.get', `$${t}`], ['i32.const', 8]], ['i32.const', 0xff]]]]
+  }
+
+  // bswap32: i32 bytes [b0 b1 b2 b3] → [b3 b2 b1 b0]. Symmetric — used for both
+  // load (after native LE load) and store (before native LE store).
+  const bswap32I32 = (v) => {
+    const t = tempI32('bs32')
+    return ['block', ['result', 'i32'],
+      ['local.set', `$${t}`, v],
+      ['i32.or',
+        ['i32.or',
+          ['i32.shl', ['local.get', `$${t}`], ['i32.const', 24]],
+          ['i32.shl', ['i32.and', ['local.get', `$${t}`], ['i32.const', 0xff00]], ['i32.const', 8]]],
+        ['i32.or',
+          ['i32.and', ['i32.shr_u', ['local.get', `$${t}`], ['i32.const', 8]], ['i32.const', 0xff00]],
+          ['i32.and', ['i32.shr_u', ['local.get', `$${t}`], ['i32.const', 24]], ['i32.const', 0xff]]]]]
+  }
+
+  // bswap64: rotate bytes via two 32-bit halves. We need a runtime helper because
+  // i64 doesn't have inline byte-swap and we'd otherwise emit a 64-line tree.
+  ctx.core.stdlib['__bswap64'] = `(func $__bswap64 (param $v i64) (result i64)
+    (local $r i64)
+    (local.set $r (i64.shl (i64.and (local.get $v) (i64.const 0xff)) (i64.const 56)))
+    (local.set $r (i64.or (local.get $r) (i64.shl (i64.and (local.get $v) (i64.const 0xff00)) (i64.const 40))))
+    (local.set $r (i64.or (local.get $r) (i64.shl (i64.and (local.get $v) (i64.const 0xff0000)) (i64.const 24))))
+    (local.set $r (i64.or (local.get $r) (i64.shl (i64.and (local.get $v) (i64.const 0xff000000)) (i64.const 8))))
+    (local.set $r (i64.or (local.get $r) (i64.shr_u (i64.and (local.get $v) (i64.const 0xff00000000)) (i64.const 8))))
+    (local.set $r (i64.or (local.get $r) (i64.shr_u (i64.and (local.get $v) (i64.const 0xff0000000000)) (i64.const 24))))
+    (local.set $r (i64.or (local.get $r) (i64.shr_u (i64.and (local.get $v) (i64.const 0xff000000000000)) (i64.const 40))))
+    (local.set $r (i64.or (local.get $r) (i64.shr_u (local.get $v) (i64.const 56))))
+    (local.get $r))`
+  const bswap64I64 = (v) => { inc('__bswap64'); return ['call', '$__bswap64', v] }
+
+  // DV float reads return raw f64 bits, which may be non-canonical NaN (sign-flipped
+  // or with payload). jz's `__eq` fast path only treats canonical NaN (0x7FF8…0000)
+  // as NaN, so non-canonical NaN would break `v !== v` semantics. Canonicalize here
+  // (cheap: 4 wasm ops) so `getFloat32`/`getFloat64` return a real-spec NaN value.
+  ctx.core.stdlib['__canon_nan'] = `(func $__canon_nan (param $v f64) (result f64)
+    (select
+      (f64.reinterpret_i64 (i64.const 0x7FF8000000000000))
+      (local.get $v)
+      (f64.ne (local.get $v) (local.get $v))))`
+  const canonNaN = (vIR) => { inc('__canon_nan'); return typed(['call', '$__canon_nan', vIR], 'f64') }
+
+  // ToIndex for DataView byte offsets (spec 25.1.2.x getViewValue/setViewValue):
+  // ToIntegerOrInfinity then reject negatives and >2^53-1 with a RangeError. The
+  // throw rides jz's $__jz_err tag so a user `try/catch` (or assert.throws) sees it.
+  // trunc_sat keeps a huge-but-passing index from trapping the conversion — the
+  // subsequent memory access fails the same way an oversized index always has.
+  ctx.core.stdlib['__dv_index'] = `(func $__dv_index (param $idx f64) (result i32)
+    (if (f64.ne (local.get $idx) (local.get $idx)) (then (local.set $idx (f64.const 0))))
+    (local.set $idx (f64.trunc (local.get $idx)))
+    (if (i32.or
+          (f64.lt (local.get $idx) (f64.const 0))
+          (f64.gt (local.get $idx) (f64.const 9007199254740991)))
+      (then (throw $__jz_err (f64.const 0))))
+    (i32.trunc_sat_f64_s (local.get $idx)))`
+
+  // ToIndex the DV byte offset, throwing RangeError on a negative/oversized value.
+  // The offset is ToNumber-coerced first (per ToIndex) so a Symbol byte offset
+  // raises a TypeError instead of silently truncating to 0.
+  const dvIndex = (offNode) => {
+    ctx.runtime.throws = true
+    inc('__dv_index')
+    return typed(['call', '$__dv_index', toNumF64(offNode, emit(offNode))], 'i32')
+  }
+
+  // A DataView receiver resolves to its 16-byte descriptor pointer
+  // [byteLen:i32][dataOff:i32][parentOff:i32]. get/set hoist this once, then
+  // read dataOff (desc[4]) for the access address and byteLen (desc[0]) as the
+  // view size for the bounds check.
