jz 0.5.1 → 0.6.0

package/module/regex.js

@@ -7,10 +7,11 @@
  * @module regex
  */
 
-import { typed, asF64, asI64, UNDEF_NAN, mkPtrIR, temp, tempI32 } from '../src/ir.js'
-import { emit } from '../src/emit.js'
-import { err, inc, PTR, LAYOUT } from '../src/ctx.js'
-import { includeModule } from '../src/autoload.js'
+import { typed, asF64, asI64, UNDEF_NAN, NULL_NAN, mkPtrIR, temp, tempI32 } from '../src/ir.js'
+import { emit, deps } from '../src/bridge.js'
+import { ctx, err, inc, PTR, LAYOUT, getter, declGlobal } from '../src/ctx.js'
+import { valTypeOf } from '../src/kind.js'
+import { VAL } from '../src/reps.js'
 
 // Build IR that constructs a match array: [full, cap1, cap2, ...]
 // strLocal, msLocal, meLocal are local names (i32 for ms/me, f64 for str).
@@ -27,7 +28,7 @@ const buildMatchArr = (strLocal, msLocal, meLocal, nGroups, groupNames = []) =>
     if (groupNames[i]) named.push([i, groupNames[i]])
   }
   if (named.length) {
-    includeModule('collection')
+    ctx.module.include('collection')
     inc('__hash_new_small', '__hash_set', '__dyn_set')
   }
   const captureValue = i => ['if', ['result', 'f64'],
@@ -223,7 +224,22 @@ const parseGroup = () => {
   const inner = parseAlt()
   cur() === RPAREN || perr('Unclosed ('); skip()
   if (groupName) groupNames[groupId] = groupName
-  return groupId ? [type, inner, groupId] : [type, inner]
+  // Carry the capture name IN the group node (4th element) as well as the module-level
+  // groupNames array. The AST structure survives the parse→compile handoff intact (it
+  // drives codegen), whereas the self-host kernel drops mutations to the module-level
+  // groupNames array — so `.groups` was never built. compileRegexToStdlib reads names
+  // back via collectGroupNames(ast), which works in both legs.
+  return groupId ? (groupName ? [type, inner, groupId, groupName] : [type, inner, groupId]) : [type, inner]
+}
+
+// Walk a parsed regex AST and return a `groupId → name` array for named captures,
+// sourced from the group nodes' 4th element (set by parseGroup). Kernel-safe: relies
+// only on the surviving AST structure, not module-level parse state.
+const collectGroupNames = (node, out = []) => {
+  if (!Array.isArray(node)) return out
+  if (node[0] === '()' && typeof node[2] === 'number' && typeof node[3] === 'string') out[node[2]] = node[3]
+  for (let i = 1; i < node.length; i++) collectGroupNames(node[i], out)
+  return out
 }
 
 const isGroupNameStart = c =>
@@ -251,7 +267,8 @@ const parseGroupName = () => {
 const CHAR_CLASS_WAT = {
   d: '(i32.and (i32.ge_u (local.get $char) (i32.const 48)) (i32.le_u (local.get $char) (i32.const 57)))',
   w: '(i32.or (i32.or (i32.and (i32.ge_u (local.get $char) (i32.const 97)) (i32.le_u (local.get $char) (i32.const 122))) (i32.and (i32.ge_u (local.get $char) (i32.const 65)) (i32.le_u (local.get $char) (i32.const 90)))) (i32.or (i32.and (i32.ge_u (local.get $char) (i32.const 48)) (i32.le_u (local.get $char) (i32.const 57))) (i32.eq (local.get $char) (i32.const 95))))',
-  s: '(i32.or (i32.or (i32.eq (local.get $char) (i32.const 32)) (i32.eq (local.get $char) (i32.const 9))) (i32.or (i32.eq (local.get $char) (i32.const 10)) (i32.eq (local.get $char) (i32.const 13))))'
+  // SP(32) TAB(9) LF(10) CR(13) VT(11) FF(12); NBSP/Unicode-Zs are multibyte under UTF-8 — out of scope
+  s: '(i32.or (i32.or (i32.or (i32.eq (local.get $char) (i32.const 32)) (i32.eq (local.get $char) (i32.const 9))) (i32.or (i32.eq (local.get $char) (i32.const 10)) (i32.eq (local.get $char) (i32.const 13)))) (i32.or (i32.eq (local.get $char) (i32.const 11)) (i32.eq (local.get $char) (i32.const 12))))'
 }
 
 // 8-bit char load at $str + $pos
@@ -714,7 +731,7 @@ const patternMinLen = node => {
 // === Module init ===
 
 export default (ctx) => {
-  Object.assign(ctx.core.stdlibDeps, {
+  deps({
     __str_to_buf: ['__str_byteLen', '__char_at'],
   })
 
