jz 0.4.0 → 0.5.1

package/module/core.js

@@ -9,25 +9,17 @@
  * @module core
  */
 
-import { typed, asF64, asI32, asI64, NULL_NAN, UNDEF_NAN, temp, usesDynProps, ptrOffsetIR, isNullish } from '../src/ir.js'
-import { emit } from '../src/emit.js'
-import { valTypeOf, lookupValType, VAL, T, repOf, updateRep, shapeOf } from '../src/analyze.js'
-import { err, inc, PTR, LAYOUT } from '../src/ctx.js'
+import { typed, asF64, asI32, asI64, NULL_NAN, UNDEF_NAN, temp, usesDynProps, ptrOffsetIR, isNullish, valKindToPtr } from '../src/ir.js'
+import { emit, buildArrayWithSpreads } from '../src/emit.js'
+import { reconstructArgsWithSpreads } from '../src/ir.js'
+import { valTypeOf, lookupValType, lookupNotString, VAL, T, repOf, updateRep, shapeOf, inlineArraySid } from '../src/analyze.js'
+import { ctx, err, inc, PTR, LAYOUT } from '../src/ctx.js'
 import { initSchema } from './schema.js'
 import { strHashLiteral } from './collection.js'
 
 // Pre-shifted NaN prefix as a full i64 mask, for `(i64.const ${NAN_BITS})` use.
 const NAN_BITS = '0x' + LAYOUT.NAN_PREFIX_BITS.toString(16).toUpperCase().padStart(16, '0')
 
-const PTR_BY_VAL = {
-  [VAL.ARRAY]: PTR.ARRAY,
-  [VAL.OBJECT]: PTR.OBJECT,
-  [VAL.TYPED]: PTR.TYPED,
-  [VAL.SET]: PTR.SET,
-  [VAL.MAP]: PTR.MAP,
-  [VAL.CLOSURE]: PTR.CLOSURE,
-}
-
 export default (ctx) => {
   Object.assign(ctx.core.stdlibDeps, {
     __eq: ['__str_eq', '__ptr_type'],
@@ -54,7 +46,10 @@ export default (ctx) => {
     (local $fa f64) (local $fb f64) (local $ta i32) (local $tb i32)
     ;; Fast path: bit equality covers identical pointers AND interned/SSO strings (same content
     ;; → same bits). Failing universal-NaN test catches NaN===NaN→false. Saves the NaN-check
-    ;; pair (4 f64.eq) on the hottest case in watr (op === 'literal-string').
+    ;; pair (4 f64.eq) on the hottest case in watr (op === 'literal-string'). A number-NaN is
+    ;; *only ever* the canonical NAN_BITS here: math ops canonicalize at the source (the
+    ;; canon helper in module/math.js), so a non-canonical 0xFFF8.. pattern can only be a
+    ;; negative BigInt carrier — bit-identical to itself and correctly equal.
     (if (result i32) (i64.eq (local.get $a) (local.get $b))
       (then (i64.ne (local.get $a) (i64.const ${NAN_BITS})))
       (else
@@ -155,6 +150,19 @@ export default (ctx) => {
   ctx.core.stdlib['__ptr_type'] = `(func $__ptr_type (param $ptr i64) (result i32)
     (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))`
 
+  // True iff a NaN-boxed value is a non-primitive (heap object) — tag is neither
+  // ATOM (null/undefined/boolean/symbol) nor STRING. A genuine f64 Number is
+  // never NaN-boxed, so `f64.eq(x,x)` holding proves it a primitive. Drives the
+  // ES `OrdinaryToPrimitive` method-fallback chain (src/ir.js toPrimitiveChain).
+  ctx.core.stdlib['__is_object'] = `(func $__is_object (param $p i64) (result i32)
+    (local $t i32)
+    (if (f64.eq (f64.reinterpret_i64 (local.get $p)) (f64.reinterpret_i64 (local.get $p)))
+      (then (return (i32.const 0))))
+    (local.set $t (call $__ptr_type (local.get $p)))
+    (i32.and
+      (i32.ne (local.get $t) (i32.const ${PTR.ATOM}))
+      (i32.ne (local.get $t) (i32.const ${PTR.STRING}))))`
+
   // === Bump allocator ===
 
   // Heap-base watermark: gates header-backed propsPtr fast paths so static-data
@@ -162,18 +170,38 @@ export default (ctx) => {
   // Updated by optimizeModule() when data segment exceeds 1024 bytes.
   ctx.scope.globals.set('__heap_start', '(global $__heap_start (mut i32) (i32.const 1024))')
 
