jz 0.5.1 → 0.6.0

package/module/array.js

@@ -8,11 +8,15 @@
  * @module array
  */
 
-import { typed, asF64, asI64, asI32, NULL_NAN, UNDEF_NAN, temp, tempI32, allocPtr, multiCount, arrayLoop, elemLoad, elemStore, truthyIR, extractF64Bits, appendStaticSlots, mkPtrIR, slotAddr, isLiteralStr, resolveValType, undefExpr } from '../src/ir.js'
-import { emit, buildArrayWithSpreads } from '../src/emit.js'
-import { valTypeOf, lookupValType, lookupNotString, VAL, extractParams, updateRep, staticPropertyKey, staticObjectProps, inlineArraySid } from '../src/analyze.js'
+import { typed, asF64, asI64, asI32, NULL_NAN, UNDEF_NAN, temp, tempI32, allocPtr, multiCount, arrayLoop, elemLoad, elemStore, truthyIR, extractF64Bits, appendStaticSlots, mkPtrIR, slotAddr, isLiteralStr, resolveValType, undefExpr, ptrTypeEq } from '../src/ir.js'
+import { inBoundsArrIdx } from '../src/type.js'
+import { emit, spread, deps } from '../src/bridge.js'
+import { valTypeOf } from '../src/kind.js'
+import { extractParams, classifyParam, ASSIGN_OPS, refsName, REFS_IN_EXPR } from '../src/ast.js'
+import { staticPropertyKey, staticObjectProps, inlineArraySid } from '../src/static.js'
+import { VAL, lookupValType, lookupNotString, updateRep } from '../src/reps.js'
 import { structInline } from '../src/abi/index.js'
-import { ctx, inc, err, PTR, LAYOUT } from '../src/ctx.js'
+import { ctx, inc, err, PTR, LAYOUT, followForwardingWat } from '../src/ctx.js'
 import { strHashLiteral } from './collection.js'
 
 
@@ -22,17 +26,23 @@ function allocArray(len, cap) {
   return { local: a.local, setup: [a.init], ptr: a.ptr }
 }
 
-/** Pack literal i64 slots as a static ARRAY: writes [len][cap][slots...] into the data segment
- *  and returns a folded ARRAY pointer to the first slot. */
+/** Pack literal i64 slots as a static ARRAY into the data segment, returning a
+ *  folded ARRAY pointer to the first slot. The 16-byte header MUST match
+ *  __alloc_hdr (core.js): a zeroed dyn-props word at off-16, then len/cap at
+ *  off-8/-4. Heap arrays get that props word zeroed for free; a static array with
+ *  only an 8-byte header left off-16 pointing at adjacent data-segment bytes, so
+ *  for-in / named-prop lookup (which read off-16 as the props-sidecar pointer)
+ *  walked garbage → OOB (test262 built-ins/Object/keys sparse-array). */
 function staticArrayPtr(slots) {
   if (!ctx.runtime.data) ctx.runtime.data = ''
   while (ctx.runtime.data.length % 8 !== 0) ctx.runtime.data += '\0'
   const headerOff = ctx.runtime.data.length
   const len = slots.length
-  const hdr = new Uint8Array(8); new DataView(hdr.buffer).setInt32(0, len, true); new DataView(hdr.buffer).setInt32(4, len, true)
-  for (let i = 0; i < 8; i++) ctx.runtime.data += String.fromCharCode(hdr[i])
+  const hdr = new Uint8Array(16); const dv = new DataView(hdr.buffer)
+  dv.setInt32(8, len, true); dv.setInt32(12, len, true)  // off-8: len, off-4: cap (props word at 0..7 stays 0)
+  for (let i = 0; i < 16; i++) ctx.runtime.data += String.fromCharCode(hdr[i])
   appendStaticSlots(slots)
-  return mkPtrIR(PTR.ARRAY, 0, headerOff + 8)
+  return mkPtrIR(PTR.ARRAY, 0, headerOff + 16)
 }
 
 function hoistArrayValue(arr) {
@@ -94,16 +104,8 @@ function substExpr(node, mapping) {
   return out
 }
 
-// Check whether a name is referenced inside a pure expression body.
-// Mirrors substExpr's traversal — skips property names on '.'/'?.' and object keys on ':'.
 function exprUses(node, name) {
-  if (typeof node === 'string') return node === name
-  if (!Array.isArray(node)) return false
-  const op = node[0]
-  if (op === '.' || op === '?.') return exprUses(node[1], name)
-  if (op === ':') return exprUses(node[2], name)
-  for (let i = 1; i < node.length; i++) if (exprUses(node[i], name)) return true
-  return false
+  return refsName(node, name, REFS_IN_EXPR)
 }
 