+  const dvDescriptor = (dv) => ptrOffsetIR(emit(dv), VAL.TYPED)
+  const dvDataOff = (descLocal) => ['i32.load', ['i32.add', ['local.get', `$${descLocal}`], ['i32.const', 4]]]
+  const dvViewSize = (descLocal) => ['i32.load', ['local.get', `$${descLocal}`]]
+
+  // ToIndex the DV byte offset, then bounds-check `getIndex + elementSize > viewSize`
+  // (spec 25.3.1.1 GetViewValue / SetViewValue step 13) — a RangeError when the
+  // access would run past the view. elementSize moves to the static side of the
+  // compare so a saturated/huge index can't overflow the i32 addition. viewSize is
+  // read live from the descriptor, so the check holds for every DataView receiver.
+  const dvIndexChecked = (offNode, size, viewSize) => {
+    ctx.runtime.throws = true
+    const idxT = tempI32('dvb')
+    return typed(['block', ['result', 'i32'],
+      ['local.set', `$${idxT}`, dvIndex(offNode)],
+      ['if', ['i32.gt_s', ['local.get', `$${idxT}`], ['i32.sub', viewSize, ['i32.const', size]]],
+        ['then', ['throw', '$__jz_err', ['f64.const', 0]]]],
+      ['local.get', `$${idxT}`]], 'i32')
+  }
+
+  // DataView set methods: extract i32 offset from f64 ptr, optionally byte-swap, store.
+  // 8-bit ops ignore the LE arg entirely (single byte — no swap possible).
   const DV_SET = {
-    setInt8: 'i32.store8', setUint8: 'i32.store8',
-    setInt16: 'i32.store16', setUint16: 'i32.store16',
-    setInt32: 'i32.store', setUint32: 'i32.store',
-    setFloat32: 'f32.store', setFloat64: 'f64.store',
-    setBigInt64: 'i64.store', setBigUint64: 'i64.store',
-  }
-  for (const [method, storeOp] of Object.entries(DV_SET)) {
-    ctx.core.emit[`.${method}`] = (dv, off, val, _le) => {
-      const dvOff = ptrOffsetIR(emit(dv), VAL.BUFFER)
-      const addr = ['i32.add', dvOff, asI32(emit(off))]
-      let v = emit(val)
-      if (method.includes('BigInt') || method.includes('BigUint'))
-        v = typed(['i64.reinterpret_f64', asF64(v)], 'i64')
-      else if (method.includes('Float64')) v = asF64(v)
-      else if (method.includes('Float32')) v = typed(['f32.demote_f64', asF64(v)], 'f32')
-      else v = asI32(v)
-      return [storeOp, addr, v]
+    setInt8: ['i32.store8', 'i32', 1],   setUint8: ['i32.store8', 'i32', 1],
+    setInt16: ['i32.store16', 'i32', 2], setUint16: ['i32.store16', 'i32', 2],
+    setInt32: ['i32.store', 'i32', 4],   setUint32: ['i32.store', 'i32', 4],
+    setFloat32: ['f32.store', 'f32', 4], setFloat64: ['f64.store', 'f64', 8],
+    setBigInt64: ['i64.store', 'i64', 8], setBigUint64: ['i64.store', 'i64', 8],
+  }
+  for (const [method, [storeOp, valType, size]] of Object.entries(DV_SET)) {
+    ctx.core.emit[`.${method}`] = (dv, off, val, leNode) => {
+      // Resolve the receiver's descriptor once; the store reads dataOff/byteLen from it.
+      const desc = tempI32('dvD')
+      const fin = (body) => ['block', ['local.set', `$${desc}`, dvDescriptor(dv)], body]
+      const addr = ['i32.add', dvDataOff(desc), dvIndexChecked(off, size, dvViewSize(desc))]
+      // Coerce value into the wasm value type the store op consumes. Non-BigInt
+      // stores ToNumber the value first (per SetViewValue) so a Symbol value
+      // raises a TypeError and a string value parses instead of truncating to 0.
+      let v
+      if (valType === 'i64') v = typed(['i64.reinterpret_f64', asF64(emit(val))], 'i64')
+      else if (valType === 'f64') v = asF64(toNumF64(val, emit(val)))
+      else if (valType === 'f32') v = typed(['f32.demote_f64', asF64(toNumF64(val, emit(val)))], 'f32')
+      else v = asI32(toNumF64(val, emit(val)))
+
+      if (size === 1) return fin([storeOp, addr, v])
+
+      // For BE we byte-swap the integer payload; floats route through bitcast i↔f.