+  // Shared memory keeps the heap pointer in linear memory (memory[1020]):
+  // wasm globals are per-instance, so threads sharing one memory must share one
+  // pointer cell. Non-shared memory (incl. alloc:false) uses the `$__heap`
+  // global — exported so the JS-side adapter (memory.String etc) bumps the same
+  // pointer. Storing it in memory would collide with the static data section
+  // whenever the data exceeds 1020 bytes.
   if (ctx.memory.shared) {
-    // Shared memory: heap offset stored at memory[1020] (i32), just before heap start at 1024
+    // Heap offset stored at memory[1020] (i32), just before heap start at 1024.
+    // We still want to grow memory when running out of pages — without growth a
+    // host-run binary traps on the first allocation that exceeds the initial
+    // 64 KB. Use the same geometric-growth strategy as the owned-memory variant.
     ctx.core.stdlib['__alloc'] = `(func $__alloc (param $bytes i32) (result i32)
-      (local $ptr i32)
+      (local $ptr i32) (local $next i32) (local $cur i32) (local $need i32)
       (local.set $ptr (i32.load (i32.const 1020)))
-      (i32.store (i32.const 1020) (i32.and (i32.add (i32.add (local.get $ptr) (local.get $bytes)) (i32.const 7)) (i32.const -8)))
+      (local.set $next (i32.and (i32.add (i32.add (local.get $ptr) (local.get $bytes)) (i32.const 7)) (i32.const -8)))
+      (local.set $cur (i32.shl (memory.size) (i32.const 16)))
+      (if (i32.gt_u (local.get $next) (local.get $cur))
+        (then
+          (local.set $need (i32.shr_u (i32.add (i32.sub (local.get $next) (local.get $cur)) (i32.const 65535)) (i32.const 16)))
+          (if (i32.lt_u (local.get $need) (memory.size)) (then (local.set $need (memory.size))))
+          (if (i32.eq (memory.grow (local.get $need)) (i32.const -1))
+            (then (if (i32.eq (memory.grow
+              (i32.shr_u (i32.add (i32.sub (local.get $next) (local.get $cur)) (i32.const 65535)) (i32.const 16)))
+              (i32.const -1)) (then (unreachable)))))))
+      (i32.store (i32.const 1020) (local.get $next))
       (local.get $ptr))`
     ctx.core.stdlib['__clear'] = `(func $__clear
       (i32.store (i32.const 1020) (i32.const 1024)))`
   } else {
-    // Own memory: heap offset in a global, auto-grow when needed
-    ctx.scope.globals.set('__heap', '(global $__heap (mut i32) (i32.const 1024))')
+    // Own memory: heap offset in a global, auto-grow when needed. Exported so
+    // the JS-side adapter (alloc:false, no `_alloc` export) shares the pointer.
+    ctx.scope.globals.set('__heap', '(global $__heap (export "__heap") (mut i32) (i32.const 1024))')
     // Bump allocator with geometric growth. Growing one page at a time turns a
     // long-running embedding (e.g. watr called thousands of times) into O(n²) —
     // each memory.grow may relocate and copy the whole heap. So when we must
@@ -383,18 +411,39 @@ export default (ctx) => {
    *  ARRAY/SET/MAP share a single layout: length is i32 at offset-8. We inline that load
    *  directly instead of calling __len which re-dispatches on type. ptrOffsetIR handles
    *  ARRAY forwarding (non-ARRAY skips the forwarding loop). TYPED has a variable-width
-   *  layout depending on the aux typed-element shift, so it still routes through __len. */
-  function emitLengthAccess(va, vt) {
+   *  layout depending on the aux typed-element shift, so it still routes through __len.
+   *  `notString` (from rep.notString — write-shape evidence rules out primitive string)
+   *  routes the otherwise-unknown case through __len directly, eliding the STRING arm
+   *  of __length. __len returns 0 on tags it doesn't recognize, matching JS's
+   *  `undefined` semantics on non-pointer .length (the binding writes through xs[i]
+   *  / xs.length, so reaching .length with a non-pointer is unreachable in practice). */
+  function emitLengthAccess(va, vt, notString = false) {
+    // jsstring carrier: receiver is an externref slot (boundary param tagged
+    // `jsstring` by narrow.js phase J). Route to the `wasm:js-string` length
+    // builtin directly — no SSO unbox, zero copy.
+    if (va?.type === 'externref') {
+      ctx.core.jsstring.add('length')
+      return typed(['f64.convert_i32_s', ['call', '$__jss_length', va]], 'f64')
+    }
     if (vt === VAL.ARRAY || vt === VAL.SET || vt === VAL.MAP) {
       const off = ptrOffsetIR(va, vt)
       return typed(['f64.convert_i32_s', ['i32.load', ['i32.sub', off, ['i32.const', 8]]]], 'f64')
     }
     if (vt === VAL.TYPED)
       return typed(['f64.convert_i32_s', ['call', '$__len', ['i64.reinterpret_f64', va]]], 'f64')
-    // Known string → byteLen (handles SSO + heap)
+    // Known string → byteLen via the active string rep. Pass the slot
+    // carrier (f64 under nanbox-sso) — the rep op handles internal
+    // reinterpret/wrap. The `?.` call site passes a bare `['local.get', $t]`
+    // without a `.type` tag, so coerce defensively to f64.
     if (vt === VAL.STRING) {
-      inc('__str_byteLen')
-      return typed(['f64.convert_i32_s', ['call', '$__str_byteLen', ['i64.reinterpret_f64', va]]], 'f64')
+      const f64Va = va?.type === 'f64' ? va : typed(va, 'f64')
+      return typed(['f64.convert_i32_s', ctx.abi.string.ops.byteLen(f64Va, ctx)], 'f64')
+    }
+    // Unknown but proven not-string → __len directly (skips the STRING arm of __length).
+    if (notString) {
+      inc('__len')
+      ctx.features.typedarray = true
+      return typed(['f64.convert_i32_s', ['call', '$__len', ['i64.reinterpret_f64', va]]], 'f64')
     }
     // Unknown → runtime dispatch via stdlib. Set/Map dispatch arms are pulled
     // only when user code actually constructs Set/Map (collection.js sets the
@@ -412,7 +461,7 @@ export default (ctx) => {
   // (read on the AST `.prop` node), not via tagging this IR node.
   function emitSchemaSlotRead(baseExpr, idx) {
     const base = baseExpr?.type === 'f64' ? baseExpr : typed(baseExpr, 'f64')
-    return typed(['f64.load', ['i32.add', ptrOffsetIR(base, VAL.OBJECT), ['i32.const', idx * 8]]], 'f64')
+    return typed(ctx.abi.object.ops.load(ptrOffsetIR(base, VAL.OBJECT), idx), 'f64')
   }
 