 // Callback factory: returns { setup, call, usedParams } where call(argExprs) emits the invocation.
@@ -239,26 +241,32 @@ const headerPropsToGlobalIR = () => needsArrayDynMove() ? `
             (global.set $__dyn_props (local.get $root)))))) ` : ''
 
 export default (ctx) => {
-  Object.assign(ctx.core.stdlibDeps, {
-    __arr_idx: [],
+  deps({
+    __arr_idx: ['__ptr_offset_fwd'],
     __arr_grow: arrayGrowDeps(false),
     __arr_grow_known: arrayGrowDeps(true),
     __arr_shift: () => [
       '__ptr_offset',
       ...(needsArrayDynMove() ? ['__dyn_move', '__hash_new', '__ihash_set_local'] : []),
     ],
+    __arr_fill: ['__ptr_offset'],
     __arr_set_idx_ptr: ['__arr_grow', '__ptr_offset'],
     __arr_push1: ['__arr_grow_known', '__ptr_offset'],
+    __arr_set_length: ['__arr_grow_known', '__ptr_offset', '__ptr_type'],
     __arr_unshift: ['__arr_grow', '__len', '__ptr_offset'],
+    __arr_splice: ['__arr_grow', '__len', '__ptr_offset', '__alloc_hdr', '__mkptr'],
     __typed_idx: () => ctx.features.typedarray || ctx.features.external
-      ? ['__len']
-      : ['__len', '__ptr_offset'],
+      ? ['__len', '__ptr_offset_fwd']
+      : ['__len', '__ptr_offset', '__ptr_offset_fwd'],
+    __arr_idx_known: ['__ptr_offset_fwd'],
   })
 
-  // Iteration methods (.map/.filter/.reduce/.forEach/...) invoke callbacks with
-  // (item, idx) internally — closure width must accommodate arity 2 even if no
-  // source-level closure has that arity.
-  ctx.closure.floor = Math.max(ctx.closure.floor ?? 0, 2)
+  // Iteration methods invoke callbacks with an implicit trailing index: .map/
+  // .filter/.forEach pass (item, idx); .reduce/.reduceRight pass (acc, item, idx).
+  // The uniform closure width must accommodate the widest of these (arity 3) even
+  // when no source-level closure declares that arity — otherwise a reduce callback
+  // routed through the closure path overflows the call_indirect signature.
+  ctx.closure.floor = Math.max(ctx.closure.floor ?? 0, 3)
 
   inc('__ptr_offset', '__ptr_type', '__len', '__set_len', '__typed_idx', '__is_truthy')
 
@@ -268,7 +276,7 @@ export default (ctx) => {
     const t = temp('t')
     return typed(['i32.and',
       ['f64.ne', ['local.tee', `$${t}`, v], ['local.get', `$${t}`]],
-      ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ['local.get', `$${t}`]]], ['i32.const', PTR.ARRAY]]], 'i32')
+      ptrTypeEq(['local.get', `$${t}`], PTR.ARRAY)], 'i32')
   }
 
   ctx.core.emit['new.Array'] = (len) => {
@@ -298,13 +306,7 @@ export default (ctx) => {
       (then (f64.const nan:${UNDEF_NAN}))
       (else
         (local.set $off (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
-        (block $done
-          (loop $follow
-            (br_if $done (i32.lt_u (local.get $off) (i32.const 8)))
-            (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
-            (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
-            (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-            (br $follow)))
+        ${followForwardingWat('$off', { lowGuard: true })}
         (if (result f64)
           (i32.and
             (i32.ge_u (local.get $off) (i32.const 8))
@@ -317,13 +319,7 @@ export default (ctx) => {
   ctx.core.stdlib['__arr_idx_known'] = `(func $__arr_idx_known (param $ptr i64) (param $i i32) (result f64)
     (local $off i32)
     (local.set $off (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
-    (block $done
-      (loop $follow
-        (br_if $done (i32.lt_u (local.get $off) (i32.const 8)))
-        (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
-        (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
-        (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-        (br $follow)))
+    ${followForwardingWat('$off', { lowGuard: true })}
     (if (result f64)
       (i32.and
         (i32.ge_u (local.get $off) (i32.const 8))
@@ -357,12 +353,7 @@ export default (ctx) => {
     ;; ARRAY fast path: follow forwarding inline, bounds-check against header len, f64.load — no $__len call.
     (if (i32.and (i32.eq (local.get $t) (i32.const ${PTR.ARRAY})) (i32.ge_u (local.get $off) (i32.const 8)))
       (then
-        (block $done
-          (loop $follow
-            (br_if $done (i32.gt_u (local.get $off) (i32.shl (memory.size) (i32.const 16))))
-            (br_if $done (i32.ne (i32.load (i32.sub (local.get $off) (i32.const 4))) (i32.const -1)))
-            (local.set $off (i32.load (i32.sub (local.get $off) (i32.const 8))))
-            (br $follow)))
+        ${followForwardingWat('$off', { lowGuard: false })}
         (return (if (result f64)
           (i32.and (i32.ge_s (local.get $i) (i32.const 0)) (i32.lt_u (local.get $i) (i32.load (i32.sub (local.get $off) (i32.const 8)))))
           (then (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))
@@ -433,7 +424,7 @@ export default (ctx) => {
     const op = n[0]
     if (op == null) return true                // [null,x] literal — null/number/bigint
     if (op === '=>') return false              // arrow function — callable
-    if (op === '{}' || op === 'str' || op === 'strcat' || op === '//') return true
+    if (op === '{}' || op === 'str' || op === 'strcat' || op === '//' || op === 'bool') return true  // object/string/regexp/boolean literal
     if (op === '[]' && n.length < 3) return true            // array literal
     if (op === '()' && n[1] === 'Symbol') return true       // Symbol(...) result
     return false                               // calls / member access — unknown
@@ -515,11 +506,14 @@ export default (ctx) => {
 