@@ -750,12 +767,12 @@ export default (ctx) => {
     // Reserve mutable globals for capture group start/end (shared across regexes by index)
     for (let i = 1; i <= (ast.groups || 0); i++) {
       if (!ctx.scope.globals.has(`__re_g${i}_start`)) {
-        ctx.scope.globals.set(`__re_g${i}_start`, `(global $__re_g${i}_start (mut i32) (i32.const -1))`)
-        ctx.scope.globals.set(`__re_g${i}_end`, `(global $__re_g${i}_end (mut i32) (i32.const -1))`)
+        declGlobal(`__re_g${i}_start`, 'i32', -1)
+        declGlobal(`__re_g${i}_end`, 'i32', -1)
       }
     }
     ctx.runtime.regex.groups.set(id, ast.groups || 0)
-    ctx.runtime.regex.groupNames.set(id, ast.groupNames || [])
+    ctx.runtime.regex.groupNames.set(id, collectGroupNames(ast))
     ctx.core.stdlib[funcName] = compileRegex(ast, funcName)
 
     // Search wrapper: tries match at each position, returns (match_start, match_end) via locals
@@ -774,7 +791,30 @@ export default (ctx) => {
         (br $next)))
       (i32.const -1) (i32.const -1))`
 
-    inc(funcName, searchName, '__str_to_buf')
+    // search_from: like search but starts scanning at $fromPos (used by global exec)
+    const searchFromName = `__regex_search_from_${id}`
+    ctx.core.stdlib[searchFromName] = `(func $${searchFromName} (param $str i64) (param $fromPos i32) (result i32 i32)
+      (local $off i32) (local $len i32) (local $pos i32) (local $result i32)
+      (local.set $off (call $__str_to_buf (local.get $str)))
+      (local.set $len (call $__str_byteLen (local.get $str)))
+      (local.set $pos (local.get $fromPos))
+      (block $done (loop $next
+        (br_if $done (i32.gt_s (local.get $pos) (local.get $len)))
+        (local.set $result (call $${funcName} (local.get $off) (local.get $len) (local.get $pos)))
+        (if (i32.ge_s (local.get $result) (i32.const 0))
+          (then (return (local.get $pos) (local.get $result))))
+        (local.set $pos (i32.add (local.get $pos) (i32.const 1)))
+        (br $next)))
+      (i32.const -1) (i32.const -1))`
+
+    // lastIndex mutable global for /g or /y regexes — tracks position across exec() calls
+    if ((flags || '').includes('g') || (flags || '').includes('y')) {
+      const liGlobal = `__re_lastIndex_${id}`
+      if (!ctx.scope.globals.has(liGlobal))
+        declGlobal(liGlobal, 'i32')
+    }
+
+    inc(funcName, searchName, searchFromName, '__str_to_buf')
     ctx.runtime.regex.compiled.set(key, id)
     return id
   }
@@ -811,19 +851,46 @@ export default (ctx) => {
         ['else', ['f64.const', 0]]]], 'f64')
   }
 
-  // regex.exec(str) → [match_text, cap1, ...] array or 0 (null)
+  // regex.exec(str) → [match_text, cap1, ...] array or null.
+  // Mirrors JS: returns null (NULL_NAN) on no-match so `!== null` and while-loop idioms work.
+  // For /g (and /y) regexes: stateful — reads lastIndex, advances on match, resets on miss.
   ctx.core.emit['.regex:exec'] = (obj, str) => {
     const id = resolveRegex(obj)
     if (id == null) err('regex.exec requires a known regex')
     const nGroups = ctx.runtime.regex.groups.get(id) || 0
     const groupNames = ctx.runtime.regex.groupNames.get(id) || []
+    const flags = flagsOf(obj)
+    const isGlobal = flags.includes('g') || flags.includes('y')
     const s = temp('re'), ms = tempI32('rems'), me = tempI32('reme')
+    const nullIR = ['f64.const', `nan:${NULL_NAN}`]
+    if (isGlobal) {
+      // Stateful path: read lastIndex, search from there, update/reset lastIndex.
+      const liGlobal = `$__re_lastIndex_${id}`
+      inc(`__regex_search_from_${id}`)
+      return typed(['block', ['result', 'f64'],
+        ['local.set', `$${s}`, asF64(emit(str))],
+        ['local.set', `$${ms}`, ['local.set', `$${me}`,
+          ['call', `$__regex_search_from_${id}`,
+            ['i64.reinterpret_f64', ['local.get', `$${s}`]],
+            ['global.get', liGlobal]]]],
+        ['if', ['result', 'f64'], ['i32.lt_s', ['local.get', `$${ms}`], ['i32.const', 0]],
+          // no match — reset lastIndex, return null
+          ['then', ['global.set', liGlobal, ['i32.const', 0]], nullIR],
+          // match — advance lastIndex past match end (bump by 1 for zero-length)
+          ['else',
+            ['global.set', liGlobal,
+              ['select',
+                ['i32.add', ['local.get', `$${me}`], ['i32.const', 1]],
+                ['local.get', `$${me}`],
+                ['i32.eq', ['local.get', `$${ms}`], ['local.get', `$${me}`]]]],
+            buildMatchArr(s, ms, me, nGroups, groupNames)]]], 'f64')
+    }
     return typed(['block', ['result', 'f64'],
       ['local.set', `$${s}`, asF64(emit(str))],
       ['local.set', `$${ms}`, ['local.set', `$${me}`,
         ['call', `$__regex_search_${id}`, ['i64.reinterpret_f64', ['local.get', `$${s}`]]]]],
       ['if', ['result', 'f64'], ['i32.lt_s', ['local.get', `$${ms}`], ['i32.const', 0]],
-        ['then', ['f64.const', 0]],
+        ['then', nullIR],
         ['else', buildMatchArr(s, ms, me, nGroups, groupNames)]]], 'f64')
   }
 