   function emitHashGetLocalConst(base, key, prop) {
@@ -422,7 +471,7 @@ export default (ctx) => {
   }
 
   function emitTypeTag(receiver, vt) {
-    const p = PTR_BY_VAL[vt]
+    const p = valKindToPtr(vt)
     if (p != null) return ['i32.const', p]
     inc('__ptr_type')
     return ['call', '$__ptr_type', receiver]
@@ -440,9 +489,15 @@ export default (ctx) => {
     return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_expr_t', receiver, key, emitTypeTag(receiver, vt)]], 'f64')
   }
 
-  function emitDynGetAnyTyped(base, key, vt) {
-    inc('__dyn_get_any_t')
+  function emitDynGetAnyTyped(base, key, vt, prop) {
     const receiver = asI64(base?.type ? base : typed(base, 'f64'))
+    // Constant string key: fold the FNV hash at compile time and call the
+    // prehashed body — no __str_hash on every access (hot for `parse.step` etc).
+    if (typeof prop === 'string') {
+      inc('__dyn_get_any_t_h')
+      return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_any_t_h', receiver, key, emitTypeTag(receiver, vt), ['i32.const', strHashLiteral(prop)]]], 'f64')
+    }
+    inc('__dyn_get_any_t')
     return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_any_t', receiver, key, emitTypeTag(receiver, vt)]], 'f64')
   }
 
@@ -499,6 +554,15 @@ export default (ctx) => {
     // (`{...x}`) shift slot ordering and would need their own resolution.
     const slot = literalSlot(obj, prop)
     if (slot >= 0) return emitSchemaSlotRead(asF64(va), slot)
+    // Receiver IR is an unboxed OBJECT pointer carrying its own schema (a
+    // structInline element cell, a narrowed local): resolve the field's fixed
+    // slot directly from `ptrAux` — more precise than the structural
+    // `ctx.schema.find(null, …)` and never falls to the dyn dispatcher.
+    if (va?.ptrKind === VAL.OBJECT && va.ptrAux != null && typeof prop === 'string') {
+      const sch = ctx.schema.list[va.ptrAux]
+      const si = sch ? sch.indexOf(prop) : -1
+      if (si >= 0) return emitSchemaSlotRead(asF64(va), si)
+    }
     let schemaIdx = typeof obj === 'string' ? ctx.schema.find(obj, prop) : ctx.schema.find(null, prop)
     // Chain receiver (e.g. `o.meta.bias`): when the chain resolves to a known
     // OBJECT shape via JSON-shape propagation, the parent shape's `names`
@@ -506,7 +570,7 @@ export default (ctx) => {
     // ctx.schema.find(null, prop) when multiple registered schemas share a key.
     if (schemaIdx < 0 && typeof obj !== 'string') {
       const sh = shapeOf(obj)
-      if ((sh?.vt === VAL.OBJECT || sh?.vt === VAL.HASH) && sh.names) {
+      if ((sh?.val === VAL.OBJECT || sh?.val === VAL.HASH) && sh.names) {
         const i = sh.names.indexOf(prop)
         if (i >= 0) schemaIdx = i
       }
@@ -532,7 +596,7 @@ export default (ctx) => {
         // Skip the external branch and dispatch through the typed HASH/OBJECT path.
         if (ctx.transform.host === 'wasi') return emitDynGetExprTyped(va, key, vt, prop)
         ctx.features.external = true
-        return emitDynGetAnyTyped(va, key, vt)
+        return emitDynGetAnyTyped(va, key, vt, prop)
       }
       inc('__hash_get', '__str_hash', '__str_eq')
       return typed(['f64.reinterpret_i64', ['call', '$__hash_get', asI64(va), key]], 'f64')
@@ -585,6 +649,13 @@ export default (ctx) => {
   // === Property dispatch (.length, .prop) ===
 