   // Grow array if capacity insufficient. Returns (possibly new) NaN-boxed pointer.
   // Old storage is left behind as a forwarding header so existing aliases keep
-  // seeing the current backing store after growth.
-  ctx.core.stdlib['__arr_grow'] = () => `(func $__arr_grow (param $ptr i64) (param $minCap i32) (result f64)
-    (local $t i32) (local $off i32) (local $oldCap i32) (local $newCap i32) (local $newOff i32) (local $len i32)
+  // seeing the current backing store after growth. `defensive` adds a type/bounds
+  // guard (non-array ptr → fresh 4-cap buffer) for untyped call sites; the `_known`
+  // variant skips it for hot paths that already proved the receiver is an array.
+  // Single source of truth: both stdlib entries share the grow/relocate tail.
+  const arrGrow = (name, defensive) => `(func $${name} (param $ptr i64) (param $minCap i32) (result f64)
+    ${defensive ? '(local $t i32) ' : ''}(local $off i32) (local $oldCap i32) (local $newCap i32) (local $newOff i32) (local $len i32)
     ${needsArrayDynMove() ? '(local $oldProps f64)' : ''}
-    (local.set $t (call $__ptr_type (local.get $ptr)))
+    ${defensive ? `(local.set $t (call $__ptr_type (local.get $ptr)))
     (local.set $off (call $__ptr_offset (local.get $ptr)))
     ;; Defensive path: invalid/non-array pointer -> create fresh array buffer.
     (if
@@ -529,7 +523,7 @@ export default (ctx) => {
       (then
         (local.set $newCap (select (local.get $minCap) (i32.const 4) (i32.gt_s (local.get $minCap) (i32.const 4))))
         (local.set $newOff (call $__alloc_hdr (i32.const 0) (local.get $newCap)))
-        (return (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))))
+        (return (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))))` : `(local.set $off (call $__ptr_offset (local.get $ptr)))`}
     (local.set $oldCap (i32.load (i32.sub (local.get $off) (i32.const 4))))
     (if (i32.ge_s (local.get $oldCap) (local.get $minCap))
       (then (return (f64.reinterpret_i64 (local.get $ptr)))))
@@ -546,25 +540,8 @@ export default (ctx) => {
     (i32.store (i32.sub (local.get $off) (i32.const 4)) (i32.const -1))
     (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))`
 
-  ctx.core.stdlib['__arr_grow_known'] = () => `(func $__arr_grow_known (param $ptr i64) (param $minCap i32) (result f64)
-    (local $off i32) (local $oldCap i32) (local $newCap i32) (local $newOff i32) (local $len i32)
-    ${needsArrayDynMove() ? '(local $oldProps f64)' : ''}
-    (local.set $off (call $__ptr_offset (local.get $ptr)))
-    (local.set $oldCap (i32.load (i32.sub (local.get $off) (i32.const 4))))
-    (if (i32.ge_s (local.get $oldCap) (local.get $minCap))
-      (then (return (f64.reinterpret_i64 (local.get $ptr)))))
-    (local.set $newCap (select
-      (local.get $minCap)
-      (i32.shl (local.get $oldCap) (i32.const 1))
-      (i32.gt_s (local.get $minCap) (i32.shl (local.get $oldCap) (i32.const 1)))))
-    (local.set $len (i32.load (i32.sub (local.get $off) (i32.const 8))))
-    (local.set $newOff (call $__alloc_hdr (local.get $len) (local.get $newCap)))
-    (memory.copy (local.get $newOff) (local.get $off) (i32.shl (local.get $len) (i32.const 3)))
-    ${headerPropsCopyIR()}
-    ${maybeDynMoveIR()}
-    (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $newOff))
-    (i32.store (i32.sub (local.get $off) (i32.const 4)) (i32.const -1))
-    (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))`
+  ctx.core.stdlib['__arr_grow'] = () => arrGrow('__arr_grow', true)
+  ctx.core.stdlib['__arr_grow_known'] = () => arrGrow('__arr_grow_known', false)
 
   // Hot for arr[i] = val (~18M calls in watr self-host). Compute base via __ptr_offset
   // once and read len from the inline header (i32.load base-8) — avoids __len's separate
@@ -609,6 +586,37 @@ export default (ctx) => {
     (i32.store (i32.sub (local.get $base) (i32.const 8)) (i32.add (local.get $len) (i32.const 1)))
     (local.get $p))`
 
