jz 0.5.0 → 0.6.0

package/module/core.js

@@ -9,32 +9,38 @@
  * @module core
  */
 
-import { typed, asF64, asI32, asI64, NULL_NAN, UNDEF_NAN, temp, usesDynProps, ptrOffsetIR, isNullish, valKindToPtr } from '../src/ir.js'
-import { emit, buildArrayWithSpreads } from '../src/emit.js'
+import { typed, asF64, asI32, asI64, NULL_NAN, UNDEF_NAN, FALSE_NAN, TRUE_NAN, temp, usesDynProps, ptrOffsetIR, isNullish, valKindToPtr, sidecarOverride, undefExpr } from '../src/ir.js'
+import { emit, spread, deps } from '../src/bridge.js'
 import { reconstructArgsWithSpreads } from '../src/ir.js'
-import { valTypeOf, lookupValType, lookupNotString, VAL, T, repOf, updateRep, shapeOf, inlineArraySid } from '../src/analyze.js'
-import { ctx, err, inc, PTR, LAYOUT } from '../src/ctx.js'
+import { valTypeOf, shapeOf } from '../src/kind.js'
+import { T } from '../src/ast.js'
+import { inlineArraySid } from '../src/static.js'
+import { VAL, lookupValType, lookupNotString, repOf, updateRep } from '../src/reps.js'
+import { ctx, err, inc, PTR, LAYOUT, HEAP, emitArity, followForwardingWat, declGlobal } from '../src/ctx.js'
+import { ptrOffsetFwdWat, STR_INTERN_BIT } from '../layout.js'
+import { nanPrefixHex } from '../layout.js'
 import { initSchema } from './schema.js'
 import { strHashLiteral } from './collection.js'
 
-// Pre-shifted NaN prefix as a full i64 mask, for `(i64.const ${NAN_BITS})` use.
-const NAN_BITS = '0x' + LAYOUT.NAN_PREFIX_BITS.toString(16).toUpperCase().padStart(16, '0')
+const NAN_BITS = nanPrefixHex()
 
 export default (ctx) => {
-  Object.assign(ctx.core.stdlibDeps, {
+  deps({
     __eq: ['__str_eq', '__ptr_type'],
     __typeof: ['__ptr_type', '__is_nullish'],
-    __len: ['__typed_shift'],
+    __len: ['__typed_shift', '__ptr_offset', '__ptr_offset_fwd'],
     __cap: ['__typed_shift', '__ptr_type', '__ptr_offset', '__ptr_aux'],
     __typed_data: ['__ptr_offset', '__ptr_aux'],
-    __ptr_offset: [],
+    __ptr_offset: ['__ptr_offset_fwd'],
+    __ptr_offset_fwd: [],
     __is_str_key: ['__ptr_type'],
     __str_len: ['__ptr_type', '__ptr_offset', '__ptr_aux'],
-    __set_len: [],
+    __set_len: ['__ptr_offset_fwd'],
     __length: ['__ptr_type', '__ptr_offset', '__str_len', '__len'],
-    __typeof: ['__ptr_type', '__is_nullish'],
+    __alloc: ['__memgrow'],
     __alloc_hdr: ['__alloc'],
     __alloc_hdr_n: ['__alloc'],
+    __coll_order: ['__alloc'],
   })
 
   ctx.core.stdlib['__is_nullish'] = `(func $__is_nullish (param $v i64) (result i32)
@@ -62,15 +68,26 @@ export default (ctx) => {
             (f64.eq (local.get $fb) (local.get $fb)))
           (then (f64.eq (local.get $fa) (local.get $fb)))
           (else
-            ;; At least one operand is a NaN-box. Both STRING (heap or SSO) → __str_eq
-            ;; handles content compare and SSO fast-fail internally.
+            ;; At least one operand is a NaN-box (the && above failed). For both to
+            ;; be strings BOTH must be NaN-boxed: tag bits are only meaningful on a
+            ;; NaN-box, so a normal number whose exponent bits happen to alias the
+            ;; STRING tag (e.g. ASCII content read as f64) must NOT route to __str_eq
+            ;; — that would deref garbage. number-vs-string is simply false.
             (local.set $ta (i32.wrap_i64 (i64.and (i64.shr_u (local.get $a) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
             (local.set $tb (i32.wrap_i64 (i64.and (i64.shr_u (local.get $b) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
             (if (result i32)
               (i32.and
-                (i32.eq (local.get $ta) (i32.const ${PTR.STRING}))
-                (i32.eq (local.get $tb) (i32.const ${PTR.STRING})))
-              (then (call $__str_eq (local.get $a) (local.get $b)))
+                (i32.and (f64.ne (local.get $fa) (local.get $fa)) (i32.eq (local.get $ta) (i32.const ${PTR.STRING})))
+                (i32.and (f64.ne (local.get $fb) (local.get $fb)) (i32.eq (local.get $tb) (i32.const ${PTR.STRING}))))
+              (then
+                ;; both canonical interned (bit-ne already known) ⇒ unequal —
+                ;; skip the __str_eq call entirely (see STR_INTERN_BIT, layout.js)
+                (if (result i32)
+                  (i32.and
+                    (i32.eq (i32.and (i32.wrap_i64 (i64.shr_u (local.get $a) (i64.const ${LAYOUT.AUX_SHIFT}))) (i32.const ${LAYOUT.SSO_BIT | LAYOUT.SLICE_BIT | STR_INTERN_BIT})) (i32.const ${STR_INTERN_BIT}))
+                    (i32.eq (i32.and (i32.wrap_i64 (i64.shr_u (local.get $b) (i64.const ${LAYOUT.AUX_SHIFT}))) (i32.const ${LAYOUT.SSO_BIT | LAYOUT.SLICE_BIT | STR_INTERN_BIT})) (i32.const ${STR_INTERN_BIT})))
+                  (then (i32.const 0))
+                  (else (call $__str_eq (local.get $a) (local.get $b)))))
               (else (i32.const 0))))))))`
 