+      const swap = (iVal) => size === 2 ? bswap16I32(iVal) : size === 4 ? bswap32I32(iVal) : bswap64I64(iVal)
+      const beStore = () => {
+        if (valType === 'f32') {
+          const swapped = typed(['f32.reinterpret_i32', swap(typed(['i32.reinterpret_f32', v], 'i32'))], 'f32')
+          return [storeOp, addr, swapped]
+        }
+        if (valType === 'f64') {
+          const swapped = typed(['f64.reinterpret_i64', bswap64I64(typed(['i64.reinterpret_f64', v], 'i64'))], 'f64')
+          return [storeOp, addr, swapped]
+        }
+        return [storeOp, addr, swap(v)]
+      }
+
+      const le = staticLE(leNode)
+      if (le === true) return fin([storeOp, addr, v])
+      if (le === false) return fin(beStore())
+      // Dynamic: hoist value + addr into temps so each branch can re-use.
+      const aT = tempI32('dvsa')
+      const vLoc = valType === 'i64' ? tempI64('dvsv') : valType === 'i32' ? tempI32('dvsv') : temp('dvsv')
+      // Re-declare with correct type for f32 (temp() defaults to f64).
+      if (valType === 'f32') ctx.func.locals.set(vLoc, 'f32')
+      const leT = tempI32('dvsle')
+      return fin(['block',
+        ['local.set', `$${aT}`, addr],
+        ['local.set', `$${vLoc}`, v],
+        ['local.set', `$${leT}`, truthyIR(emit(leNode))],
+        ['if',
+          ['local.get', `$${leT}`],
+          ['then', [storeOp, ['local.get', `$${aT}`], typed(['local.get', `$${vLoc}`], valType)]],
+          ['else', (() => {
+            const refV = typed(['local.get', `$${vLoc}`], valType)
+            if (valType === 'f32') return [storeOp, ['local.get', `$${aT}`], typed(['f32.reinterpret_i32', swap(typed(['i32.reinterpret_f32', refV], 'i32'))], 'f32')]
+            if (valType === 'f64') return [storeOp, ['local.get', `$${aT}`], typed(['f64.reinterpret_i64', bswap64I64(typed(['i64.reinterpret_f64', refV], 'i64'))], 'f64')]
+            return [storeOp, ['local.get', `$${aT}`], swap(refV)]
+          })()]]])
     }
   }
 
-  // DataView get methods: extract i32 offset, load value, return as f64
+  // DataView get methods: extract i32 offset, load value, optionally byte-swap, return as f64.
+  // 8-bit ops ignore the LE arg entirely (single byte).
   const DV_GET = {
-    getInt8: ['i32.load8_s', 'i32'], getUint8: ['i32.load8_u', 'i32'],
-    getInt16: ['i32.load16_s', 'i32'], getUint16: ['i32.load16_u', 'i32'],
-    getInt32: ['i32.load', 'i32'], getUint32: ['i32.load', 'i32'],
-    getFloat32: ['f32.load', 'f32'], getFloat64: ['f64.load', 'f64'],
-    getBigInt64: ['i64.load', 'i64'], getBigUint64: ['i64.load', 'i64'],
-  }
-  for (const [method, [loadOp, resultType]] of Object.entries(DV_GET)) {
-    ctx.core.emit[`.${method}`] = (dv, off, _le) => {
-      const addr = ['i32.add', ptrOffsetIR(emit(dv), VAL.BUFFER), asI32(emit(off))]
-      const raw = typed([loadOp, addr], resultType)
-      if (resultType === 'f64') return raw
-      if (resultType === 'f32') return typed(['f64.promote_f32', raw], 'f64')
-      if (resultType === 'i64') return typed(['f64.reinterpret_i64', raw], 'f64')
-      return typed(['f64.convert_i32_s', raw], 'f64')
+    getInt8: ['i32.load8_s', 'i32', 1, true],  getUint8: ['i32.load8_u', 'i32', 1, false],
+    getInt16: ['i32.load16_s', 'i32', 2, true], getUint16: ['i32.load16_u', 'i32', 2, false],
+    getInt32: ['i32.load', 'i32', 4, true],    getUint32: ['i32.load', 'i32', 4, false],
+    getFloat32: ['f32.load', 'f32', 4, false], getFloat64: ['f64.load', 'f64', 8, false],
+    getBigInt64: ['i64.load', 'i64', 8, true], getBigUint64: ['i64.load', 'i64', 8, false],
+  }
+  for (const [method, [loadOp, resultType, size, signed]] of Object.entries(DV_GET)) {
+    ctx.core.emit[`.${method}`] = (dv, off, leNode) => {
+      // Resolve the receiver's descriptor once; the load reads dataOff/byteLen from it.
+      const desc = tempI32('dvD')
+      const fin = (body) => typed(['block', ['result', 'f64'],
+        ['local.set', `$${desc}`, dvDescriptor(dv)], asF64(body)], 'f64')
+      const addr = ['i32.add', dvDataOff(desc), dvIndexChecked(off, size, dvViewSize(desc))]
+
+      // Convert a wasm-typed raw value back into the f64 ABI return. Float reads
+      // canonicalize NaN (see __canon_nan) so downstream `v !== v` works.