+  // arr.length = N. Truncation (N ≤ len) just rewrites the len word in place — no
+  // relocation, so aliases keep their pointer. Growth past capacity relocates via
+  // __arr_grow_known (old header forward-marked) and undefined-fills the new slots,
+  // matching JS sparse-array semantics. Non-ARRAY receivers are left unchanged so a
+  // mistyped `.length =` cannot corrupt object/collection headers. Returns the
+  // (possibly relocated) pointer; the assignment's value is N (computed at the call site).
+  ctx.core.stdlib['__arr_set_length'] = `(func $__arr_set_length (param $ptr i64) (param $n i32) (result f64)
+    (local $base i32) (local $p f64) (local $oldLen i32) (local $cap i32) (local $k i32)
+    (local.set $p (f64.reinterpret_i64 (local.get $ptr)))
+    (if (i32.ne (call $__ptr_type (local.get $ptr)) (i32.const ${PTR.ARRAY}))
+      (then (return (local.get $p))))
+    (if (i32.lt_s (local.get $n) (i32.const 0)) (then (local.set $n (i32.const 0))))
+    (local.set $base (call $__ptr_offset (local.get $ptr)))
+    (if (i32.lt_u (local.get $base) (i32.const 8)) (then (return (local.get $p))))
+    (local.set $oldLen (i32.load (i32.sub (local.get $base) (i32.const 8))))
+    (local.set $cap (i32.load (i32.sub (local.get $base) (i32.const 4))))
+    (if (i32.gt_s (local.get $n) (local.get $cap))
+      (then
+        (local.set $p (call $__arr_grow_known (local.get $ptr) (local.get $n)))
+        (local.set $base (call $__ptr_offset (i64.reinterpret_f64 (local.get $p))))))
+    (if (i32.gt_u (local.get $n) (local.get $oldLen))
+      (then
+        (local.set $k (local.get $oldLen))
+        (block $fdone (loop $fill
+          (br_if $fdone (i32.ge_u (local.get $k) (local.get $n)))
+          (i64.store (i32.add (local.get $base) (i32.shl (local.get $k) (i32.const 3))) (i64.const ${UNDEF_NAN}))
+          (local.set $k (i32.add (local.get $k) (i32.const 1)))
+          (br $fill)))))
+    (i32.store (i32.sub (local.get $base) (i32.const 8)) (local.get $n))
+    (local.get $p))`
+
   // === Array literal ===
 
   ctx.core.emit['['] = (...elems) => {
@@ -633,10 +641,10 @@ export default (ctx) => {
       return typed(['block', ['result', 'f64'], ...body], 'f64')
     }
 
-    // Spread literal: buildArrayWithSpreads pre-sums the total length, allocates
+    // Spread literal: spread pre-sums the total length, allocates
     // exact, and bulk-copies ARRAY sources with a single memory.copy — vs the
     // per-element __arr_set_idx_ptr grow loop. Normalise the parser's `['...', x]`.
-    return buildArrayWithSpreads(elems.map(e =>
+    return spread(elems.map(e =>
       Array.isArray(e) && e[0] === '...' ? ['__spread', e[1]] : e))
   }
 