@@ -844,26 +911,34 @@ export default (ctx) => {
   // RegExp.prototype.source — the pattern text. A literal stores it verbatim
   // (already grammar-escaped), so `/A/.source` is the 6-char "A".
   // An empty pattern serializes to "(?:)" so the result re-parses to a regex.
-  ctx.core.emit['.regex:source'] = (obj) => {
+  ctx.core.emit['.regex:source'] = getter((obj) => {
     const a = regexAstOf(obj)
     return emit(['str', (a && a[1]) || '(?:)'])
-  }
+  })
 
   // RegExp.prototype.flags — flag characters in canonical order (sec-get-regexp.prototype.flags).
   const FLAG_ORDER = 'dgimsvy'
-  ctx.core.emit['.regex:flags'] = (obj) => {
+  ctx.core.emit['.regex:flags'] = getter((obj) => {
     const f = flagsOf(obj)
     return emit(['str', [...FLAG_ORDER].filter(c => f.includes(c)).join('')])
-  }
+  })
 
   // Individual flag accessors → 1/0 (jz carries booleans as f64).
   for (const [prop, ch] of [
     ['global', 'g'], ['ignoreCase', 'i'], ['multiline', 'm'], ['dotAll', 's'],
     ['unicode', 'u'], ['sticky', 'y'], ['hasIndices', 'd'], ['unicodeSets', 'v'],
-  ]) ctx.core.emit[`.regex:${prop}`] = (obj) => typed(['f64.const', flagsOf(obj).includes(ch) ? 1 : 0], 'f64')
+  ]) ctx.core.emit[`.regex:${prop}`] = getter((obj) => typed(['f64.const', flagsOf(obj).includes(ch) ? 1 : 0], 'f64'))
 
-  // lastIndex — jz regexes are stateless; a freshly-evaluated regex reads 0.
-  ctx.core.emit['.regex:lastIndex'] = () => typed(['f64.const', 0], 'f64')
+  // lastIndex — for /g and /y regexes, reads the mutable global; others always 0.
+  ctx.core.emit['.regex:lastIndex'] = getter((obj) => {
+    const id = resolveRegex(obj)
+    if (id != null) {
+      const flags = flagsOf(obj)
+      if (flags.includes('g') || flags.includes('y'))
+        return typed(['f64.convert_i32_u', ['global.get', `$__re_lastIndex_${id}`]], 'f64')
+    }
+    return typed(['f64.const', 0], 'f64')
+  })
 
   // str.search(/re/) → first match position or -1
   ctx.core.emit['.string:search'] = (str, search) => {
@@ -913,15 +988,116 @@ export default (ctx) => {
         ['else', buildMatchArr(s, ms, me, nGroups, groupNames)]]], 'f64')
   }
 