+      const toF64 = (raw) => {
+        if (resultType === 'f64') return canonNaN(raw)
+        if (resultType === 'f32') return canonNaN(typed(['f64.promote_f32', raw], 'f64'))
+        if (resultType === 'i64') return typed(['f64.reinterpret_i64', raw], 'f64')
+        return typed(signed ? ['f64.convert_i32_s', raw] : ['f64.convert_i32_u', raw], 'f64')
+      }
+
+      if (size === 1) return fin(toF64(typed([loadOp, addr], resultType)))
+
+      // LE path: native wasm load is already little-endian.
+      // BE path: load as raw int (always little-endian on wasm), byte-swap, then
+      //          reinterpret to the requested type so sign-extension matches.
+      // For unsigned 16-bit, bswap16 only spans the low half — no extra masking needed.
+      // For signed 16-bit BE, swap then sign-extend via `i32.extend16_s`.
+      const beLoad = () => {
+        if (size === 2) {
+          const rawU = bswap16I32(typed(['i32.load16_u', addr], 'i32'))
+          return toF64(typed(signed ? ['i32.extend16_s', rawU] : rawU, 'i32'))
+        }
+        if (size === 4) {
+          if (resultType === 'f32') {
+            return toF64(typed(['f32.reinterpret_i32', bswap32I32(typed(['i32.load', addr], 'i32'))], 'f32'))
+          }
+          return toF64(typed(bswap32I32(typed(['i32.load', addr], 'i32')), 'i32'))
+        }
+        // size === 8 (f64 or i64).
+        if (resultType === 'f64') {
+          return toF64(typed(['f64.reinterpret_i64', bswap64I64(typed(['i64.load', addr], 'i64'))], 'f64'))
+        }
+        return typed(['f64.reinterpret_i64', bswap64I64(typed(['i64.load', addr], 'i64'))], 'f64')
+      }
+
+      const le = staticLE(leNode)
+      if (le === true) return fin(toF64(typed([loadOp, addr], resultType)))
+      if (le === false) return fin(beLoad())
+      // Dynamic LE: hoist addr, branch on leNode at runtime.
+      const aT = tempI32('dvga')
+      const leT = tempI32('dvgle')
+      return fin(typed(['block', ['result', 'f64'],
+        ['local.set', `$${aT}`, addr],
+        ['local.set', `$${leT}`, truthyIR(emit(leNode))],
+        ['if', ['result', 'f64'],
+          ['local.get', `$${leT}`],
+          ['then', asF64(toF64(typed([loadOp, ['local.get', `$${aT}`]], resultType)))],
+          ['else', asF64((() => {
+            // Replicate beLoad but using hoisted addr.
+            const a = ['local.get', `$${aT}`]
+            if (size === 2) {
+              const rawU = bswap16I32(typed(['i32.load16_u', a], 'i32'))
+              return toF64(typed(signed ? ['i32.extend16_s', rawU] : rawU, 'i32'))
+            }
+            if (size === 4) {
+              if (resultType === 'f32') {
+                return toF64(typed(['f32.reinterpret_i32', bswap32I32(typed(['i32.load', a], 'i32'))], 'f32'))
+              }
+              return toF64(typed(bswap32I32(typed(['i32.load', a], 'i32')), 'i32'))
+            }
+            if (resultType === 'f64') {
+              return toF64(typed(['f64.reinterpret_i64', bswap64I64(typed(['i64.load', a], 'i64'))], 'f64'))
+            }
+            return typed(['f64.reinterpret_i64', bswap64I64(typed(['i64.load', a], 'i64'))], 'f64')
+          })())]]], 'f64'))
     }
   }
 
@@ -550,13 +837,27 @@ export default (ctx) => {
 
   // .length handled by ptr.js's __len (reads from memory header [-8:len])
 
-  /** Resolve element type + view-ness for a known TypedArray variable.
-   *  Returns { et, isView, isBigInt } or null. */
+  /** Resolve element type + view-ness for a known TypedArray expression.
+   *  Returns { et, isView, isBigInt } or null. Handles:
+   *    - bare binding: `xs` (in typedElem)
+   *    - element-preserving method chain: `xs.filter(...)` / `xs.map(...)` /
+   *      `xs.slice(...)` — walks back to the root binding. View-ness clears
+   *      at the chain output (the result is always an owned typed array). */
+  const TYPED_CHAIN_METHODS = new Set(['map', 'filter', 'slice'])
   const resolveElem = (arr) => {
-    const ctor = typeof arr === 'string' && ctx.types.typedElem?.get(arr)
+    let receiver = arr, chainOutput = false
+    // Walk method-call chain inward. `arr.method(...)` parses as
+    // ['()', ['.', recv, 'method'], ...args] — peel until we hit a name.