@@ -674,8 +682,8 @@ export default (ctx) => {
       const fi = fo.names.indexOf(litKey)
       if (fi >= 0) return typed(['local.get', `$${arr}#${fi}`], 'f64')
     }
-    if (litKey != null && typeof arr === 'string' && ctx.schema.find) {
-      const slot = ctx.schema.find(arr, litKey)
+    if (litKey != null && typeof arr === 'string' && ctx.schema.slotOf) {
+      const slot = ctx.schema.slotOf(arr, litKey)
       if (slot >= 0) {
         inc('__ptr_offset')
         return typed(ctx.abi.object.ops.load(['call', '$__ptr_offset', ['i64.reinterpret_f64', asF64(emit(arr))]], slot), 'f64')
@@ -776,10 +784,19 @@ export default (ctx) => {
       // f64.load is correct regardless of elem kind (returns raw f64 for NUMBER,
       // NaN-boxed pointer for OBJECT/STRING; downstream typed() handles both).
       // Fast path fires on schemaId (Array<{x,y,z}> shapes) OR plain elem-val
-      // (Array<NUMBER> from `.map(x => x*k)` etc.).
+      // (Array<NUMBER> from `.map(x => x*k)` etc.) — both are proven facts from
+      // the narrowing fixpoint (carried onto params via paramReps).
       const rep = typeof arr === 'string' ? ctx.func.localReps?.get(arr) : null
-      const hasElemFact = rep?.arrayElemSchema != null
-      if (hasElemFact && keyIsNum) {
+      const hasElemFact = rep?.arrayElemSchema != null || rep?.arrayElemValType != null
+      // Take the unchecked inline load ONLY when the index is proven in-bounds by an
+      // enclosing canonical loop `for (let i=C; i<arr.length; i++)`. Skipping the bounds
+      // check on an arbitrary numeric index is unsound: `a[1]` on a length-1 array would
+      // read the raw (uninitialized) cell instead of undefined. Constant / unproven
+      // indices fall through to __arr_idx(_known) below, which bounds-checks → UNDEF_NAN.
+      const idxProvenInBounds = hasElemFact && keyIsNum
+        && typeof arr === 'string' && typeof idx === 'string'
+        && inBoundsArrIdx(ctx).has(arr + '\x00' + idx)
+      if (idxProvenInBounds) {
         inc('__ptr_offset')
         // __ptr_offset returns i32 — base local must be i32 (not the default
         // f64 NaN-box temp). Flat tee form so downstream peepholes can fold
@@ -790,6 +807,23 @@ export default (ctx) => {
           ['local.tee', `$${baseI32}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]]],
           vi), 'f64')
       }
+      // Known-elem array, numeric key, NOT proven in-bounds → inline bounds-checked
+      // load: `idx < len ? load : undefined`. Same semantics as __arr_idx_known but
+      // inline, so watr hoists the loop-invariant len load and CSEs the base — the
+      // residual cost is a single (predictable) compare per access, not a call. Skipping
+      // the check would read raw memory for OOB indices (e.g. `a[1]` on a length-1 array).
+      if (hasElemFact && keyIsNum) {
+        inc('__ptr_offset')
+        const baseI32 = tempI32('ab'), idxI32 = tempI32('ai')
+        return typed(['if', ['result', 'f64'],
+          ['i32.lt_u',
+            ['local.tee', `$${idxI32}`, vi],
+            ['i32.load', ['i32.sub',
+              ['local.tee', `$${baseI32}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ptrExpr]]],
+              ['i32.const', 8]]]],
+          ['then', ctx.abi.array.ops.load(['local.get', `$${baseI32}`], ['local.get', `$${idxI32}`])],
+          ['else', undefExpr()]], 'f64')
+      }
       const baseTmp = temp()
       // Numeric key (literal or known-NUMBER name) → skip __is_str_key dispatch;
       // arrays don't honor string-key access for numeric keys (keys aren't coerced
@@ -842,7 +876,7 @@ export default (ctx) => {
         const keyI32 = asI32(typed(keyExpr, 'f64'))
         if (ctx.module.modules['string'] && !notString) {
           return ['if', ['result', 'f64'],
-            ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ptrExpr]], ['i32.const', PTR.STRING]],
+            ptrTypeEq(ptrExpr, PTR.STRING),
             ['then', (inc('__str_idx'), ['call', '$__str_idx', ['i64.reinterpret_f64', ptrExpr], keyI32])],
             ['else', (['call', '$__typed_idx', ['i64.reinterpret_f64', ptrExpr], keyI32])]]
         }
@@ -852,7 +886,7 @@ export default (ctx) => {
     if (ctx.module.modules['string'] && !notString)
       return typed(
         ['if', ['result', 'f64'],
-          ['i32.eq', ['call', '$__ptr_type', ['i64.reinterpret_f64', ptrExpr]], ['i32.const', PTR.STRING]],
+          ptrTypeEq(ptrExpr, PTR.STRING),
           ['then', stringLoad()],
           ['else', arrayLoad]],
         'f64')
@@ -1021,6 +1055,42 @@ export default (ctx) => {
                 (i32.store (i32.sub (local.get $rawOff) (i32.const 4)) (i32.const -1))))
             (local.get $val))))))`
 
+  // .fill(value, start?, end?) — overwrite [start, end) with value; mutate + return the
+  // array. start/end default to 0 / length and accept negatives (offset from end). The
+  // INT_MAX end sentinel clamps to length in the helper, which also normalizes negatives.
+  ctx.core.emit['.fill'] = (arr, val, start, end) => {
+    inc('__arr_fill')
+    return typed(['call', '$__arr_fill',
+      asI64(emit(arr)),
+      val == null ? undefExpr() : asF64(emit(val)),
+      start == null ? ['i32.const', 0] : asI32(emit(start)),
+      end == null ? ['i32.const', 0x7FFFFFFF] : asI32(emit(end))], 'f64')
+  }
+
+  ctx.core.stdlib['__arr_fill'] = `(func $__arr_fill (param $arr i64) (param $val f64) (param $start i32) (param $end i32) (result f64)
+    (local $off i32) (local $len i32) (local $i i32)
+    (if (i32.eq
+          (i32.wrap_i64 (i64.and (i64.shr_u (local.get $arr) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
+          (i32.const ${PTR.ARRAY}))
+      (then
+        (local.set $off (call $__ptr_offset (local.get $arr)))
+        (if (i32.ge_u (local.get $off) (i32.const 8))
+          (then
+            (local.set $len (i32.load (i32.sub (local.get $off) (i32.const 8))))
+            (if (i32.lt_s (local.get $start) (i32.const 0)) (then (local.set $start (i32.add (local.get $len) (local.get $start)))))
+            (if (i32.lt_s (local.get $start) (i32.const 0)) (then (local.set $start (i32.const 0))))
+            (if (i32.gt_s (local.get $start) (local.get $len)) (then (local.set $start (local.get $len))))
+            (if (i32.lt_s (local.get $end) (i32.const 0)) (then (local.set $end (i32.add (local.get $len) (local.get $end)))))
+            (if (i32.lt_s (local.get $end) (i32.const 0)) (then (local.set $end (i32.const 0))))
+            (if (i32.gt_s (local.get $end) (local.get $len)) (then (local.set $end (local.get $len))))
+            (local.set $i (local.get $start))
+            (block $done (loop $fill
+              (br_if $done (i32.ge_s (local.get $i) (local.get $end)))
+              (f64.store (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3))) (local.get $val))
+              (local.set $i (i32.add (local.get $i) (i32.const 1)))
+              (br $fill)))))))
+    (f64.reinterpret_i64 (local.get $arr)))`
+
   // .splice(start) | .splice(start, deleteCount) → remove range, return removed as new array
   ctx.core.emit['.splice'] = (arr, start, deleteCount) => {
     const recv = hoistArrayValue(arr)
@@ -1098,59 +1168,111 @@ export default (ctx) => {
     (i32.store (i32.sub (local.get $off) (i32.const 8)) (i32.add (local.get $len) (i32.const 1)))
     (f64.convert_i32_s (i32.add (local.get $len) (i32.const 1))))`
 