-  // str.replace(/re/, repl) → replaced string
+  // str.replace(/re/, repl) → replaced string. With the `g` flag every match is
+  // replaced (a per-regex loop, mirroring split); otherwise only the first.
   ctx.core.emit['.string:replace'] = (str, search, repl) => {
     const id = resolveRegex(search)
+    const isFn = valTypeOf(repl) === VAL.CLOSURE && ctx.closure?.call
+    // ToString(fn(matchStr)) → i64 string. The closure value is hoisted into
+    // `fnL` once by the caller; each match passes its substring as the lone arg.
+    const callbackRepl = (fnL, matchStrIR) =>
+      ['call', '$__to_str', asI64(ctx.closure.call(typed(['local.get', `$${fnL}`], 'f64'), [matchStrIR]))]
     if (id == null) {
+      if (isFn) {
+        // String search + callback: replace the FIRST occurrence (spec: a string
+        // search matches once). Mirror string.js `.replace`'s callback path.
+        inc('__str_indexof', '__str_slice', '__str_concat', '__str_byteLen', '__to_str')
+        const s = temp('rps'), q = temp('rpq'), fnL = temp('rpf'), idx = tempI32('rpi'), mlen = tempI32('rpm')
+        const sI64 = () => ['i64.reinterpret_f64', ['local.get', `$${s}`]]
+        const match = typed(['call', '$__str_slice', sI64(), ['local.get', `$${idx}`],
+          ['i32.add', ['local.get', `$${idx}`], ['local.get', `$${mlen}`]]], 'f64')
+        return typed(['block', ['result', 'f64'],
+          ['local.set', `$${s}`, asF64(emit(str))],
+          ['local.set', `$${q}`, asF64(emit(search))],
+          ['local.set', `$${fnL}`, asF64(emit(repl))],
+          ['local.set', `$${mlen}`, ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${q}`]]]],
+          ['local.set', `$${idx}`, ['call', '$__str_indexof', sI64(), ['i64.reinterpret_f64', ['local.get', `$${q}`]], ['i32.const', 0]]],
+          ['if', ['result', 'f64'], ['i32.lt_s', ['local.get', `$${idx}`], ['i32.const', 0]],
+            ['then', ['local.get', `$${s}`]],
+            ['else', typed(['call', '$__str_concat',
+              asI64(typed(['call', '$__str_concat',
+                asI64(typed(['call', '$__str_slice', sI64(), ['i32.const', 0], ['local.get', `$${idx}`]], 'f64')),
+                callbackRepl(fnL, match)], 'f64')),
+              asI64(typed(['call', '$__str_slice', sI64(),
+                ['i32.add', ['local.get', `$${idx}`], ['local.get', `$${mlen}`]],
+                ['call', '$__str_byteLen', sI64()]], 'f64'))], 'f64')]]], 'f64')
+      }
       // Fall back to string replace
       inc('__str_replace')
       return typed(['call', '$__str_replace', asI64(emit(str)), asI64(emit(search)), asI64(emit(repl))], 'f64')
     }
     inc('__str_slice', '__str_concat', '__str_byteLen')
+    // Regex + callback: walk matches in IR (a WAT helper can't call a closure).
+    // One unified loop covers /g (all matches) and non-/g (break after the first).
+    if (isFn) {
+      const global = flagsOf(search).includes('g')
+      inc('__str_to_buf', '__to_str', `__regex_${id}`)
+      const s = temp('rcs'), fnL = temp('rcf'), acc = temp('rca')
+      const off = tempI32('rco'), len = tempI32('rcl'), pos = tempI32('rcp')
+      const res = tempI32('rcr'), ms = tempI32('rcms'), me = tempI32('rcme'), pe = tempI32('rcpe')
+      const sI64 = () => ['i64.reinterpret_f64', ['local.get', `$${s}`]]
+      const accI64 = () => ['i64.reinterpret_f64', ['local.get', `$${acc}`]]
+      const slice = (a, b) => typed(['call', '$__str_slice', sI64(), a, b], 'f64')
+      const matchStr = slice(['local.get', `$${ms}`], ['local.get', `$${me}`])
+      const step = [
+        ['local.set', `$${res}`, ['call', `$__regex_${id}`, ['local.get', `$${off}`], ['local.get', `$${len}`], ['local.get', `$${pos}`]]],
+        ['if', ['i32.lt_s', ['local.get', `$${res}`], ['i32.const', 0]],
+          ['then', ['local.set', `$${pos}`, ['i32.add', ['local.get', `$${pos}`], ['i32.const', 1]]], ['br', '$next']]],
+        ['local.set', `$${ms}`, ['local.get', `$${pos}`]],