+    while (Array.isArray(receiver) && receiver[0] === '()' &&
+        Array.isArray(receiver[1]) && receiver[1][0] === '.' &&
+        TYPED_CHAIN_METHODS.has(receiver[1][2])) {
+      receiver = receiver[1][1]
+      chainOutput = true
+    }
+    const ctor = typeof receiver === 'string' && ctx.types.typedElem?.get(receiver)
     if (!ctor) return null
-    const isView = ctor.endsWith('.view')
-    const name = isView ? ctor.slice(4, -5) : ctor.slice(4)
+    const isView = !chainOutput && ctor.endsWith('.view')
+    const name = ctor.endsWith('.view') ? ctor.slice(4, -5) : ctor.slice(4)
     const et = ELEM[name]
     return et == null ? null : { et, isView, isBigInt: name === 'BigInt64Array' || name === 'BigUint64Array' }
   }
@@ -782,11 +1083,22 @@ export default (ctx) => {
 
   // .map() on TypedArrays — SIMD auto-vectorization when pattern detected
   ctx.core.emit['.typed:map'] = (arr, fn) => {
-    // Resolve element type + view-ness from variable tracking
-    const ctor = typeof arr === 'string' && ctx.types.typedElem?.get(arr)
-    const isView = ctor?.endsWith('.view')
-    const elemName = isView ? ctor.slice(4, -5) : ctor?.slice(4)
-    const elemType = elemName && ELEM[elemName]
+    // Resolve element type + view-ness. `resolveElem` handles bare bindings AND
+    // chained method receivers (`xs.filter(…).map(…)`) by walking back to the
+    // root typedElem-tracked binding.
+    const r = resolveElem(arr)
+    const elemType = r?.et
+    const isView = r?.isView
+    const elemName = r && (r.isBigInt
+      ? (elemType === 7 ? 'BigInt64Array' : 'BigUint64Array')  // unreachable: SIMD path gated below
+      : ['Int8Array','Uint8Array','Int16Array','Uint16Array','Int32Array','Uint32Array','Float32Array','Float64Array'][elemType])
+
+    // BigInt typed arrays: SIMD path doesn't support them; defer to scalar map.
+    if (r?.isBigInt) {
+      // Fall through to generic .map below — keeps i64-via-NaN-box semantics intact.
+      if (ctx.core.emit['.map']) return ctx.core.emit['.map'](arr, fn)
+      return null
+    }
 
     // Try SIMD: inline arrow with recognizable pattern
     if (elemType != null && Array.isArray(fn) && fn[0] === '=>') {
@@ -846,4 +1158,309 @@ export default (ctx) => {
     if (ctx.core.emit['.map']) return ctx.core.emit['.map'](arr, fn)
     return null
   }
+
+  // === Shared typed iteration core ===
+  //
+  // typedLoop(arr, bodyFn, opts?) emits the common shape every typed iteration
+  // method needs: resolve elemType from the receiver's tracked ctor, set up
+  // (ptr, len, i) locals, walk i in [0, len), per iteration load arr[i] as f64
+  // and pass it to bodyFn. Returns the IR setup statements. Returns null if the
+  // element type can't be resolved — callers fall back to the generic array
+  // emitter.
+  //
+  // bodyFn(loadElem, i, len, ptr, exitLabel) returns IR statements. loadElem is
+  // a function (called lazily so it isn't materialized for unused-item paths)
+  // returning f64 IR for the current element. `exitLabel` lets the body break
+  // out of the loop (e.g. `.find` after a hit, `.some`/`.every` on early
+  // resolution). `i`/`len`/`ptr` are i32 local-name strings.
+  const typedLoop = (arr, bodyFn) => {
+    const r = resolveElem(arr)
+    if (!r) return null
+    const { et, isView, isBigInt } = r
+    if (isBigInt) return null  // BigInt: defer to generic .map (returns BigInts via f64-bits NaN-box)
+    const va = emit(arr)
+    const len = tempI32('tll'), ptr = tempI32('tlp'), i = tempI32('tli')
+    const id = ctx.func.uniq++
+    const exit = `$brk${id}`
+    inc('__len')
+    const loadElem = () => {
+      const off = ['i32.add', ['local.get', `$${ptr}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', SHIFT[et]]]]
+      if (et === 7) return typed(['f64.load', off], 'f64')
+      if (et === 6) return typed(['f64.promote_f32', ['f32.load', off]], 'f64')
+      return typed([(et & 1) ? 'f64.convert_i32_u' : 'f64.convert_i32_s', [LOAD[et], off]], 'f64')
+    }
+    const setup = [
+      ['local.set', `$${ptr}`, typedDataAddr(asF64(va), isView)],
+      ['local.set', `$${len}`, ['call', '$__len', ['i64.reinterpret_f64', asF64(va)]]],
+      ['local.set', `$${i}`, ['i32.const', 0]],
+      ['block', exit, ['loop', `$loop${id}`,
+        ['br_if', exit, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${len}`]]],
+        ...bodyFn(loadElem, i, len, ptr, exit),
+        ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
+        ['br', `$loop${id}`]]]]
+    return { setup, ptr, len, i, exit, et, isView, loadElem }
+  }
+
+  // === Typed iteration emitters ===
+  //
+  // Each emitter dispatches via the `.typed:method` key on `ctx.core.emit`.
+  // emit.js:2211 picks `.typed:<m>` over `.${m}` when the receiver's val type
+  // is VAL.TYPED ('typed'), so a user-visible `arr.forEach(...)` on a tracked
+  // typed-array binding routes here automatically.
+  //
+  // Calling convention: callbacks receive (item, idx) — matches array.js
+  // (omits the `arr` arg that array-method spec passes; jz keeps the closure
+  // ABI width at 2 to spare a slot across the whole program). Reduce passes
+  // (acc, item). Closure invocation goes through `ctx.closure.call` directly.