   ctx.core.stdlib['__is_null'] = `(func $__is_null (param $v i64) (result i32)
@@ -86,11 +103,13 @@ export default (ctx) => {
       (else
         (i32.and
           (i32.and
-            (i64.ne (local.get $v) (i64.const ${NAN_BITS}))
-            (i64.ne (local.get $v) (i64.const ${NULL_NAN})))
-          (i32.and
-            (i64.ne (local.get $v) (i64.const ${UNDEF_NAN}))
-            (i64.ne (local.get $v) (i64.const 0x7FFA400000000000)))))))`
+            (i32.and
+              (i64.ne (local.get $v) (i64.const ${NAN_BITS}))
+              (i64.ne (local.get $v) (i64.const ${NULL_NAN})))
+            (i32.and
+              (i64.ne (local.get $v) (i64.const ${UNDEF_NAN}))
+              (i64.ne (local.get $v) (i64.const 0x7FFA400000000000))))
+          (i64.ne (local.get $v) (i64.const ${FALSE_NAN}))))))`
 
   ctx.core.stdlib['__is_str_key'] = `(func $__is_str_key (param $v i64) (result i32)
     (local $f f64)
@@ -124,29 +143,56 @@ export default (ctx) => {
           (i64.shl (i64.and (i64.extend_i32_u (local.get $aux)) (i64.const ${LAYOUT.AUX_MASK})) (i64.const ${LAYOUT.AUX_SHIFT}))
           (i64.and (i64.extend_i32_u (local.get $offset)) (i64.const ${LAYOUT.OFFSET_MASK})))))))`
 
+  ctx.core.stdlib['__ptr_offset_fwd'] = ptrOffsetFwdWat()
+
   ctx.core.stdlib['__ptr_offset'] = `(func $__ptr_offset (param $ptr i64) (result i32)
-    (local $bits i64) (local $off i32)
+    (local $bits i64) (local $off i32) (local $t i32)
     (local.set $bits (local.get $ptr))
     (local.set $off (i32.wrap_i64 (i64.and (local.get $bits) (i64.const ${LAYOUT.OFFSET_MASK}))))
-    ;; Arrays can be reallocated during growth; follow forwarding pointer (cap=-1 sentinel).
-    ;; Bounds are checked inside the loop so non-array ptrs skip them entirely, and well-formed
-    ;; ARRAY ptrs without forwarding still pay only one bounds check before the cap load.
-    (if (i32.eq
-          (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
-          (i32.const ${PTR.ARRAY}))
+    ;; ARRAY/SET/MAP/HASH can be reallocated on growth; follow the forwarding pointer
+    ;; (cap=-1 sentinel at -4, new offset at -8). Other types never forward, so they skip
+    ;; the loop; a well-formed ptr without forwarding pays one bounds + cap check per hop.
+    (local.set $t (i32.wrap_i64 (i64.and (i64.shr_u (local.get $bits) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))
+    (if (i32.or (i32.eq (local.get $t) (i32.const ${PTR.ARRAY}))
+          (i32.or (i32.eq (local.get $t) (i32.const ${PTR.HASH}))
+            (i32.or (i32.eq (local.get $t) (i32.const ${PTR.SET})) (i32.eq (local.get $t) (i32.const ${PTR.MAP})))))
       (then
-        (block $done
-          (loop $follow
-            (br_if $done (i32.lt_u (local.get $off) (i32.const 8)))
-            (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
-            (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
-            (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-            (br $follow)))))
+        ${followForwardingWat('$off', { lowGuard: true })}))
     (local.get $off))`
 
   ctx.core.stdlib['__ptr_aux'] = `(func $__ptr_aux (param $ptr i64) (result i32)
     (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.AUX_SHIFT})) (i64.const ${LAYOUT.AUX_MASK}))))`
 
+  // Exact JS `%` (fmod) for the f64 path. wasm has no f64 remainder, and the
+  // textbook `a - b*trunc(a/b)` is both INEXACT (rounding in trunc/mul/sub for
+  // large a/b) and WRONG on the IEEE edges. This does the spec exactly:
+  //   NaN if a or b is NaN, a is ±Inf, or b is 0; a if b is ±Inf or |a|<|b|;
+  //   otherwise binary long division — scale |b| up to ≤|a|, then subtract-and-
+  //   halve back down to |b|. Every step (×2, ×0.5, aligned subtraction) is
+  //   exact in f64, so the remainder is bit-identical to JS. Sign follows the
+  //   dividend (copysign), matching `(-5)%3 === -2`, `5%(-3) === 2`, `-0%3 === -0`.
+  ctx.core.stdlib['__rem'] = `(func $__rem (param $a f64) (param $b f64) (result f64)
+    (local $x f64) (local $y f64)
+    (if (f64.ne (local.get $a) (local.get $a)) (then (return (local.get $a))))
+    (if (f64.ne (local.get $b) (local.get $b)) (then (return (local.get $b))))
+    (local.set $x (f64.abs (local.get $a)))
+    (local.set $y (f64.abs (local.get $b)))
+    (if (i32.or (f64.eq (local.get $x) (f64.const inf)) (f64.eq (local.get $y) (f64.const 0)))
+      (then (return (f64.div (f64.const 0) (f64.const 0)))))
+    (if (i32.or (f64.eq (local.get $y) (f64.const inf)) (f64.lt (local.get $x) (local.get $y)))
+      (then (return (local.get $a))))
+    (block $up (loop $ul
+      (br_if $up (f64.gt (f64.mul (local.get $y) (f64.const 2)) (local.get $x)))
+      (local.set $y (f64.mul (local.get $y) (f64.const 2)))
+      (br $ul)))
+    (block $dn (loop $dl
+      (br_if $dn (f64.lt (local.get $y) (f64.abs (local.get $b))))
+      (if (f64.ge (local.get $x) (local.get $y)) (then (local.set $x (f64.sub (local.get $x) (local.get $y)))))
+      (local.set $y (f64.mul (local.get $y) (f64.const 0.5)))
+      (br $dl)))
+    (f64.copysign (local.get $x) (local.get $a)))`
+
+
   ctx.core.stdlib['__ptr_type'] = `(func $__ptr_type (param $ptr i64) (result i32)
     (i32.wrap_i64 (i64.and (i64.shr_u (local.get $ptr) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK}))))`
 