   ctx.core.emit['.'] = (obj, prop) => {
+    // SRoA flat object: `o.prop` → `local.get $o#i` (analyze.js scanFlatObjects).
+    const flatR = typeof obj === 'string' ? ctx.func.flatObjects?.get(obj) : null
+    if (flatR) {
+      const fi = flatR.names.indexOf(prop)
+      if (fi >= 0) return typed(['local.get', `$${obj}#${fi}`], 'f64')
+    }
+
     // Boxed object: delegate .length and .prop to inner value or schema
     if (typeof obj === 'string' && ctx.schema.isBoxed(obj)) {
       if (prop === 'length') {
@@ -622,8 +693,59 @@ export default (ctx) => {
       if (Array.isArray(obj) && (obj[0] === 'str' || obj[0] == null) && typeof obj[1] === 'string') {
         return typed(['f64.const', Buffer.byteLength(obj[1], 'utf8')], 'f64')
       }
-      const vt = typeof obj === 'string' ? repOf(obj)?.val : valTypeOf(obj)
-      return emitLengthAccess(asF64(emit(obj)), vt)
+      // structInline Array<S>: the header `len` counts physical f64 cells (K
+      // per element), so the JS array length is `physicalLen / K`.
+      const inlSid = inlineArraySid(obj)
+      if (inlSid != null) {
+        const K = ctx.schema.list[inlSid].length
+        const physLen = ['i32.load', ['i32.sub', ptrOffsetIR(asF64(emit(obj)), VAL.ARRAY), ['i32.const', 8]]]
+        return typed(['f64.convert_i32_s', K > 1 ? ['i32.div_s', physLen, ['i32.const', K]] : physLen], 'f64')
+      }
+      const rep = typeof obj === 'string' ? repOf(obj) : null
+      const vt = rep ? rep.val : valTypeOf(obj)
+      const notString = vt == null && typeof obj === 'string' && lookupNotString(obj)
+      // jsstring carrier: keep the externref-typed IR so emitLengthAccess can
+      // dispatch to `wasm:js-string.length` instead of forcing through f64.
+      const recv = emit(obj)
+      if (recv?.type === 'externref') return emitLengthAccess(recv, vt, notString)
+      return emitLengthAccess(asF64(recv), vt, notString)
+    }
+
+    // Type-specific property emitter (`.regex:source`, …) — the property-read
+    // mirror of the `.vt:method` method-dispatch table. Property emitters take
+    // a single arg (the receiver); arity ≥ 2 entries are method emitters and
+    // must not be routed here (reading `re.test` as a value is not a call).
+    const ptRep = typeof obj === 'string' ? repOf(obj) : null
+    const ptVt = ptRep ? ptRep.val : valTypeOf(obj)
+    if (ptVt) {
+      const tpEmitter = ctx.core.emit[`.${ptVt}:${prop}`]
+      if (tpEmitter && tpEmitter.length <= 1) return tpEmitter(obj)
+    }
+
+    // valueOf/toString are ToPrimitive hooks (ES2024 7.1.1) that an own data
+    // property shadows. On a heap receiver carrying a dynamic-prop sidecar
+    // (array/typed/object), reading `obj.valueOf`/`obj.toString` must return an
+    // assigned override when present, else the inherited builtin. Without this,
+    // the arity-1 builtin emitter below (returns the receiver) masks the
+    // override. The method-call path in src/emit.js runs the parallel probe and
+    // additionally covers statically-unknown receivers (e.g. `arr[0].valueOf()`);
+    // a bare read of an unknown-type receiver can't yield a builtin-as-value
+    // here anyway, so this read path stays scoped to known sidecar types.
+    if ((prop === 'valueOf' || prop === 'toString') && ctx.closure.call &&
+        (ptVt === VAL.ARRAY || ptVt === VAL.TYPED || ptVt === VAL.OBJECT)) {
+      const builtin = ctx.core.emit[`.${ptVt}:${prop}`] || ctx.core.emit[`.${prop}`]
+      if (builtin && builtin.length <= 1) {
+        const o = temp('vo'), p = temp('vp')
+        inc('__dyn_get_expr', '__ptr_type')
+        return typed(['block', ['result', 'f64'],
+          ['local.set', `$${o}`, asF64(emit(obj))],
+          ['local.set', `$${p}`, ['f64.reinterpret_i64',
+            ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ['local.get', `$${o}`]], asI64(emit(['str', prop]))]]],
+          ['if', ['result', 'f64'],
+            ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${p}`]]], ['i32.const', PTR.CLOSURE]],
+            ['then', ['local.get', `$${p}`]],
+            ['else', asF64(builtin(o))]]], 'f64')
+      }
     }
 
     // Module-registered property emitter (.size, etc.)
@@ -634,77 +756,78 @@ export default (ctx) => {
     return emitPropAccess(emit(obj), obj, prop)
   }
 