+  // The element-type-name list is needed by allocPtr for typedAux:
+  const ET_NAME = ['Int8Array','Uint8Array','Int16Array','Uint16Array','Int32Array','Uint32Array','Float32Array','Float64Array']
+
+  // .forEach: callback (item, idx). Result is 0 to match array.js's
+  // convention (spec says undefined; both modules pick 0 since f() exposes the
+  // result as f64 and NaN-boxed undef reads as NaN).
+  // Pre-allocate locals BEFORE typedLoop — bodyFn captures `cbLoc` by closure;
+  // TDZ would fire if we declared it after.
+  ctx.core.emit['.typed:forEach'] = (arr, fn) => {
+    const cbLoc = temp('tfc')
+    const loop = typedLoop(arr, (load, i) => [
+      ['drop', asF64(ctx.closure.call(
+        typed(['local.get', `$${cbLoc}`], 'f64'),
+        [load(), typed(['f64.convert_i32_s', ['local.get', `$${i}`]], 'f64')]))]
+    ])
+    if (!loop) return null
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${cbLoc}`, asF64(emit(fn))],
+      ...loop.setup,
+      ['f64.const', 0]], 'f64')
+  }
+
+  // .reduce: callback (acc, item) → acc. Without init, slot 0 seeds acc and
+  // the callback skips on iteration 0. Matches JS semantics; the (idx, arr)
+  // callback args are dropped (consistent with array.js).
+  ctx.core.emit['.typed:reduce'] = (arr, fn, init) => {
+    const cbLoc = temp('trc'), acc = temp('trv'), seeded = init !== undefined
+    const loop = typedLoop(arr, (load, i) => {
+      const step = ['local.set', `$${acc}`, asF64(ctx.closure.call(
+        typed(['local.get', `$${cbLoc}`], 'f64'),
+        [typed(['local.get', `$${acc}`], 'f64'), load()]))]
+      if (seeded) return [step]
+      // Unseeded: iteration 0 just stashes the value into acc.
+      return [
+        ['if', ['i32.eqz', ['local.get', `$${i}`]],
+          ['then', ['local.set', `$${acc}`, load()]],
+          ['else', step]]]
+    })
+    if (!loop) return null
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${cbLoc}`, asF64(emit(fn))],
+      ['local.set', `$${acc}`, seeded ? asF64(emit(init)) : undefExpr()],
+      ...loop.setup,
+      ['local.get', `$${acc}`]], 'f64')
+  }
+
+  // .indexOf: scalar value-equality search. Returns -1 on miss. Compare on f64
+  // — Array.prototype.indexOf uses strict equality (NaN ≠ NaN).
+  ctx.core.emit['.typed:indexOf'] = (arr, val) => {
+    const found = tempI32('tif'), needle = temp('tin')
+    const loop = typedLoop(arr, (load, i, _len, _ptr, exit) => [
+      ['if', ['f64.eq', load(), ['local.get', `$${needle}`]],
+        ['then',
+          ['local.set', `$${found}`, ['local.get', `$${i}`]],
+          ['br', exit]]]
+    ])
+    if (!loop) return null
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${needle}`, asF64(emit(val))],
+      ['local.set', `$${found}`, ['i32.const', -1]],
+      ...loop.setup,
+      ['f64.convert_i32_s', ['local.get', `$${found}`]]], 'f64')
+  }
+
+  // .includes: like indexOf but NaN-equal-NaN (JS spec). Stash needle bits as
+  // i64 and compare via i64.eq so two NaNs with matching bit patterns match
+  // (f64.eq would say false).
+  ctx.core.emit['.typed:includes'] = (arr, val) => {
+    const found = tempI32('thf'), needle = temp('thn')
+    const loop = typedLoop(arr, (load, _i, _len, _ptr, exit) => [
+      ['if',
+        ['i32.or',
+          ['f64.eq', load(), ['local.get', `$${needle}`]],
+          ['i64.eq',
+            ['i64.reinterpret_f64', load()],
+            ['i64.reinterpret_f64', ['local.get', `$${needle}`]]]],
+        ['then', ['local.set', `$${found}`, ['i32.const', 1]], ['br', exit]]]
+    ])
+    if (!loop) return null
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${needle}`, asF64(emit(val))],
+      ['local.set', `$${found}`, ['i32.const', 0]],
+      ...loop.setup,
+      ['f64.convert_i32_s', ['local.get', `$${found}`]]], 'f64')
+  }
+
+  // .find / .findIndex: linear scan, first truthy callback wins. Miss returns
+  // undefined / -1 respectively.