@@ -167,66 +213,115 @@ export default (ctx) => {
 
   // Heap-base watermark: gates header-backed propsPtr fast paths so static-data
   // OBJECT slots (offsets < heap base) don't misread arbitrary memory at off-16.
-  // Updated by optimizeModule() when data segment exceeds 1024 bytes.
-  ctx.scope.globals.set('__heap_start', '(global $__heap_start (mut i32) (i32.const 1024))')
+  // Updated by optimizeModule() when data segment exceeds HEAP.START bytes.
+  declGlobal('__heap_start', 'i32', HEAP.START)
 
-  // Shared memory keeps the heap pointer in linear memory (memory[1020]):
+  // Shared memory keeps the heap pointer in linear memory (memory[HEAP.PTR_ADDR]):
   // wasm globals are per-instance, so threads sharing one memory must share one
   // pointer cell. Non-shared memory (incl. alloc:false) uses the `$__heap`
   // global — exported so the JS-side adapter (memory.String etc) bumps the same
   // pointer. Storing it in memory would collide with the static data section
-  // whenever the data exceeds 1020 bytes.
+  // whenever the data exceeds HEAP.PTR_ADDR bytes.
+  // Geometric memory growth shared by `__alloc` and the in-place string
+  // bump-extend paths (string.js). Ensures linear memory covers byte offset
+  // `$next`, growing when short. Growing one page at a time turns a long-running
+  // embedding (watr called thousands of times) into O(n²) — each memory.grow may
+  // relocate and copy the whole heap — so we request at least the current size
+  // (≥2× total) in one shot; only on hitting the declared maximum do we fall back
+  // to the bare minimum. `$need` is the TOTAL pages required to cover $next; the
+  // byte size of memory ((memory.size)<<16) is computed in i64 because it
+  // overflows i32 at the wasm32 max of 65536 pages (4 GiB) — without that,
+  // capacity reads as 0 and every allocation spuriously tries to grow past the
+  // ceiling, trapping near 4 GiB.
+  ctx.core.stdlib['__memgrow'] = `(func $__memgrow (param $next i32)
+    (local $cur i32) (local $need i32)
+    (local.set $need (i32.wrap_i64 (i64.shr_u (i64.add (i64.extend_i32_u (local.get $next)) (i64.const 65535)) (i64.const 16))))
+    (if (i32.gt_u (local.get $need) (memory.size))
+      (then
+        (if (i64.gt_u (i64.extend_i32_u (local.get $need)) (i64.const 65536)) (then (unreachable)))
+        (local.set $cur (i32.sub (local.get $need) (memory.size)))            ;; minimum delta
+        (if (i32.lt_u (local.get $cur) (memory.size)) (then (local.set $cur (memory.size))))  ;; geometric
+        (if (i32.gt_u (i32.add (local.get $cur) (memory.size)) (i32.const 65536))
+          (then (local.set $cur (i32.sub (i32.const 65536) (memory.size)))))  ;; cap at wasm32 max
+        (if (i32.eq (memory.grow (local.get $cur)) (i32.const -1))
+          (then (if (i32.eq (memory.grow (i32.sub (local.get $need) (memory.size))) (i32.const -1))
+            (then (unreachable))))))))`
+
   if (ctx.memory.shared) {
-    // Heap offset stored at memory[1020] (i32), just before heap start at 1024.
-    // We still want to grow memory when running out of pages — without growth a
-    // host-run binary traps on the first allocation that exceeds the initial
-    // 64 KB. Use the same geometric-growth strategy as the owned-memory variant.
+    // Heap offset stored at memory[HEAP.PTR_ADDR] (i32), just before heap start at
+    // HEAP.START. Threads sharing one memory must share one pointer cell.
     ctx.core.stdlib['__alloc'] = `(func $__alloc (param $bytes i32) (result i32)
-      (local $ptr i32) (local $next i32) (local $cur i32) (local $need i32)
-      (local.set $ptr (i32.load (i32.const 1020)))
+      (local $ptr i32) (local $next i32)
+      (local.set $ptr (i32.load (i32.const ${HEAP.PTR_ADDR})))
       (local.set $next (i32.and (i32.add (i32.add (local.get $ptr) (local.get $bytes)) (i32.const 7)) (i32.const -8)))
-      (local.set $cur (i32.shl (memory.size) (i32.const 16)))
-      (if (i32.gt_u (local.get $next) (local.get $cur))
-        (then
-          (local.set $need (i32.shr_u (i32.add (i32.sub (local.get $next) (local.get $cur)) (i32.const 65535)) (i32.const 16)))
-          (if (i32.lt_u (local.get $need) (memory.size)) (then (local.set $need (memory.size))))
-          (if (i32.eq (memory.grow (local.get $need)) (i32.const -1))
-            (then (if (i32.eq (memory.grow
-              (i32.shr_u (i32.add (i32.sub (local.get $next) (local.get $cur)) (i32.const 65535)) (i32.const 16)))
-              (i32.const -1)) (then (unreachable)))))))
-      (i32.store (i32.const 1020) (local.get $next))
+      (call $__memgrow (local.get $next))
+      (i32.store (i32.const ${HEAP.PTR_ADDR}) (local.get $next))
       (local.get $ptr))`
     ctx.core.stdlib['__clear'] = `(func $__clear
-      (i32.store (i32.const 1020) (i32.const 1024)))`
+      (i32.store (i32.const ${HEAP.PTR_ADDR}) (i32.const ${HEAP.START})))`
   } else {
-    // Own memory: heap offset in a global, auto-grow when needed. Exported so
-    // the JS-side adapter (alloc:false, no `_alloc` export) shares the pointer.
-    ctx.scope.globals.set('__heap', '(global $__heap (export "__heap") (mut i32) (i32.const 1024))')
-    // Bump allocator with geometric growth. Growing one page at a time turns a
-    // long-running embedding (e.g. watr called thousands of times) into O(n²) —
-    // each memory.grow may relocate and copy the whole heap. So when we must
-    // grow, request at least the current size (≥2× total) in one shot; only on
-    // hitting the declared maximum do we fall back to the bare minimum.
+    // Own memory: heap offset in a global, exported so the JS-side adapter
+    // (alloc:false, no `_alloc` export) shares the pointer.
+    declGlobal('__heap', 'i32', HEAP.START, { export: '__heap' })
     ctx.core.stdlib['__alloc'] = `(func $__alloc (param $bytes i32) (result i32)
-      (local $ptr i32) (local $next i32) (local $cur i32) (local $need i32)
+      (local $ptr i32) (local $next i32)
       (local.set $ptr (global.get $__heap))
-      ;; Align next allocation to 8 bytes
       (local.set $next (i32.and (i32.add (i32.add (local.get $ptr) (local.get $bytes)) (i32.const 7)) (i32.const -8)))
-      (local.set $cur (i32.shl (memory.size) (i32.const 16)))
-      (if (i32.gt_u (local.get $next) (local.get $cur))
-        (then
-          (local.set $need (i32.shr_u (i32.add (i32.sub (local.get $next) (local.get $cur)) (i32.const 65535)) (i32.const 16)))
-          (if (i32.lt_u (local.get $need) (memory.size)) (then (local.set $need (memory.size))))
-          (if (i32.eq (memory.grow (local.get $need)) (i32.const -1))
-            (then (if (i32.eq (memory.grow
-              (i32.shr_u (i32.add (i32.sub (local.get $next) (local.get $cur)) (i32.const 65535)) (i32.const 16)))
-              (i32.const -1)) (then (unreachable)))))))
+      (call $__memgrow (local.get $next))
       (global.set $__heap (local.get $next))
       (local.get $ptr))`
     ctx.core.stdlib['__clear'] = `(func $__clear
-      (global.set $__heap (i32.const 1024)))`
+      (global.set $__heap (i32.const ${HEAP.START})))`
   }
 