+        ['local.set', `$${me}`, ['local.get', `$${res}`]],
+        ['local.set', `$${acc}`, ['call', '$__str_concat', accI64(), asI64(slice(['local.get', `$${pe}`], ['local.get', `$${ms}`]))]],
+        ['local.set', `$${acc}`, ['call', '$__str_concat', accI64(), callbackRepl(fnL, matchStr)]],
+        ['local.set', `$${pe}`, ['local.get', `$${me}`]],
+        ...(global ? [] : [['br', '$done']]),
+        ['local.set', `$${pos}`, ['select', ['i32.add', ['local.get', `$${me}`], ['i32.const', 1]], ['local.get', `$${me}`], ['i32.eq', ['local.get', `$${ms}`], ['local.get', `$${me}`]]]],
+        ['br', '$next'],
+      ]
+      return typed(['block', ['result', 'f64'],
+        ['local.set', `$${s}`, asF64(emit(str))],
+        ['local.set', `$${fnL}`, asF64(emit(repl))],
+        ['local.set', `$${off}`, ['call', '$__str_to_buf', sI64()]],
+        ['local.set', `$${len}`, ['call', '$__str_byteLen', sI64()]],
+        ['local.set', `$${pe}`, ['i32.const', 0]],
+        ['local.set', `$${pos}`, ['i32.const', 0]],
+        ['local.set', `$${acc}`, slice(['i32.const', 0], ['i32.const', 0])],
+        ['block', '$done', ['loop', '$next',
+          ['br_if', '$done', ['i32.gt_s', ['local.get', `$${pos}`], ['local.get', `$${len}`]]],
+          ...step]],
+        ['call', '$__str_concat', accI64(), asI64(slice(['local.get', `$${pe}`], ['local.get', `$${len}`]))]], 'f64')
+    }
+    // Global replace: walk every match, accumulating slice(prevEnd,matchStart)+repl.
+    // Empty seed via slice(str,0,0); zero-length matches advance by 1 (per split).
+    if (flagsOf(search).includes('g')) {
+      const replName = `__regex_replace_${id}`
+      if (!ctx.core.stdlib[replName]) {
+        inc('__str_to_buf')
+        ctx.core.stdlib[replName] = `(func $${replName} (param $str i64) (param $repl i64) (result f64)
+          (local $off i32) (local $len i32) (local $pos i32) (local $result i32)
+          (local $mstart i32) (local $mend i32) (local $prevEnd i32) (local $acc f64)
+          (local.set $off (call $__str_to_buf (local.get $str)))
+          (local.set $len (call $__str_byteLen (local.get $str)))
+          (local.set $prevEnd (i32.const 0))
+          (local.set $pos (i32.const 0))
+          (local.set $acc (call $__str_slice (local.get $str) (i32.const 0) (i32.const 0)))
+          (block $done (loop $next
+            (br_if $done (i32.gt_s (local.get $pos) (local.get $len)))
+            (local.set $result (call $__regex_${id} (local.get $off) (local.get $len) (local.get $pos)))
+            (if (i32.lt_s (local.get $result) (i32.const 0))
+              (then (local.set $pos (i32.add (local.get $pos) (i32.const 1))) (br $next)))
+            (local.set $mstart (local.get $pos))
+            (local.set $mend (local.get $result))
+            (local.set $acc (call $__str_concat (i64.reinterpret_f64 (local.get $acc))
+              (i64.reinterpret_f64 (call $__str_slice (local.get $str) (local.get $prevEnd) (local.get $mstart)))))
+            (local.set $acc (call $__str_concat (i64.reinterpret_f64 (local.get $acc)) (local.get $repl)))
+            (local.set $prevEnd (local.get $mend))
+            (local.set $pos (select (i32.add (local.get $mend) (i32.const 1)) (local.get $mend) (i32.eq (local.get $mstart) (local.get $mend))))
+            (br $next)))
+          (call $__str_concat (i64.reinterpret_f64 (local.get $acc))
+            (i64.reinterpret_f64 (call $__str_slice (local.get $str) (local.get $prevEnd) (local.get $len)))))`
+        inc(replName)
+      }
+      return typed(['call', `$${replName}`, asI64(emit(str)), asI64(emit(repl))], 'f64')
+    }
     const s = temp('sr'), r = temp('srr'), ms = tempI32('srms'), me = tempI32('srme')
     return typed(['block', ['result', 'f64'],
       ['local.set', `$${s}`, asF64(emit(str))],
@@ -939,13 +1115,67 @@ export default (ctx) => {
               ['call', '$__str_byteLen', ['i64.reinterpret_f64', ['local.get', `$${s}`]]]]]]]]], 'f64')
   }
 