-  // .some(fn) → return 1 if any element passes, else 0 (early exit)
-  ctx.core.emit['.some'] = (arr, fn) => {
+  // .splice(start, deleteCount, ...items) with inserts → __arr_splice. Deletes
+  // `del` elements at `s`, inserts the elements of `ins`, returns the removed
+  // elements as a new array. Mutation is in place: a grow relocates the buffer
+  // but leaves a forwarding pointer, so the caller's NaN-box still resolves —
+  // no write-back needed (mirrors __arr_unshift). memory.copy is memmove, so the
+  // tail shift is correct whether the array grew (shift right) or shrank (left).
+  ctx.core.stdlib['__arr_splice'] = `(func $__arr_splice (param $arr i64) (param $start i32) (param $del i32) (param $ins i64) (result f64)
+    (local $off i32) (local $len i32) (local $s i32) (local $cnt i32)
+    (local $m i32) (local $newLen i32) (local $tail i32) (local $out f64) (local $a f64)
+    (local.set $len (call $__len (local.get $arr)))
+    (local.set $off (call $__ptr_offset (local.get $arr)))
+    (local.set $s (local.get $start))
+    (if (i32.lt_s (local.get $s) (i32.const 0))
+      (then
+        (local.set $s (i32.add (local.get $s) (local.get $len)))
+        (if (i32.lt_s (local.get $s) (i32.const 0)) (then (local.set $s (i32.const 0))))))
+    (if (i32.gt_s (local.get $s) (local.get $len)) (then (local.set $s (local.get $len))))
+    (local.set $cnt (local.get $del))
+    (if (i32.lt_s (local.get $cnt) (i32.const 0)) (then (local.set $cnt (i32.const 0))))
+    (if (i32.gt_s (i32.add (local.get $s) (local.get $cnt)) (local.get $len))
+      (then (local.set $cnt (i32.sub (local.get $len) (local.get $s)))))
+    (local.set $m (call $__len (local.get $ins)))
+    (local.set $newLen (i32.add (i32.sub (local.get $len) (local.get $cnt)) (local.get $m)))
+    (local.set $tail (i32.sub (i32.sub (local.get $len) (local.get $s)) (local.get $cnt)))
+    (local.set $out (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (call $__alloc_hdr (local.get $cnt) (local.get $cnt))))
+    (memory.copy
+      (call $__ptr_offset (i64.reinterpret_f64 (local.get $out)))
+      (i32.add (local.get $off) (i32.shl (local.get $s) (i32.const 3)))
+      (i32.shl (local.get $cnt) (i32.const 3)))
+    (local.set $a (f64.reinterpret_i64 (local.get $arr)))
+    (if (i32.gt_s (local.get $newLen) (local.get $len))
+      (then (local.set $a (call $__arr_grow (local.get $arr) (local.get $newLen)))))
+    (local.set $off (call $__ptr_offset (i64.reinterpret_f64 (local.get $a))))
+    (memory.copy
+      (i32.add (local.get $off) (i32.shl (i32.add (local.get $s) (local.get $m)) (i32.const 3)))
+      (i32.add (local.get $off) (i32.shl (i32.add (local.get $s) (local.get $cnt)) (i32.const 3)))
+      (i32.shl (local.get $tail) (i32.const 3)))
+    (memory.copy
+      (i32.add (local.get $off) (i32.shl (local.get $s) (i32.const 3)))
+      (call $__ptr_offset (local.get $ins))
+      (i32.shl (local.get $m) (i32.const 3)))
+    (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $newLen))
+    (local.get $out))`
+
+  // Early-exit callback iterator: init value, exit test, value on match.
+  const earlyExitMethod = ({ tag, init, test, onMatch, reverse }) => (arr, fn) => {
     const recv = hoistArrayValue(arr)
-    const r = temp('sr')
+    const r = temp(tag)
     const exit = `$exit${ctx.func.uniq++}`
     const cb = makeCallback(fn, callbackArgReps(arr))
     const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
-      ['if', truthyIR(cb.call([item, idxArg(cb, i)])),
-        ['then', ['local.set', `$${r}`, ['f64.const', 1]], ['br', exit]]]
-    ])
+      ['if', test(cb, i, item),
+        ['then', ['local.set', `$${r}`, onMatch(cb, i, item)], ['br', exit]]]
+    ], undefined, undefined, reverse)
     return typed(['block', ['result', 'f64'],
       recv.setup,
       cb.setup,
-      ['local.set', `$${r}`, ['f64.const', 0]],
+      ['local.set', `$${r}`, init],
       ['block', exit, ...loop],
       ['local.get', `$${r}`]], 'f64')
   }
 