+  // Build an insertion-ordered list of live slot offsets for a Set/Map/HASH
+  // backing table at $off (cap slots of $stride bytes). Returns a fresh i32 array
+  // (live-count entries) of slot offsets sorted by packed sequence (the insertion
+  // counter rides in each entry's hash-word high 32 bits — see collection.js's
+  // seqStore). Every order-sensitive iteration (keys/values/entries, for-in,
+  // spread, JSON, Map copy) walks this instead of raw slot order, so jz matches
+  // the JS spec's insertion order. Lives in core (not collection) because object
+  // and json iterate HASH tables without pulling the collection module. Insertion
+  // sort: enumerated collections are small, and it stays branch-light when sorted.
+  ctx.core.stdlib['__coll_order'] = `(func $__coll_order (param $off i32) (param $cap i32) (param $stride i32) (result i32)
+    (local $i i32) (local $n i32) (local $slot i32) (local $buf i32)
+    (local $j i32) (local $k i32) (local $cur i32) (local $sq i32)
+    ;; A null/empty backing pointer (off below the heap base) has no live slots —
+    ;; ordering it yields the empty list. Guard before the $off-8 length read so a
+    ;; degenerate receiver returns an empty buffer instead of faulting on load(-8).
+    (if (i32.lt_u (local.get $off) (i32.const ${HEAP.START})) (then (return (call $__alloc (i32.const 0)))))
+    (local.set $buf (call $__alloc (i32.shl (i32.load (i32.sub (local.get $off) (i32.const 8))) (i32.const 2))))
+    ;; gather live slot offsets (occupied ⇔ hash word ≠ 0)
+    (block $gd (loop $gl
+      (br_if $gd (i32.ge_s (local.get $i) (local.get $cap)))
+      (local.set $slot (i32.add (local.get $off) (i32.mul (local.get $i) (local.get $stride))))
+      (if (i64.ne (i64.load (local.get $slot)) (i64.const 0))
+        (then
+          (i32.store (i32.add (local.get $buf) (i32.shl (local.get $n) (i32.const 2))) (local.get $slot))
+          (local.set $n (i32.add (local.get $n) (i32.const 1)))))
+      (local.set $i (i32.add (local.get $i) (i32.const 1)))
+      (br $gl)))
+    ;; insertion-sort buf[0..n) ascending by sequence = hash-word high 32 bits
+    (local.set $j (i32.const 1))
+    (block $sd (loop $sl
+      (br_if $sd (i32.ge_s (local.get $j) (local.get $n)))
+      (local.set $cur (i32.load (i32.add (local.get $buf) (i32.shl (local.get $j) (i32.const 2)))))
+      (local.set $sq (i32.wrap_i64 (i64.shr_u (i64.load (local.get $cur)) (i64.const 32))))
+      (local.set $k (i32.sub (local.get $j) (i32.const 1)))
+      (block $id (loop $il
+        (br_if $id (i32.lt_s (local.get $k) (i32.const 0)))
+        (br_if $id (i32.le_u
+          (i32.wrap_i64 (i64.shr_u (i64.load (i32.load (i32.add (local.get $buf) (i32.shl (local.get $k) (i32.const 2))))) (i64.const 32)))
+          (local.get $sq)))
+        (i32.store (i32.add (local.get $buf) (i32.shl (i32.add (local.get $k) (i32.const 1)) (i32.const 2)))
+          (i32.load (i32.add (local.get $buf) (i32.shl (local.get $k) (i32.const 2)))))
+        (local.set $k (i32.sub (local.get $k) (i32.const 1)))
+        (br $il)))
+      (i32.store (i32.add (local.get $buf) (i32.shl (i32.add (local.get $k) (i32.const 1)) (i32.const 2))) (local.get $cur))
+      (local.set $j (i32.add (local.get $j) (i32.const 1)))
+      (br $sl)))
+    (local.get $buf))`
+
   // === Memory-based length/cap helpers (C-style headers) ===
 