-  // Optional chaining: obj?.prop → null if obj is null, else obj.prop
-  ctx.core.emit['?.'] = (obj, prop) => {
-    const t = temp()
-    const va = asF64(emit(obj))
-    const vt = typeof obj === 'string' ? repOf(obj)?.val : valTypeOf(obj)
-    let access
-    if (prop === 'length') {
-      access = emitLengthAccess(['local.get', `$${t}`], vt)
-    } else {
-      const propIdx = typeof obj === 'string' ? ctx.schema.find(obj, prop) : -1
-      if (propIdx >= 0) access = emitSchemaSlotRead(['local.get', `$${t}`], propIdx)
-      else {
-        if (typeof obj === 'string') {
-          const objType = lookupValType(obj)
-          if (usesDynProps(objType)) {
-            access = emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType, prop)
-          } else if (objType === VAL.HASH) {
-            access = emitHashGetLocalConst(['local.get', `$${t}`], asI64(emit(['str', prop])), prop)
-          } else if (objType == null) {
-            // Unknown receiver — in WASI mode use typed dispatch (no PTR.EXTERNAL values).
-            // In JS host mode use __dyn_get_any_t but don't force features.external here
-            // since ?.prop short-circuits on nullish (EXTERNAL arm is dead unless already on).
-            access = ctx.transform.host === 'wasi'
-              ? emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType, prop)
-              : emitDynGetAnyTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType)
-          } else {
-            inc('__hash_get', '__str_hash', '__str_eq')
-            access = ['f64.reinterpret_i64', ['call', '$__hash_get', ['i64.reinterpret_f64', ['local.get', `$${t}`]], asI64(emit(['str', prop]))]]
-          }
-        } else {
-          if (valTypeOf(obj) === VAL.HASH) {
-            access = emitHashGetLocalConst(['local.get', `$${t}`], asI64(emit(['str', prop])), prop)
-          } else {
-            access = emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), valTypeOf(obj), prop)
-          }
-        }
-      }
-    }
-    // Use local.set + local.get (not local.tee inside guard) because isNullish
-    // inlines the null/undefined check as (i32.or (i64.eq X NULL) (i64.eq X UNDEF)),
-    // which duplicates X — a local.tee(block(call $sideEffect)) would run twice.
-    return typed(['block', ['result', 'f64'],
+  // Optional-chain short-circuit: store the receiver/callee into temp `$t`
+  // once, evaluate `thenIR` when it is non-nullish, else yield `undefined`.
+  // local.set + local.get (never a local.tee feeding the guard) because
+  // notNullish inlines an isNullish check — (i32.or (i64.eq X NULL)
+  // (i64.eq X UNDEF)) — that duplicates its operand, so a tee'd
+  // side-effecting value would run twice.
+  const optionalGuard = (t, va, thenIR) =>
+    typed(['block', ['result', 'f64'],
       ['local.set', `$${t}`, va],
       ['if', ['result', 'f64'],
         notNullish(typed(['local.get', `$${t}`], 'f64')),
-        ['then', access],
+        ['then', thenIR],
         ['else', ['f64.const', `nan:${UNDEF_NAN}`]]]], 'f64')
+
+  // Receiver-evaluate-once: allocate a fresh hoist-temp `$t`, emit `value` into
+  // it, then call `useFn(t)` to build the consumer IR — wrapping both in an
+  // optionalGuard so the consumer runs only when `$t` is non-nullish. Used by
+  // `?.` / `?.[]` / `?.()` whose receiver is read twice (the nullish check and
+  // the dispatched access) but must evaluate once. Rep-seeding for the temp,
+  // when the receiver's value-type drives downstream dispatch, lives inside
+  // the useFn callback so it runs before the consumer IR consults reps.
+  const evalOnce = (value, useFn) => {
+    const t = temp()
+    const va = asF64(emit(value))
+    return optionalGuard(t, va, useFn(t))
   }
 