+  // str.matchAll(/re/g) → array of match arrays (each like exec's result: full
+  // match at [0], capture groups after, named groups under `.groups`). JS yields
+  // a lazy iterator, but an array satisfies both `[...m]` and `for (const x of m)`.
+  // Two-pass over the same anchored matcher: count, then fill a sized array.
+  ctx.core.emit['.string:matchAll'] = (str, search) => {
+    const id = resolveRegex(search)
+    if (id == null) err('matchAll requires a regex argument')
+    const nGroups = ctx.runtime.regex.groups.get(id) || 0
+    const groupNames = ctx.runtime.regex.groupNames.get(id) || []
+    inc('__str_to_buf', '__str_byteLen', '__alloc', '__mkptr', `__regex_${id}`)
+    const s = temp('mas'), outArr = tempI32('mao')
+    const off = tempI32('maof'), len = tempI32('maln'), pos = tempI32('maps')
+    const res = tempI32('mars'), cnt = tempI32('macn'), wi = tempI32('mawi')
+    const ms = tempI32('mams'), me = tempI32('mame')
+    const sI64 = () => ['i64.reinterpret_f64', ['local.get', `$${s}`]]
+    // Anchored-matcher scan: __regex_${id}(off,len,pos) returns match-end (>=0) or
+    // -1; `body` runs per match with ms=pos, me=res; pos advances (+1 on a
+    // zero-length match to make progress). `posInit` resets the cursor per pass.
+    const scan = (body) => ['block', '$d', ['loop', '$n',
+      ['br_if', '$d', ['i32.gt_s', ['local.get', `$${pos}`], ['local.get', `$${len}`]]],
+      ['local.set', `$${res}`, ['call', `$__regex_${id}`, ['local.get', `$${off}`], ['local.get', `$${len}`], ['local.get', `$${pos}`]]],
+      ['if', ['i32.lt_s', ['local.get', `$${res}`], ['i32.const', 0]],
+        ['then', ['local.set', `$${pos}`, ['i32.add', ['local.get', `$${pos}`], ['i32.const', 1]]], ['br', '$n']]],
+      ['local.set', `$${ms}`, ['local.get', `$${pos}`]],
+      ['local.set', `$${me}`, ['local.get', `$${res}`]],
+      ...body,
+      ['local.set', `$${pos}`, ['select', ['i32.add', ['local.get', `$${me}`], ['i32.const', 1]], ['local.get', `$${me}`], ['i32.eq', ['local.get', `$${ms}`], ['local.get', `$${me}`]]]],
+      ['br', '$n']]]
+    // Re-running the matcher in the fill pass repopulates the $__re_g* capture
+    // globals just before buildMatchArr reads them — correct per-match captures.
+    const matchArr = buildMatchArr(s, ms, me, nGroups, groupNames)
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${s}`, asF64(emit(str))],
+      ['local.set', `$${off}`, ['call', '$__str_to_buf', sI64()]],
+      ['local.set', `$${len}`, ['call', '$__str_byteLen', sI64()]],
+      ['local.set', `$${cnt}`, ['i32.const', 0]],
+      ['local.set', `$${pos}`, ['i32.const', 0]],
+      scan([['local.set', `$${cnt}`, ['i32.add', ['local.get', `$${cnt}`], ['i32.const', 1]]]]),
+      ['local.set', `$${outArr}`, ['call', '$__alloc', ['i32.add', ['i32.const', 8], ['i32.shl', ['local.get', `$${cnt}`], ['i32.const', 3]]]]],
+      ['i32.store', ['local.get', `$${outArr}`], ['local.get', `$${cnt}`]],
+      ['i32.store', ['i32.add', ['local.get', `$${outArr}`], ['i32.const', 4]], ['local.get', `$${cnt}`]],
+      ['local.set', `$${outArr}`, ['i32.add', ['local.get', `$${outArr}`], ['i32.const', 8]]],
+      ['local.set', `$${wi}`, ['i32.const', 0]],
+      ['local.set', `$${pos}`, ['i32.const', 0]],
+      scan([
+        ['f64.store', ['i32.add', ['local.get', `$${outArr}`], ['i32.shl', ['local.get', `$${wi}`], ['i32.const', 3]]], matchArr],
+        ['local.set', `$${wi}`, ['i32.add', ['local.get', `$${wi}`], ['i32.const', 1]]],
+      ]),
+      mkPtrIR(PTR.ARRAY, 0, ['local.get', `$${outArr}`])], 'f64')
+  }
+
   // str.split(/re/) → array of substrings
-  ctx.core.emit['.string:split'] = (str, sep) => {
+  ctx.core.emit['.string:split'] = (str, sep, limit) => {
     const id = resolveRegex(sep)
     if (id == null) {
-      // Fall back to string split
+      // Fall back to string split, forwarding the optional limit (0x7fffffff = no limit).
+      // __str_split is 3-param (str, sep, limit); a 2-arg call here trips a wasm arity
+      // error in any program with a known-string `.split` (e.g. the watr self-host).
       inc('__str_split')
-      return typed(['call', '$__str_split', asI64(emit(str)), asI64(emit(sep))], 'f64')
+      const limitIR = limit == null ? ['i32.const', 0x7fffffff] : ['i32.trunc_sat_f64_u', asF64(emit(limit))]
+      return typed(['call', '$__str_split', asI64(emit(str)), asI64(emit(sep)), limitIR], 'f64')
     }
 