   // Array/TypedArray/Buffer: [-8:len(i32)][-4:cap(i32)][data...]
@@ -263,12 +358,7 @@ export default (ctx) => {
     (if (result i32)
       (i32.and (i32.eq (local.get $t) (i32.const 1)) (i32.ge_u (local.get $off) (i32.const 8)))
       (then
-        (block $done
-          (loop $follow
-            (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
-            (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
-            (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-            (br $follow)))
+        ${followForwardingWat('$off', { lowGuard: false })}
         (i32.load (i32.sub (local.get $off) (i32.const 8))))
       (else
         (if (result i32)
@@ -288,7 +378,9 @@ export default (ctx) => {
                                    (call $__typed_shift (i32.and (local.get $aux) (i32.const 7)))))
                   (else (i32.shr_u (i32.load (i32.sub (local.get $off) (i32.const 8)))
                                    (call $__typed_shift (i32.and (local.get $aux) (i32.const 7)))))))
-              (else (i32.load (i32.sub (local.get $off) (i32.const 8))))))
+              ;; HASH/SET/MAP/BUFFER: re-resolve offset so grown SET/MAP follow the
+              ;; forwarding chain (HASH/BUFFER never forward → same inline offset).
+              (else (i32.load (i32.sub (call $__ptr_offset (local.get $ptr)) (i32.const 8))))))
           (else (i32.const 0))))))`
 
   ctx.core.stdlib['__cap'] = `(func $__cap (param $ptr i64) (result i32)
@@ -349,13 +441,7 @@ export default (ctx) => {
       (then
         (if (i32.eq (local.get $t) (i32.const 1))
           (then
-            (block $done
-              (loop $follow
-                (br_if $done (i32.lt_u (local.get $off) (i32.const 8)))
-                (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
-                (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
-                (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-                (br $follow)))))
+            ${followForwardingWat('$off', { lowGuard: true })}))
         (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $len)))))`
 
   // Alloc header(16) + data(cap*stride). Layout: [propsPtr@-16(f64=0), len@-8, cap@-4],
@@ -377,12 +463,18 @@ export default (ctx) => {
 
   // Generic header allocator for non-8 strides: Set (16), Map probe (24), TypedArray raw (1).
   // Same 16-byte header layout as __alloc_hdr; per-entry stride is passed dynamically.
+  // Header (16B) + cap*stride slots. Collections (Set/Map/HASH) key "empty slot"
+  // off a zero hash word, so the slot region MUST start zeroed. The bump allocator
+  // reuses memory after a heap reset (__clear) without re-zeroing, so we cannot
+  // lean on fresh-page zeroing here — clear the slots explicitly. Also covers the
+  // grow path, which rehashes into a freshly-allocated table expecting empties.
   ctx.core.stdlib['__alloc_hdr_n'] = `(func $__alloc_hdr_n (param $len i32) (param $cap i32) (param $stride i32) (result i32)
     (local $ptr i32)
     (local.set $ptr (call $__alloc (i32.add (i32.const 16) (i32.mul (local.get $cap) (local.get $stride)))))
     (i64.store (local.get $ptr) (i64.const 0))
     (i32.store (i32.add (local.get $ptr) (i32.const 8)) (local.get $len))
     (i32.store (i32.add (local.get $ptr) (i32.const 12)) (local.get $cap))
+    (memory.fill (i32.add (local.get $ptr) (i32.const 16)) (i32.const 0) (i32.mul (local.get $cap) (local.get $stride)))
     (i32.add (local.get $ptr) (i32.const 16)))`
 
   // Allocator + exports are deferred: only included when memory is actually needed.
@@ -460,7 +552,14 @@ export default (ctx) => {
   // Slot val-types reach the emit-time consumer via valTypeOf → ctx.schema.slotVT
   // (read on the AST `.prop` node), not via tagging this IR node.
   function emitSchemaSlotRead(baseExpr, idx) {
-    const base = baseExpr?.type === 'f64' ? baseExpr : typed(baseExpr, 'f64')
+    // An unboxed proven-non-ARRAY pointer (a structInline element cell, a narrowed local)
+    // reaches ptrOffsetIR raw so it returns the offset directly — no `__ptr_offset` call.
+    // Pre-boxing via asF64 strips ptrKind and forces every field read onto the call path
+    // (the dcbb433 perf cliff on object/struct kernels — `p.x,p.y,p.z` per loop iteration).
+    // A NaN-box or untyped value still routes through f64 for the reinterpret/forwarding path.
+    const base = (baseExpr?.ptrKind != null && baseExpr.ptrKind !== VAL.ARRAY)
+      ? baseExpr
+      : (baseExpr?.type === 'f64' ? baseExpr : asF64(baseExpr))
     return typed(ctx.abi.object.ops.load(ptrOffsetIR(base, VAL.OBJECT), idx), 'f64')
   }
 