+  const findCommon = (arr, fn, returnIndex) => {
+    const cbLoc = temp('tfc'), result = temp('tfr'), foundIdx = tempI32('tfi')
+    const loop = typedLoop(arr, (load, i, _len, _ptr, exit) => {
+      const itemLoc = temp('tfit')
+      return [
+        ['local.set', `$${itemLoc}`, load()],
+        ['if', truthyIR(ctx.closure.call(
+          typed(['local.get', `$${cbLoc}`], 'f64'),
+          [typed(['local.get', `$${itemLoc}`], 'f64'),
+           typed(['f64.convert_i32_s', ['local.get', `$${i}`]], 'f64')])),
+          ['then',
+            returnIndex
+              ? ['local.set', `$${foundIdx}`, ['local.get', `$${i}`]]
+              : ['local.set', `$${result}`, typed(['local.get', `$${itemLoc}`], 'f64')],
+            ['br', exit]]]
+      ]
+    })
+    if (!loop) return null
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${cbLoc}`, asF64(emit(fn))],
+      returnIndex
+        ? ['local.set', `$${foundIdx}`, ['i32.const', -1]]
+        : ['local.set', `$${result}`, undefExpr()],
+      ...loop.setup,
+      returnIndex
+        ? typed(['f64.convert_i32_s', ['local.get', `$${foundIdx}`]], 'f64')
+        : typed(['local.get', `$${result}`], 'f64')], 'f64')
+  }
+  ctx.core.emit['.typed:find'] = (arr, fn) => findCommon(arr, fn, false)
+  ctx.core.emit['.typed:findIndex'] = (arr, fn) => findCommon(arr, fn, true)
+
+  // .some / .every: short-circuit boolean reduction. some=∃, every=∀.
+  const anyAllCommon = (arr, fn, isEvery) => {
+    const cbLoc = temp('tac'), result = tempI32('tar')
+    const loop = typedLoop(arr, (load, i, _len, _ptr, exit) => {
+      const test = truthyIR(ctx.closure.call(
+        typed(['local.get', `$${cbLoc}`], 'f64'),
+        [load(), typed(['f64.convert_i32_s', ['local.get', `$${i}`]], 'f64')]))
+      // every: exit on falsy with result=0. some: exit on truthy with result=1.
+      return [
+        ['if', isEvery ? ['i32.eqz', test] : test,
+          ['then', ['local.set', `$${result}`, ['i32.const', isEvery ? 0 : 1]], ['br', exit]]]
+      ]
+    })
+    if (!loop) return null
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${cbLoc}`, asF64(emit(fn))],
+      ['local.set', `$${result}`, ['i32.const', isEvery ? 1 : 0]],
+      ...loop.setup,
+      ['f64.convert_i32_s', ['local.get', `$${result}`]]], 'f64')
+  }
+  ctx.core.emit['.typed:some'] = (arr, fn) => anyAllCommon(arr, fn, false)
+  ctx.core.emit['.typed:every'] = (arr, fn) => anyAllCommon(arr, fn, true)
+
+  // .filter: produces a TYPED array of the same element type. Allocates worst-
+  // case (len slots) then patches the byte-count header at the end with the
+  // actual passed count. Mirrors .filter in array.js but with typed-aware
+  // load/store.
+  ctx.core.emit['.typed:filter'] = (arr, fn) => {
+    const r = resolveElem(arr)
+    if (!r || r.isBigInt) return null
+    const { et, isView } = r
+    const cbLoc = temp('tfc'), arrLoc = temp('tfa')
+    const count = tempI32('tfn'), maxLen = tempI32('tfm')
+    const srcPtr = tempI32('tfsp'), srcLen = tempI32('tfsl'), srci = tempI32('tfi')
+    inc('__len')
+    const loadAt = (ptrLoc, iLoc) => {
+      const off = ['i32.add', ['local.get', `$${ptrLoc}`], ['i32.shl', ['local.get', `$${iLoc}`], ['i32.const', SHIFT[et]]]]
+      if (et === 7) return typed(['f64.load', off], 'f64')
+      if (et === 6) return typed(['f64.promote_f32', ['f32.load', off]], 'f64')
+      return typed([(et & 1) ? 'f64.convert_i32_u' : 'f64.convert_i32_s', [LOAD[et], off]], 'f64')
+    }
+    const storeAt = (ptrLoc, iLoc, valF64) => {
+      const off = ['i32.add', ['local.get', `$${ptrLoc}`], ['i32.shl', ['local.get', `$${iLoc}`], ['i32.const', SHIFT[et]]]]
+      if (et === 7) return ['f64.store', off, valF64]
+      if (et === 6) return ['f32.store', off, ['f32.demote_f64', valF64]]
+      return [STORE[et], off, [(et & 1) ? 'i32.trunc_f64_u' : 'i32.trunc_f64_s', valF64]]
+    }
+    const dst = allocPtr({ type: PTR.TYPED, aux: typedAux(ET_NAME[et]),
+      len: ['i32.shl', ['local.get', `$${maxLen}`], ['i32.const', SHIFT[et]]],
+      stride: 1, tag: 'tfd' })
+    const id = ctx.func.uniq++
+    const passes = truthyIR(ctx.closure.call(
+      typed(['local.get', `$${cbLoc}`], 'f64'),
+      [loadAt(srcPtr, srci), typed(['f64.convert_i32_s', ['local.get', `$${srci}`]], 'f64')]))
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${cbLoc}`, asF64(emit(fn))],
+      ['local.set', `$${arrLoc}`, asF64(emit(arr))],
+      ['local.set', `$${srcPtr}`, typedDataAddr(typed(['local.get', `$${arrLoc}`], 'f64'), isView)],
+      ['local.set', `$${srcLen}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${arrLoc}`]]]],
+      ['local.set', `$${maxLen}`, ['local.get', `$${srcLen}`]],
+      dst.init,
+      ['local.set', `$${count}`, ['i32.const', 0]],
+      ['local.set', `$${srci}`, ['i32.const', 0]],
+      ['block', `$brk${id}`, ['loop', `$loop${id}`,
+        ['br_if', `$brk${id}`, ['i32.ge_s', ['local.get', `$${srci}`], ['local.get', `$${srcLen}`]]],
+        ['if', passes,
+          ['then',
+            storeAt(dst.local, count, loadAt(srcPtr, srci)),
+            ['local.set', `$${count}`, ['i32.add', ['local.get', `$${count}`], ['i32.const', 1]]]]],
+        ['local.set', `$${srci}`, ['i32.add', ['local.get', `$${srci}`], ['i32.const', 1]]],
+        ['br', `$loop${id}`]]],
+      // Patch byte-count header — __len reads from -8 then __typed_shift's by
+      // the typed-elem stride, so we store `count * stride` bytes here.