     // Generate a split-by-regex WAT function for this regex

package/module/schema.js

@@ -8,8 +8,9 @@
  */
 
 import { typed, asF64 } from '../src/ir.js'
-import { emit } from '../src/emit.js'
-import { VAL, lookupValType, repOf } from '../src/analyze.js'
+import { emit } from '../src/bridge.js'
+import { valTypeOf } from '../src/kind.js'
+import { VAL, lookupValType, repOf } from '../src/reps.js'
 import { err, inc } from '../src/ctx.js'
 
 /** Initialize schema helpers on ctx. Called once per compilation from core module. */
@@ -40,8 +41,12 @@ export function initSchema(ctx) {
 
   /** schemaId for a variable name: ValueRep first, then module-level ctx.schema.vars.
    *  Both paths exist because vars covers names without a per-function ValueRep
-   *  (prepare-phase rest/destructure tracking, module-level autoboxes). */
-  ctx.schema.idOf = (name) => repOf(name)?.schemaId ?? ctx.schema.vars.get(name)
+   *  (prepare-phase rest/destructure tracking, module-level autoboxes).
+   *  Poisoned names (shape-disagreeing assignments, see prepare's
+   *  bindAssignSchema) resolve to NO schema regardless of store: a fixed-slot
+   *  read against one literal's layout would misread the other sources. */
+  ctx.schema.idOf = (name) => ctx.schema.poisoned?.has(name) ? undefined
+    : repOf(name)?.schemaId ?? ctx.schema.vars.get(name)
 
   /** Resolve variable name to its schema props array, or null. */
   ctx.schema.resolve = (varName) => {
@@ -67,8 +72,16 @@ export function initSchema(ctx) {
    *    2. Receiver is a string variable, but its valType is unknown or not OBJECT
    *    3. Receiver is not a string variable (varName == null) — no type evidence
    *    4. Structural search finds the property at inconsistent offsets across schemas
-   *  Case 4 is a real ambiguity — the caller must route to runtime dispatch. */
-  ctx.schema.find = (varName, prop) => {
+   *  Case 4 is a real ambiguity — the caller must route to runtime dispatch.
+   *
+   *  Named `slotOf`, not `find`: under self-host the compiler calls this as
+   *  `ctx.schema.find(...)` on the statically-untyped `ctx.schema` receiver, and
+   *  `find` collides with `Array.prototype.find` — the method-call dispatcher
+   *  hijacks it into a bogus array `find` (predicate scan), returning null. Every
+   *  schema-slot property read then mis-resolved through jz.wasm (e.g. a boxed
+   *  `Object.assign(arr, {p}); arr.p`). A non-builtin name dispatches correctly.
+   *  Mirrors the abi string `concat`→`cat` rename for the same root cause. */
+  ctx.schema.slotOf = (varName, prop) => {
     // Precise: variable has known schema
     const id = ctx.schema.idOf(varName)
     if (id != null) return ctx.schema.list[id]?.indexOf(prop) ?? -1
@@ -77,6 +90,11 @@ export function initSchema(ctx) {
     // can match HASH/ARRAY/etc. values as if they had OBJECT layout, producing
     // slot reads on unrelated memory. Funnel those through dynamic dispatch.
     if (typeof varName !== 'string') return -1
+    // Poisoned names hold objects of KNOWN-disagreeing shapes; the structural
+    // closed-world bet (receiver is one of the schemas containing the prop) is
+    // exactly wrong for them — its other shapes may lack the prop while another
+    // value occupies the would-be slot. Always dynamic.
+    if (ctx.schema.poisoned?.has(varName)) return -1
     const vt = lookupValType(varName)
     if (vt !== VAL.OBJECT) return -1
     // Structural subtyping: walk only schemas that contain this prop.