@@ -542,7 +641,7 @@ export default (ctx) => {
   }
 
   /** Emit .prop access for a WASM f64 node using schema or HASH fallback. */
-  function emitPropAccess(va, obj, prop) {
+  function emitPropAccess(va, obj, prop, fromOptional = false) {
     // Anonymous-literal fast path: when `obj` resolves at compile time to an
     // object literal `{...}` (either directly, or through a `.prop` chain
     // walked back to one), use the literal's slot index instead of falling
@@ -553,21 +652,21 @@ export default (ctx) => {
     // `({a:{b:1}}).a.b` where the receiver is anonymous. Spread sources
     // (`{...x}`) shift slot ordering and would need their own resolution.
     const slot = literalSlot(obj, prop)
-    if (slot >= 0) return emitSchemaSlotRead(asF64(va), slot)
+    if (slot >= 0) return emitSchemaSlotRead(va, slot)
     // Receiver IR is an unboxed OBJECT pointer carrying its own schema (a
     // structInline element cell, a narrowed local): resolve the field's fixed
     // slot directly from `ptrAux` — more precise than the structural
-    // `ctx.schema.find(null, …)` and never falls to the dyn dispatcher.
+    // `ctx.schema.slotOf(null, …)` and never falls to the dyn dispatcher.
     if (va?.ptrKind === VAL.OBJECT && va.ptrAux != null && typeof prop === 'string') {
       const sch = ctx.schema.list[va.ptrAux]
       const si = sch ? sch.indexOf(prop) : -1
-      if (si >= 0) return emitSchemaSlotRead(asF64(va), si)
+      if (si >= 0) return emitSchemaSlotRead(va, si)
     }
-    let schemaIdx = typeof obj === 'string' ? ctx.schema.find(obj, prop) : ctx.schema.find(null, prop)
+    let schemaIdx = typeof obj === 'string' ? ctx.schema.slotOf(obj, prop) : ctx.schema.slotOf(null, prop)
     // Chain receiver (e.g. `o.meta.bias`): when the chain resolves to a known
     // OBJECT shape via JSON-shape propagation, the parent shape's `names`
     // gives the slot directly. Avoids the structural ambiguity of
-    // ctx.schema.find(null, prop) when multiple registered schemas share a key.
+    // ctx.schema.slotOf(null, prop) when multiple registered schemas share a key.
     if (schemaIdx < 0 && typeof obj !== 'string') {
       const sh = shapeOf(obj)
       if ((sh?.val === VAL.OBJECT || sh?.val === VAL.HASH) && sh.names) {
@@ -576,7 +675,7 @@ export default (ctx) => {
       }
     }
     const key = asI64(emit(['str', prop]))
-    if (schemaIdx >= 0) return emitSchemaSlotRead(asF64(va), schemaIdx)
+    if (schemaIdx >= 0) return emitSchemaSlotRead(va, schemaIdx)
     if (typeof obj === 'string') {
       const vt = lookupValType(obj)
       if (usesDynProps(vt)) {
@@ -595,9 +694,16 @@ export default (ctx) => {
         // In WASI mode, values are always JSON-derived (never PTR.EXTERNAL host objects).
         // Skip the external branch and dispatch through the typed HASH/OBJECT path.
         if (ctx.transform.host === 'wasi') return emitDynGetExprTyped(va, key, vt, prop)
-        ctx.features.external = true
+        // `fromOptional` (a `?.prop` read) short-circuits on nullish, so its
+        // PTR.EXTERNAL arm is dead unless host externals are already in play —
+        // don't force the __ext_prop import just for an optional read.
+        if (!fromOptional) ctx.features.external = true
         return emitDynGetAnyTyped(va, key, vt, prop)
       }
+      // Primitive receiver (number/boolean/bigint): no dynamic props — `(5).foo` is
+      // undefined. Without this the value falls to the __hash_get fallback, which
+      // reinterprets the primitive's bits as a HASH pointer and reads heap → OOB.
+      if (vt === VAL.NUMBER || vt === VAL.BOOL || vt === VAL.BIGINT) return undefExpr()
       inc('__hash_get', '__str_hash', '__str_eq')
       return typed(['f64.reinterpret_i64', ['call', '$__hash_get', asI64(va), key]], 'f64')
     }
@@ -662,8 +768,8 @@ export default (ctx) => {
         const inner = ctx.schema.emitInner(obj)
         return typed(['f64.convert_i32_s', ['call', '$__len', ['i64.reinterpret_f64', inner]]], 'f64')
       }
-      const idx = ctx.schema.find(obj, prop)
-      if (idx >= 0) return emitSchemaSlotRead(asF64(emit(obj)), idx)
+      const idx = ctx.schema.slotOf(obj, prop)
+      if (idx >= 0) return emitSchemaSlotRead(emit(obj), idx)
     }
 
     if (prop === 'length') {
@@ -691,7 +797,7 @@ export default (ctx) => {
       // UTF-8 and __str_byteLen returns byte count, so this matches the runtime
       // semantics. Skips the call + NaN-unbox round-trip entirely.
       if (Array.isArray(obj) && (obj[0] === 'str' || obj[0] == null) && typeof obj[1] === 'string') {
-        return typed(['f64.const', Buffer.byteLength(obj[1], 'utf8')], 'f64')
+        return typed(['f64.const', new TextEncoder().encode(obj[1]).length], 'f64')
       }
       // structInline Array<S>: the header `len` counts physical f64 cells (K
       // per element), so the JS array length is `physicalLen / K`.
@@ -712,20 +818,42 @@ export default (ctx) => {
     }
 
     // Type-specific property emitter (`.regex:source`, …) — the property-read
-    // mirror of the `.vt:method` method-dispatch table. Property emitters take
-    // a single arg (the receiver); arity ≥ 2 entries are method emitters and
-    // must not be routed here (reading `re.test` as a value is not a call).
+    // mirror of the `.vt:method` method-dispatch table. Only entries tagged as
+    // getters (via `getter()`) fire here: reading `re.source` yields a value,
+    // but reading `m.keys`/`re.test` is not a call and must not invoke the
+    // method (which would materialize a view / run the probe).
     const ptRep = typeof obj === 'string' ? repOf(obj) : null
     const ptVt = ptRep ? ptRep.val : valTypeOf(obj)
     if (ptVt) {
       const tpEmitter = ctx.core.emit[`.${ptVt}:${prop}`]
-      if (tpEmitter && tpEmitter.length <= 1) return tpEmitter(obj)
+      if (tpEmitter?.getter) return tpEmitter(obj)
     }
 