+      ['i32.store', ['i32.sub', ['local.get', `$${dst.local}`], ['i32.const', 8]],
+        ['i32.shl', ['local.get', `$${count}`], ['i32.const', SHIFT[et]]]],
+      dst.ptr], 'f64')
+  }
+
+  // .slice(start, end): produces TYPED array of same element type. Mirrors JS
+  // semantics — negative indices wrap from end, out-of-range clamps to len.
+  // Bulk copy via `memory.copy`.
+  ctx.core.emit['.typed:slice'] = (arr, start, end) => {
+    const r = resolveElem(arr)
+    if (!r || r.isBigInt) return null
+    const { et, isView } = r
+    const arrLoc = temp('tsa'), srcPtr = tempI32('tssp'), srcLen = tempI32('tssl')
+    const lo = tempI32('tslo'), hi = tempI32('tshi'), n = tempI32('tsn')
+    inc('__len')
+    // ECMAScript ToInteger + clamp: idx := bound; idx := idx<0 ? max(0,idx+len) : min(len,idx).
+    // Select-based to dodge nested if-arity rules.
+    // defaultExpr: when boundExpr is omitted (e.g. arr.slice() / arr.slice(2)),
+    // start defaults to 0 and end defaults to len.
+    const clamp = (boundExpr, fallback, defaultExpr) => {
+      if (boundExpr == null) return defaultExpr
+      const idx = tempI32(fallback)
+      return ['block', ['result', 'i32'],
+        ['local.set', `$${idx}`, asI32(emit(boundExpr))],
+        ['select',
+          // negative branch: max(0, idx + len)
+          ['select',
+            ['i32.add', ['local.get', `$${idx}`], ['local.get', `$${srcLen}`]],
+            ['i32.const', 0],
+            ['i32.gt_s', ['i32.add', ['local.get', `$${idx}`], ['local.get', `$${srcLen}`]], ['i32.const', 0]]],
+          // non-negative branch: min(len, idx)
+          ['select',
+            ['local.get', `$${srcLen}`],
+            ['local.get', `$${idx}`],
+            ['i32.gt_s', ['local.get', `$${idx}`], ['local.get', `$${srcLen}`]]],
+          ['i32.lt_s', ['local.get', `$${idx}`], ['i32.const', 0]]]]
+    }
+    const dst = allocPtr({ type: PTR.TYPED, aux: typedAux(ET_NAME[et]),
+      len: ['i32.shl', ['local.get', `$${n}`], ['i32.const', SHIFT[et]]],
+      stride: 1, tag: 'tsd' })
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${arrLoc}`, asF64(emit(arr))],
+      ['local.set', `$${srcPtr}`, typedDataAddr(typed(['local.get', `$${arrLoc}`], 'f64'), isView)],
+      ['local.set', `$${srcLen}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${arrLoc}`]]]],
+      ['local.set', `$${lo}`, clamp(start, 'tslo2', ['i32.const', 0])],
+      ['local.set', `$${hi}`, clamp(end, 'tshi2', ['local.get', `$${srcLen}`])],
+      ['local.set', `$${n}`,
+        ['select',
+          ['i32.sub', ['local.get', `$${hi}`], ['local.get', `$${lo}`]],
+          ['i32.const', 0],
+          ['i32.gt_s', ['local.get', `$${hi}`], ['local.get', `$${lo}`]]]],
+      dst.init,
+      // memory.copy dst, src+lo*stride, n*stride
+      ['memory.copy',
+        ['local.get', `$${dst.local}`],
+        ['i32.add', ['local.get', `$${srcPtr}`], ['i32.shl', ['local.get', `$${lo}`], ['i32.const', SHIFT[et]]]],
+        ['i32.shl', ['local.get', `$${n}`], ['i32.const', SHIFT[et]]]],
+      dst.ptr], 'f64')
+  }
 }