+  // Optional chaining: obj?.prop → null if obj is null, else obj.prop
+  ctx.core.emit['?.'] = (obj, prop) => evalOnce(obj, (t) => {
+    const rep = typeof obj === 'string' ? repOf(obj) : null
+    const vt = rep ? rep.val : valTypeOf(obj)
+    if (prop === 'length') {
+      const notString = vt == null && typeof obj === 'string' && lookupNotString(obj)
+      return emitLengthAccess(['local.get', `$${t}`], vt, notString)
+    }
+    const propIdx = typeof obj === 'string' ? ctx.schema.find(obj, prop) : -1
+    if (propIdx >= 0) return emitSchemaSlotRead(['local.get', `$${t}`], propIdx)
+    if (typeof obj === 'string') {
+      const objType = lookupValType(obj)
+      if (usesDynProps(objType))
+        return emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType, prop)
+      if (objType === VAL.HASH)
+        return emitHashGetLocalConst(['local.get', `$${t}`], asI64(emit(['str', prop])), prop)
+      if (objType == null)
+        // Unknown receiver — in WASI mode use typed dispatch (no PTR.EXTERNAL values).
+        // In JS host mode use __dyn_get_any_t but don't force features.external here
+        // since ?.prop short-circuits on nullish (EXTERNAL arm is dead unless already on).
+        return ctx.transform.host === 'wasi'
+          ? emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType, prop)
+          : emitDynGetAnyTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType, prop)
+      inc('__hash_get', '__str_hash', '__str_eq')
+      return ['f64.reinterpret_i64', ['call', '$__hash_get', ['i64.reinterpret_f64', ['local.get', `$${t}`]], asI64(emit(['str', prop]))]]
+    }
+    if (valTypeOf(obj) === VAL.HASH)
+      return emitHashGetLocalConst(['local.get', `$${t}`], asI64(emit(['str', prop])), prop)
+    return emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), valTypeOf(obj), prop)
+  })
+
   // Optional index: arr?.[i] → null if arr is null, else arr[i]
   // Cache base in temp, propagate valType so []'s type dispatch works
-  ctx.core.emit['?.[]'] = (arr, idx) => {
-    const t = temp()
-    const va = asF64(emit(arr))
+  ctx.core.emit['?.[]'] = (arr, idx) => evalOnce(arr, (t) => {
+    // Emit-time rep seed on fresh `?.[]` hoist-temp (lifecycle: analysis-vs-emit).
     // Propagate source type to temp so [] dispatch (string, typed, etc.) works
+    // when the inner `ctx.core.emit['[]'](t, idx)` re-enters dispatch.
     const srcType = typeof arr === 'string' ? repOf(arr)?.val : null
     if (srcType) updateRep(t, { val: srcType })
     if (typeof arr === 'string' && ctx.types.typedElem?.has(arr)) {
       if (!ctx.types.typedElem) ctx.types.typedElem = new Map()
       ctx.types.typedElem.set(t, ctx.types.typedElem.get(arr))
     }
-    // Use local.set + local.get (not local.tee inside guard) because isNullish
-    // inlines the null/undefined check as (i32.or (i64.eq X NULL) (i64.eq X UNDEF)),
-    // which duplicates X — a local.tee(block(call $sideEffect)) would run twice.
-    return typed(['block', ['result', 'f64'],
-      ['local.set', `$${t}`, va],
-      ['if', ['result', 'f64'],
-        notNullish(typed(['local.get', `$${t}`], 'f64')),
-        ['then', asF64(ctx.core.emit['[]'](t, idx))],
-        ['else', ['f64.const', `nan:${UNDEF_NAN}`]]]], 'f64')
-  }
+    return asF64(ctx.core.emit['[]'](t, idx))
+  })
 
   // Optional call: fn?.(...args) → null if fn is null, else call fn
   ctx.core.emit['?.()'] = (callee, ...args) => {
@@ -716,42 +839,57 @@ export default (ctx) => {
       const methodEmit = ctx.core.emit[`.${callee[2]}`]
       if (methodEmit) {
         const recv = callee[1]
-        const t = temp()
-        const va = asF64(emit(recv))
-        const vt = typeof recv === 'string' ? repOf(recv)?.val : valTypeOf(recv)
-        if (vt) updateRep(t, { val: vt })
-        const callResult = methodEmit(t, ...args)
-        // Use local.set + local.get (not local.tee inside guard) because isNullish
-        // inlines the null/undefined check which duplicates the expression.
-        return typed(['block', ['result', 'f64'],
-          ['local.set', `$${t}`, va],
-          ['if', ['result', 'f64'],
-            notNullish(typed(['local.get', `$${t}`], 'f64')),
-            ['then', asF64(callResult)],
-            ['else', ['f64.const', `nan:${UNDEF_NAN}`]]]], 'f64')
+        return evalOnce(recv, (t) => {
+          // Emit-time rep seed on fresh `?.()` recv-temp so methodEmit's dispatch fast-paths fire.
+          const vt = typeof recv === 'string' ? repOf(recv)?.val : valTypeOf(recv)
+          if (vt) updateRep(t, { val: vt })
+          return asF64(methodEmit(t, ...args))
+        })
       }
     }
-    const t = temp()
-    const va = asF64(emit(callee))
-    // If nullish → return NULL_NAN, else call via fn.call
     if (!ctx.closure.call) err('Optional call requires fn module')
-    const callResult = ctx.closure.call(typed(['local.get', `$${t}`], 'f64'), args)
-    // Use local.set + local.get (not local.tee inside guard) because isNullish
-    // inlines the null/undefined check which duplicates the expression.
-    return typed(['block', ['result', 'f64'],
-      ['local.set', `$${t}`, va],
-      ['if', ['result', 'f64'],
-        notNullish(typed(['local.get', `$${t}`], 'f64')),
-        ['then', asF64(callResult)],
-        ['else', ['f64.const', `nan:${UNDEF_NAN}`]]]], 'f64')
+    return evalOnce(callee, (t) => {
+      // Spread args: mirror the regular `()` emitter — reconstruct the args array
+      // and route through `closure.call(_, [arrayIR], prebuiltArray=true)`. Without
+      // this, the raw `['...', expr]` node falls through to the bare spread emitter
+      // and errors as "Spread (...) can only be used in function/method calls".
+      const hasSpread = args.some(a => Array.isArray(a) && a[0] === '...')
+      let callResult
+      if (hasSpread) {
+        const normal = [], spreads = []
+        for (const a of args) {
+          if (Array.isArray(a) && a[0] === '...') spreads.push({ pos: normal.length, expr: a[1] })
+          else normal.push(a)
+        }
+        const combined = reconstructArgsWithSpreads(normal, spreads)
+        const arrayIR = buildArrayWithSpreads(combined)
+        callResult = ctx.closure.call(typed(['local.get', `$${t}`], 'f64'), [arrayIR], true)
+      } else {
+        callResult = ctx.closure.call(typed(['local.get', `$${t}`], 'f64'), args)
+      }
+      return asF64(callResult)
+    })
   }
 