-  // .every(fn) → return 1 if all elements pass, else 0 (early exit)
-  ctx.core.emit['.every'] = (arr, fn) => {
-    const recv = hoistArrayValue(arr)
-    const r = temp('ev')
-    const exit = `$exit${ctx.func.uniq++}`
-    const cb = makeCallback(fn, callbackArgReps(arr))
-    const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
-      ['if', ['i32.eqz', truthyIR(cb.call([item, idxArg(cb, i)]))],
-        ['then', ['local.set', `$${r}`, ['f64.const', 0]], ['br', exit]]]
-    ])
-    return typed(['block', ['result', 'f64'],
-      recv.setup,
-      cb.setup,
-      ['local.set', `$${r}`, ['f64.const', 1]],
-      ['block', exit, ...loop],
-      ['local.get', `$${r}`]], 'f64')
-  }
+  ctx.core.emit['.some'] = earlyExitMethod({
+    tag: 'sr',
+    init: ['f64.const', 0],
+    test: (cb, i, item) => truthyIR(cb.call([item, idxArg(cb, i)])),
+    onMatch: () => ['f64.const', 1],
+  })
 
-  // .findIndex(fn) → return index of first matching element, or -1 (early exit)
-  ctx.core.emit['.findIndex'] = (arr, fn) => {
-    const recv = hoistArrayValue(arr)
-    const r = temp('fi')
-    const exit = `$exit${ctx.func.uniq++}`
-    const cb = makeCallback(fn, callbackArgReps(arr))
-    const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
-      ['if', truthyIR(cb.call([item, idxArg(cb, i)])),
-        ['then', ['local.set', `$${r}`, ['f64.convert_i32_s', ['local.get', `$${i}`]]], ['br', exit]]]
-    ])
-    return typed(['block', ['result', 'f64'],
-      recv.setup,
-      cb.setup,
-      ['local.set', `$${r}`, ['f64.const', -1]],
-      ['block', exit, ...loop],
-      ['local.get', `$${r}`]], 'f64')
-  }
+  ctx.core.emit['.every'] = earlyExitMethod({
+    tag: 'ev',
+    init: ['f64.const', 1],
+    test: (cb, i, item) => ['i32.eqz', truthyIR(cb.call([item, idxArg(cb, i)]))],
+    onMatch: () => ['f64.const', 0],
+  })
+
+  ctx.core.emit['.findIndex'] = earlyExitMethod({
+    tag: 'fi',
+    init: ['f64.const', -1],
+    test: (cb, i, item) => truthyIR(cb.call([item, idxArg(cb, i)])),
+    onMatch: (_cb, i) => ['f64.convert_i32_s', ['local.get', `$${i}`]],
+  })
+
+  ctx.core.emit['.find'] = earlyExitMethod({
+    tag: 'ff',
+    init: ['f64.reinterpret_i64', ['i64.const', NULL_NAN]],
+    test: (cb, i, item) => truthyIR(cb.call([item, idxArg(cb, i)])),
+    onMatch: (_cb, _i, item) => item,
+  })
+
+  ctx.core.emit['.findLastIndex'] = earlyExitMethod({
+    tag: 'fli',
+    init: ['f64.const', -1],
+    test: (cb, i, item) => truthyIR(cb.call([item, idxArg(cb, i)])),
+    onMatch: (_cb, i) => ['f64.convert_i32_s', ['local.get', `$${i}`]],
+    reverse: true,
+  })
+
+  ctx.core.emit['.findLast'] = earlyExitMethod({
+    tag: 'fl',
+    init: ['f64.reinterpret_i64', ['i64.const', NULL_NAN]],
+    test: (cb, i, item) => truthyIR(cb.call([item, idxArg(cb, i)])),
+    onMatch: (_cb, _i, item) => item,
+    reverse: true,
+  })
 