package/module/simd.js

@@ -0,0 +1,85 @@
+/**
+ * SIMD module — source-level f32x4 / i32x4 intrinsics that lower 1:1 to wasm SIMD
+ * (v128). Lets a jz kernel process 4 lanes per instruction: the per-pixel-parallel
+ * kernels (mandelbrot, raymarcher) run 4 pixels/rays in masked lockstep and beat
+ * scalar V8 several-fold (validated: SIMD-4 mandelbrot ≈ 4.6× a warm-V8 scalar loop).
+ *
+ * A v128 value is just a local whose wasm type is `v128` (exprType returns 'v128'
+ * for these calls; emit passes it through without an f64/i32 coercion). Building
+ * blocks for the masked-lockstep idiom:
+ *
+ *   f32x4.splat(x)            broadcast a scalar to 4 f32 lanes
+ *   f32x4.lanes(a,b,c,d)      build a vector from 4 scalars (compile-time consts ok)
+ *   f32x4.add/sub/mul/div(a,b)
+ *   f32x4.sqrt/abs/neg/floor(a)
+ *   f32x4.min/max(a,b)
+ *   f32x4.le/lt/ge/gt/eq(a,b) → i32x4 lane mask (all-ones / all-zero per lane)
+ *   f32x4.lane(v, k)          extract lane k (0..3) as a number
+ *   i32x4.splat(n) / add/sub(a,b) / lane(v,k)
+ *   v128.and/or/xor(a,b) / not(a) / bitselect(t,f,mask)
+ *   v128.anyTrue(v) / v128.allTrue(v) → i32 (loop-exit tests)
+ *
+ * @module simd
+ */
+import { typed, asF64, asI32 } from '../src/ir.js'
+import { emit } from '../src/bridge.js'
+import { err } from '../src/ctx.js'
+
+export default (ctx) => {
+  const e = ctx.core.emit
+  const V = (node) => typed(node, 'v128')          // a v128-typed (lane vector) result
+  const I = (node) => typed(node, 'i32')            // an i32 result (lane extract / any_true)
+  const F = (node) => typed(node, 'f64')            // an f64 result (f32 lane → number)
+  const op = (a) => emit(a)                          // operand IR (v128 local.get, or a nested v128 expr) — NOT coerced to f64
+  const f32 = (a) => ['f32.demote_f64', asF64(emit(a))]   // scalar → f32 for splat/lanes
+  // lane index must be a 0..3 literal — wasm extract_lane takes an immediate, so a
+  // runtime index can't lower (and would silently read lane 0). Fail loudly instead.
+  const laneIdx = (k) => {
+    const v = typeof k === 'number' ? k : (Array.isArray(k) && k.length === 2 && k[0] == null && typeof k[1] === 'number') ? k[1] : null
+    if (v == null || (v | 0) !== v || v < 0 || v > 3)
+      err(`SIMD lane index must be a 0..3 literal (got ${JSON.stringify(k)}) — wasm extract_lane needs a constant lane.`)
+    return v
+  }
+
+  // ── build / broadcast ──────────────────────────────────────────────────────
+  e['f32x4.splat'] = (a) => V(['f32x4.splat', f32(a)])
+  e['f32x4.lanes'] = (a, b, c, d) => V(['f32x4.replace_lane', 3,
+    ['f32x4.replace_lane', 2,
+      ['f32x4.replace_lane', 1, ['f32x4.splat', f32(a)], f32(b)], f32(c)], f32(d)])
+  e['i32x4.splat'] = (a) => V(['i32x4.splat', asI32(emit(a))])
+
+  // ── f32x4 arithmetic ─────────────────────────────────────────────────────────
+  for (const o of ['add', 'sub', 'mul', 'div', 'min', 'max'])
+    e[`f32x4.${o}`] = (a, b) => V([`f32x4.${o}`, op(a), op(b)])
+  for (const o of ['sqrt', 'abs', 'neg', 'floor', 'ceil', 'trunc', 'nearest'])
+    e[`f32x4.${o}`] = (a) => V([`f32x4.${o}`, op(a)])
+
+  // ── f32x4 comparisons → i32x4 lane mask (v128 of all-ones/all-zero lanes) ─────
+  for (const o of ['eq', 'ne', 'lt', 'le', 'gt', 'ge'])
+    e[`f32x4.${o}`] = (a, b) => V([`f32x4.${o}`, op(a), op(b)])
+
+  // ── i32x4 arithmetic (iteration counters, masks as ±1) ───────────────────────
+  for (const o of ['add', 'sub', 'mul'])
+    e[`i32x4.${o}`] = (a, b) => V([`i32x4.${o}`, op(a), op(b)])
+  // i32x4 comparisons → lane mask (signed). eq/ne have no suffix; the rest are _s.
+  for (const o of ['eq', 'ne', 'lt', 'le', 'gt', 'ge'])
+    e[`i32x4.${o}`] = (a, b) => V([`i32x4.${o}${o === 'eq' || o === 'ne' ? '' : '_s'}`, op(a), op(b)])
+  // shifts by a scalar count (for float-bit twiddling: exponent extract, etc.)
+  e['i32x4.shl'] = (a, n) => V(['i32x4.shl', op(a), asI32(emit(n))])
+  e['i32x4.shr'] = (a, n) => V(['i32x4.shr_s', op(a), asI32(emit(n))])
+  e['i32x4.shrU'] = (a, n) => V(['i32x4.shr_u', op(a), asI32(emit(n))])
+  // lane-wise int → float conversion (i32x4.convert) — the value, not a bit reinterpret
+  e['f32x4.convertI32'] = (a) => V(['f32x4.convert_i32x4_s', op(a)])
+
+  // ── v128 bitwise + select + reductions ───────────────────────────────────────
+  for (const o of ['and', 'or', 'xor'])
+    e[`v128.${o}`] = (a, b) => V([`v128.${o}`, op(a), op(b)])
+  e['v128.not'] = (a) => V(['v128.not', op(a)])
+  e['v128.bitselect'] = (t, f, m) => V(['v128.bitselect', op(t), op(f), op(m)])
+  e['v128.anyTrue'] = (a) => I(['v128.any_true', op(a)])
+  e['v128.allTrue'] = (a) => I(['i32x4.all_true', op(a)])
+
+  // ── lane extract (read a single lane back to a scalar) ───────────────────────
+  e['f32x4.lane'] = (v, k) => F(['f64.promote_f32', ['f32x4.extract_lane', laneIdx(k), op(v)]])
+  e['i32x4.lane'] = (v, k) => I(['i32x4.extract_lane', laneIdx(k), op(v)])
+}