-    // Module-registered property emitter (.size, etc.)
+    // valueOf/toString are ToPrimitive hooks (ES2024 7.1.1) that an own data
+    // property shadows. On a heap receiver carrying a dynamic-prop sidecar
+    // (array/typed/object), reading `obj.valueOf`/`obj.toString` must return an
+    // assigned override when present, else the inherited builtin. Without this,
+    // the arity-1 builtin emitter below (returns the receiver) masks the
+    // override. The method-call path in src/emit.js runs the parallel probe and
+    // additionally covers statically-unknown receivers (e.g. `arr[0].valueOf()`);
+    // a bare read of an unknown-type receiver can't yield a builtin-as-value
+    // here anyway, so this read path stays scoped to known sidecar types.
+    if ((prop === 'valueOf' || prop === 'toString') && ctx.closure.call &&
+        (ptVt === VAL.ARRAY || ptVt === VAL.TYPED || ptVt === VAL.OBJECT)) {
+      const builtin = ctx.core.emit[`.${ptVt}:${prop}`] || ctx.core.emit[`.${prop}`]
+      if (builtin && emitArity(builtin) <= 1) {
+        return sidecarOverride(emit(obj), asI64(emit(['str', prop])),
+          (p) => ['local.get', `$${p}`],          // READ: yield the override closure value
+          (o) => asF64(builtin(o)))               // else the arity-≤1 builtin's value
+      }
+    }
+
+    // Module-registered property getter (.size, .byteLength, …). Methods sharing
+    // the bare-`.prop` table (`.values`, `.pop`, date getters) are untagged and
+    // fall through to a real property read — `m.values` reads the "values" field.
     const propKey = `.${prop}`
     const propEmitter = ctx.core.emit[propKey]
-    if (propEmitter && propEmitter.length <= 1) return propEmitter(obj)
+    if (propEmitter?.getter) return propEmitter(obj)
 
     return emitPropAccess(emit(obj), obj, prop)
   }
@@ -757,7 +885,13 @@ export default (ctx) => {
     return optionalGuard(t, va, useFn(t))
   }
 
-  // Optional chaining: obj?.prop → null if obj is null, else obj.prop
+  // Optional chaining: obj?.prop → undefined if obj is nullish, else obj.prop.
+  // Delegate the property read to emitPropAccess — the SAME resolution the plain
+  // `.` emitter uses (passing the hoisted temp's value for the load, but the
+  // original `obj` name for schema/valType lookup). The previous hand-rolled copy
+  // diverged: it lacked emitPropAccess's `VAL.OBJECT off-schema → __dyn_get_expr`
+  // branch and fell to `__hash_get`, which mis-reads fixed-shape OBJECT memory
+  // (a self-host miscompile — `o?.x` returned undefined under the kernel).
   ctx.core.emit['?.'] = (obj, prop) => evalOnce(obj, (t) => {
     const rep = typeof obj === 'string' ? repOf(obj) : null
     const vt = rep ? rep.val : valTypeOf(obj)
@@ -765,27 +899,19 @@ export default (ctx) => {
       const notString = vt == null && typeof obj === 'string' && lookupNotString(obj)
       return emitLengthAccess(['local.get', `$${t}`], vt, notString)
     }
-    const propIdx = typeof obj === 'string' ? ctx.schema.find(obj, prop) : -1
-    if (propIdx >= 0) return emitSchemaSlotRead(['local.get', `$${t}`], propIdx)
-    if (typeof obj === 'string') {
-      const objType = lookupValType(obj)
-      if (usesDynProps(objType))
-        return emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType, prop)
-      if (objType === VAL.HASH)
-        return emitHashGetLocalConst(['local.get', `$${t}`], asI64(emit(['str', prop])), prop)
-      if (objType == null)
-        // Unknown receiver — in WASI mode use typed dispatch (no PTR.EXTERNAL values).
-        // In JS host mode use __dyn_get_any_t but don't force features.external here
-        // since ?.prop short-circuits on nullish (EXTERNAL arm is dead unless already on).
-        return ctx.transform.host === 'wasi'
-          ? emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType, prop)
-          : emitDynGetAnyTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), objType, prop)
-      inc('__hash_get', '__str_hash', '__str_eq')
-      return ['f64.reinterpret_i64', ['call', '$__hash_get', ['i64.reinterpret_f64', ['local.get', `$${t}`]], asI64(emit(['str', prop]))]]
+    // Type-specific + module-registered property getters (`.size`, `.byteLength`,
+    // `.regex:source`, …) — the SAME getter dispatch the plain `.` emitter runs
+    // (only entries tagged via `getter()` fire; untagged `.values`/`.pop` stay a
+    // field read). Read the already-hoisted, null-guarded temp `t` rather than
+    // re-emitting `obj`. Without this `s?.size` fell straight to emitPropAccess (a
+    // plain field read) and returned undefined — a Set/Map size getter never ran.
+    if (vt) {
+      const tg = ctx.core.emit[`.${vt}:${prop}`]
+      if (tg?.getter) return tg(t)
     }
-    if (valTypeOf(obj) === VAL.HASH)
-      return emitHashGetLocalConst(['local.get', `$${t}`], asI64(emit(['str', prop])), prop)
-    return emitDynGetExprTyped(['local.get', `$${t}`], asI64(emit(['str', prop])), valTypeOf(obj), prop)
+    const g = ctx.core.emit[`.${prop}`]
+    if (g?.getter) return g(t)
+    return emitPropAccess(typed(['local.get', `$${t}`], 'f64'), obj, prop, true)
   })
 