-  // typeof: returns JS-style string. Reachable results are number/undefined/string/function/symbol/object
-  // (booleans are f64 and hit the number branch; no bigints). Strings are preallocated into globals and
+  // Statically boolean-typed operands: `Boolean(x)`, logical-not, and the
+  // relational/equality comparisons always yield a JS boolean — jz carries it as
+  // f64 0/1 but `typeof` must still report "boolean". None of these ops can
+  // produce a non-boolean, so the recognizer never false-positives. The `()`
+  // arm also unwraps parenthesized expressions (`typeof (a < b)`).
+  const BOOL_RESULT_OPS = new Set(['!', '<', '<=', '>', '>=', '==', '!=', '===', '!=='])
+  const isBoolExpr = (n) => Array.isArray(n) && (
+    BOOL_RESULT_OPS.has(n[0]) ||
+    (n[0] === '()' && (n[1] === 'Boolean' || isBoolExpr(n[1]))))
+
+  // typeof: returns JS-style string. Reachable results are number/undefined/string/function/symbol/object/boolean
+  // (booleans without a static type hit the number branch; no bigints). Strings are preallocated into globals and
   // initialized in __start (see compile.js). Comparison patterns (typeof x === 'string') are optimized
   // in prepare.js (resolveTypeof) and emitted as direct type checks via emitTypeofCmp, bypassing this path.
   ctx.core.emit['typeof'] = (a) => {
     if (valTypeOf(a) === VAL.BIGINT) return emit(['str', 'bigint'])
+    // VAL.BOOL covers boolean literals, comparisons, `!` and bindings inferred
+    // boolean; isBoolExpr additionally catches `Boolean(x)` and parenthesized forms.
+    if (valTypeOf(a) === VAL.BOOL || isBoolExpr(a)) return emit(['str', 'boolean'])
     if (!ctx.runtime.typeofStrs) {
       ctx.runtime.typeofStrs = ['number', 'undefined', 'string', 'function', 'symbol', 'object']
       for (const s of ctx.runtime.typeofStrs)
@@ -782,8 +920,11 @@ export default (ctx) => {
           (i64.eq (i64.and (local.get $v) (i64.const 0xFFF0000000000000))
                   (i64.const 0xFFF0000000000000)))
       (then (return (global.get $__tof_number))))
-    (if (call $__is_nullish (local.get $v))
+    (if (i64.eq (local.get $v) (i64.const ${UNDEF_NAN}))
       (then (return (global.get $__tof_undefined))))
+    ;; typeof null === "object" — the historical JS quirk, distinct from undefined.
+    (if (i64.eq (local.get $v) (i64.const ${NULL_NAN}))
+      (then (return (global.get $__tof_object))))
     (local.set $t (call $__ptr_type (local.get $v)))
     (if ${stringTest}
       (then (return (global.get $__tof_string))))
@@ -802,6 +943,24 @@ export default (ctx) => {
   ctx.core.emit['__ptr_aux'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_aux', asI64(emit(p))]], 'f64')
   ctx.core.emit['__ptr_offset'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_offset', asI64(emit(p))]], 'f64')
 
-  // Error(msg) — passthrough (throw handles any value)
-  ctx.core.emit['Error'] = (msg) => asF64(emit(msg))
+  // Error(msg) — passthrough (throw handles any value). Subclasses share the
+  // same shape: jz doesn't model typed-error dispatch, so SyntaxError/TypeError/
+  // RangeError/ReferenceError/URIError/EvalError all lower to the message
+  // expression. `instanceof SyntaxError` returning correct results would need
+  // proper class machinery; until then, code that throws specific subclasses
+  // compiles and the user-visible message is preserved.
+  // jz models an error as its message value (passthrough — `throw` accepts any
+  // value). A no-arg `new Error()` has no message, so it lowers to `undefined`
+  // rather than crashing on a missing argument. Emitting `['str','']` here would
+  // drag the whole string module into programs that only `throw new Error()`.
+  const passthroughError = (msg) => msg == null
+    ? typed(['f64.const', `nan:${UNDEF_NAN}`], 'f64')
+    : asF64(emit(msg))
+  ctx.core.emit['Error'] = passthroughError
+  ctx.core.emit['SyntaxError'] = passthroughError
+  ctx.core.emit['TypeError'] = passthroughError
+  ctx.core.emit['RangeError'] = passthroughError
+  ctx.core.emit['ReferenceError'] = passthroughError
+  ctx.core.emit['URIError'] = passthroughError
+  ctx.core.emit['EvalError'] = passthroughError
 }

package/module/date.js

@@ -9,7 +9,7 @@
  * @module date
  */
 
-import { typed, asF64, toNumF64, allocPtr } from '../src/ir.js'
+import { typed, asF64, toNumF64, allocPtr, temp } from '../src/ir.js'
 import { emit } from '../src/emit.js'
 import { inc, PTR } from '../src/ctx.js'
 import { VAL } from '../src/analyze.js'
@@ -30,7 +30,7 @@ export default (ctx) => {
     __date_day: [],
     __date_time_within_day: ['__date_day'],
     __date_weekday: ['__date_day'],
-    __date_year_from_time: ['__date_days_from_year'],
+    __date_year_from_time: ['__date_day', '__date_days_from_year'],
     __date_in_leap_year: ['__date_year_from_time', '__date_days_from_year'],
     __date_day_within_year: ['__date_day', '__date_year_from_time', '__date_days_from_year'],
     __date_month_from_time: ['__date_day_within_year', '__date_in_leap_year'],
@@ -618,10 +618,14 @@ export default (ctx) => {
   const emitDateSetTime = (dateExpr, ms) => {
     inc('__date_time_clip')
     const d = asF64(emit(dateExpr))
-    const t = typed(['call', '$__date_time_clip', toNumF64(ms, emit(ms))], 'f64')
+    // Clip once into a temp: the result feeds both the store and the block
+    // value, and sharing one IR node across two tree positions miscompiles
+    // under CSE (it hoists the arg without emitting its local.set).
+    const t = temp('st')
     return typed(['block', ['result', 'f64'],
-      ['f64.store', ['i32.wrap_i64', ['i64.reinterpret_f64', d]], t],
-      t], 'f64')
+      ['local.set', `$${t}`, typed(['call', '$__date_time_clip', toNumF64(ms, emit(ms))], 'f64')],
+      ['f64.store', ['i32.wrap_i64', ['i64.reinterpret_f64', d]], ['local.get', `$${t}`]],
+      ['local.get', `$${t}`]], 'f64')
   }
 
   ctx.core.emit['.getTime'] = emitDateGetTime

package/module/function.js

@@ -12,7 +12,7 @@
 
 import { typed, asF64, asI32, mkPtrIR, temp, tempI32, MAX_CLOSURE_ARITY, UNDEF_NAN } from '../src/ir.js'
 import { emit } from '../src/emit.js'
-import { isReassigned } from '../src/ast.js'
+import { isReassigned } from '../src/analyze.js'
 import { T, lookupValType, repOf, findFreeVars } from '../src/analyze.js'
 import { PTR, LAYOUT, inc, err } from '../src/ctx.js'
 
@@ -94,6 +94,14 @@ export default (ctx) => {
     const captureValTypes = new Map()
     const captureSchemaVars = new Map()
     const captureTypedElems = new Map()
+    // Propagate parent's intCertain rep across captures: the parent's narrower
+    // already guarantees every defining RHS (including assignments inside
+    // nested arrows) is integer-valued, so the f64 round-trip through the env
+    // slot preserves integer semantics. Consumers inside the inner body —
+    // `toNumF64` elision (src/ir.js), math fast paths (module/math.js),
+    // bitwise-key indexing (src/emit.js) — fire on captures just as they
+    // would on directly-declared locals.
+    const captureIntCertain = new Set()
     // Propagate parent's directClosures across captures: a const-bound closure captured
     // by an inner arrow can still be direct-dispatched in the inner body (skip
     // call_indirect on the captured pointer). Gated on isReassigned over the inner body
@@ -108,6 +116,7 @@ export default (ctx) => {
       if (elemType != null) captureTypedElems.set(name, elemType)
       const bodyName = ctx.func.directClosures?.get(name)
       if (bodyName && !isReassigned(body, name)) captureDirectClosures.set(name, bodyName)
+      if (repOf(name)?.intCertain === true) captureIntCertain.add(name)
     }
 
     const schemaNames = ctx.schema.vars?.size ? new Set(ctx.schema.vars.keys()) : null
@@ -130,6 +139,7 @@ export default (ctx) => {
       ...(defaults && { defaults }),
       ...(boxedCaptures.length && { boxed: new Set(boxedCaptures) }),
       ...(captureIntConsts.size && { intConsts: captureIntConsts }),
+      ...(captureIntCertain.size && { intCertain: captureIntCertain }),
       ...(captureValTypes.size && { valTypes: captureValTypes }),
       ...(captureSchemaVars.size && { schemaVars: captureSchemaVars }),
       ...(captureTypedElems.size && { typedElems: captureTypedElems }),