   // Optional index: arr?.[i] → null if arr is null, else arr[i]
@@ -810,14 +936,21 @@ export default (ctx) => {
     // as a direct method call. The outer optional short-circuits when the receiver
     // is nullish — the method itself is statically known to exist.
     if (Array.isArray(callee) && (callee[0] === '.' || callee[0] === '?.') && typeof callee[2] === 'string') {
-      const methodEmit = ctx.core.emit[`.${callee[2]}`]
-      if (methodEmit) {
+      const method = callee[2]
+      if (ctx.core.emit[`.${method}`]) {
         const recv = callee[1]
         return evalOnce(recv, (t) => {
-          // Emit-time rep seed on fresh `?.()` recv-temp so methodEmit's dispatch fast-paths fire.
+          // Emit-time rep seed on fresh `?.()` recv-temp so the dispatch fast-paths fire.
           const vt = typeof recv === 'string' ? repOf(recv)?.val : valTypeOf(recv)
           if (vt) updateRep(t, { val: vt })
-          return asF64(methodEmit(t, ...args))
+          // Re-enter the full `()` method dispatch (runtime string/array dispatch,
+          // charCodeAt, schema, …) rather than the bare generic `.${method}` emitter
+          // — that emitter is the *array* `includes`/`indexOf`/… and would mis-run on
+          // a string receiver. Mirrors `?.[]`'s re-entry into `[]`. The method is
+          // statically known to exist, so the inner optional is moot; `t` is already
+          // nullish-guarded by evalOnce. Args re-bundle into the `()` arg slot.
+          const callArgs = args.length === 0 ? null : args.length === 1 ? args[0] : [',', ...args]
+          return asF64(ctx.core.emit['()'](['.', t, method], callArgs))
         })
       }
     }
@@ -836,7 +969,7 @@ export default (ctx) => {
           else normal.push(a)
         }
         const combined = reconstructArgsWithSpreads(normal, spreads)
-        const arrayIR = buildArrayWithSpreads(combined)
+        const arrayIR = spread(combined)
         callResult = ctx.closure.call(typed(['local.get', `$${t}`], 'f64'), [arrayIR], true)
       } else {
         callResult = ctx.closure.call(typed(['local.get', `$${t}`], 'f64'), args)
@@ -865,9 +998,9 @@ export default (ctx) => {
     // boolean; isBoolExpr additionally catches `Boolean(x)` and parenthesized forms.
     if (valTypeOf(a) === VAL.BOOL || isBoolExpr(a)) return emit(['str', 'boolean'])
     if (!ctx.runtime.typeofStrs) {
-      ctx.runtime.typeofStrs = ['number', 'undefined', 'string', 'function', 'symbol', 'object']
+      ctx.runtime.typeofStrs = ['number', 'undefined', 'string', 'function', 'symbol', 'object', 'boolean']
       for (const s of ctx.runtime.typeofStrs)
-        ctx.scope.globals.set(`__tof_${s}`, `(global $__tof_${s} (mut f64) (f64.const 0))`)
+        declGlobal(`__tof_${s}`, 'f64')
     }
     inc('__typeof')
     // Receiver type unknown; enable branches that wouldn't otherwise be reachable.
@@ -890,7 +1023,7 @@ export default (ctx) => {
     ;; That bit pattern is the math NaN value, not a tagged pointer — treat as "number".
     ;; Negative-NaN bit patterns (sign bit set) don't match NAN_PREFIX so are uniquely numeric.
     (if (i32.or
-          (i64.eq (local.get $v) (i64.const 0x7FF8000000000000))
+          (i64.eq (local.get $v) (i64.const ${NAN_BITS}))
           (i64.eq (i64.and (local.get $v) (i64.const 0xFFF0000000000000))
                   (i64.const 0xFFF0000000000000)))
       (then (return (global.get $__tof_number))))
@@ -899,6 +1032,9 @@ export default (ctx) => {
     ;; typeof null === "object" — the historical JS quirk, distinct from undefined.
     (if (i64.eq (local.get $v) (i64.const ${NULL_NAN}))
       (then (return (global.get $__tof_object))))
+    ;; Boolean atoms (FALSE_NAN / TRUE_NAN) — carry at the JS boundary.
+    (if (i64.eq (i64.and (local.get $v) (i64.const 0xFFFFFFFEFFFFFFFF)) (i64.const ${FALSE_NAN}))
+      (then (return (global.get $__tof_boolean))))
     (local.set $t (call $__ptr_type (local.get $v)))
     (if ${stringTest}
       (then (return (global.get $__tof_string))))
@@ -911,11 +1047,14 @@ export default (ctx) => {
   // === Schema helpers (centralized in module/schema.js) ===
   initSchema(ctx)
 
-  // Low-level pointer helpers callable from jz code
-  ctx.core.emit['__mkptr'] = (t, a, o) => typed(['call', '$__mkptr', asI32(emit(t)), asI32(emit(a)), asI32(emit(o))], 'f64')
-  ctx.core.emit['__ptr_type'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_type', asI64(emit(p))]], 'f64')
-  ctx.core.emit['__ptr_aux'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_aux', asI64(emit(p))]], 'f64')
-  ctx.core.emit['__ptr_offset'] = (p) => typed(['f64.convert_i32_s', ['call', '$__ptr_offset', asI64(emit(p))]], 'f64')
+  // Low-level pointer helpers callable from jz code. Each handler inc()'s its
+  // stdlib func so the call resolves at every optimize level. At opt≥1 fusedRewrite
+  // inlines `call $__ptr_*` to bit-ops (the func is then dead-code-eliminated), but
+  // the inc() must fire first so pullStdlib has the body when watr assembles at opt0.
+  ctx.core.emit['__mkptr'] = (t, a, o) => (inc('__mkptr'), typed(['call', '$__mkptr', asI32(emit(t)), asI32(emit(a)), asI32(emit(o))], 'f64'))
+  ctx.core.emit['__ptr_type'] = (p) => (inc('__ptr_type'), typed(['f64.convert_i32_s', ['call', '$__ptr_type', asI64(emit(p))]], 'f64'))
+  ctx.core.emit['__ptr_aux'] = (p) => (inc('__ptr_aux'), typed(['f64.convert_i32_s', ['call', '$__ptr_aux', asI64(emit(p))]], 'f64'))
+  ctx.core.emit['__ptr_offset'] = (p) => (inc('__ptr_offset'), typed(['f64.convert_i32_s', ['call', '$__ptr_offset', asI64(emit(p))]], 'f64'))
 
   // Error(msg) — passthrough (throw handles any value). Subclasses share the
   // same shape: jz doesn't model typed-error dispatch, so SyntaxError/TypeError/