   // === Array methods ===
 
@@ -1170,13 +1292,13 @@ export default (ctx) => {
   }
   function isPureCallback(fn) {
     if (!Array.isArray(fn) || fn[0] !== '=>') return false
-    const body = fn[2]
     const params = new Set()
-    const p = fn[1]
-    const raw = p == null ? [] : Array.isArray(p) ? (p[0] === ',' ? p.slice(1) : p[0] === '()' ? (p[1] == null ? [] : Array.isArray(p[1]) && p[1][0] === ',' ? p[1].slice(1) : [p[1]]) : [p]) : [p]
-    for (const r of raw) params.add(Array.isArray(r) && r[0] === '...' ? r[1] : typeof r === 'string' ? r : Array.isArray(r) && r[0] === '=' ? r[1] : null)
+    for (const r of extractParams(fn[1])) {
+      const p = classifyParam(r)
+      if (p.name) params.add(p.name)
+    }
     const locals = new Set(params)
-    collectLocals(body, locals)
+    collectLocals(fn[2], locals)
     let pure = true
     ;(function walk(node) {
       if (!pure || !Array.isArray(node)) return
@@ -1184,13 +1306,13 @@ export default (ctx) => {
       if (op === '=>') return
       if (op === '()' || op === '?.()' || op === 'new') { pure = false; return }
       if (op === '++' || op === '--') { pure = false; return }
-      if (op === '=' || op === '+=' || op === '-=' || op === '*=' || op === '/=' || op === '%=' || op === '&=' || op === '|=' || op === '^=' || op === '>>=' || op === '<<=' || op === '>>>=' || op === '||=' || op === '&&=' || op === '??=') {
+      if (ASSIGN_OPS.has(op)) {
         const t = args[0]
         if (typeof t === 'string') { if (!locals.has(t)) { pure = false; return } }
         else { pure = false; return }
       }
       for (const a of args) walk(a)
-    })(body)
+    })(fn[2])
     return pure
   }
 
@@ -1315,30 +1437,56 @@ export default (ctx) => {
       const acc = temp('ra'), mapped = temp('mv')
       const upReps = callbackArgReps(up.source)
       const mapCb = makeCallback(up.fn, upReps), redCb = makeCallback(fn)
+      const mget = typed(['local.get', `$${mapped}`], 'f64')
+      // map preserves indices → the reduce callback's index is the loop counter.
+      const fold = i => ['local.set', `$${acc}`, asF64(redCb.call([typed(['local.get', `$${acc}`], 'f64'), mget, idxArg(redCb, i, 2)]))]
       const loop = arrayLoop(recv.value, (_p, _l, i, item) => [
         ['local.set', `$${mapped}`, asF64(mapCb.call([item, idxArg(mapCb, i)]))],
-        ['local.set', `$${acc}`, asF64(redCb.call([typed(['local.get', `$${acc}`], 'f64'), typed(['local.get', `$${mapped}`], 'f64')]))]
+        // No-init: seed accumulator with the first mapped element (see base path).
+        init !== undefined ? fold(i)
+          : ['if', ['i32.eqz', ['local.get', `$${i}`]],
+              ['then', ['local.set', `$${acc}`, mget]],
+              ['else', fold(i)]]
       ])
       return typed(['block', ['result', 'f64'],
         recv.setup, mapCb.setup, redCb.setup,
-        ['local.set', `$${acc}`, init ? asF64(emit(init)) : ['f64.const', 0]],
+        ['local.set', `$${acc}`, init !== undefined ? asF64(emit(init)) : ['f64.const', 0]],
         ...loop, ['local.get', `$${acc}`]], 'f64')
     }
     // .filter(f).reduce(g, init) → single loop: test f, accumulate with g if passes
     if (up && up.method === 'filter') {
       const recv = hoistArrayValue(up.source)
       const acc = temp('ra')
+      // No-init: seed is the first *passing* element, whose index isn't known
+      // statically (filter), so track a seeded flag rather than i==0.
+      const seeded = init !== undefined ? null : tempI32('rs')
       const upReps = callbackArgReps(up.source)
       const filterCb = makeCallback(up.fn, upReps)
       // reduce cb signature: (acc, item, idx). Item rep mirrors upstream's item rep.
       const redCb = makeCallback(fn, [null, upReps[0], { val: VAL.NUMBER }])
+      // filter renumbers: the reduce index counts *passing* elements, not the
+      // source position, so track a dedicated filtered-position counter (only when
+      // the callback actually reads its index — else idxArg drops the arg anyway).
+      const usesIdx = redCb.usedParams ? !!redCb.usedParams[2] : true
+      const fpos = usesIdx ? tempI32('rp') : null
+      const fold = item => ['local.set', `$${acc}`, asF64(redCb.call([typed(['local.get', `$${acc}`], 'f64'), item, fpos ? idxArg(redCb, fpos, 2) : null]))]
+      const bump = fpos ? [['local.set', `$${fpos}`, ['i32.add', ['local.get', `$${fpos}`], ['i32.const', 1]]]] : []
+      const accumulate = item => ['block',
+        seeded
+          ? ['if', ['local.get', `$${seeded}`],
+              ['then', fold(item)],
+              ['else', ['block', ['local.set', `$${acc}`, asF64(item)], ['local.set', `$${seeded}`, ['i32.const', 1]]]]]
+          : fold(item),
+        ...bump]
       const loop = arrayLoop(recv.value, (_p, _l, i, item) => [
         ['if', truthyIR(filterCb.call([item, idxArg(filterCb, i)])),
-          ['then', ['local.set', `$${acc}`, asF64(redCb.call([typed(['local.get', `$${acc}`], 'f64'), item]))]]]
+          ['then', accumulate(item)]]
       ])
       return typed(['block', ['result', 'f64'],
         recv.setup, filterCb.setup, redCb.setup,
-        ['local.set', `$${acc}`, init ? asF64(emit(init)) : ['f64.const', 0]],
+        ...(fpos ? [['local.set', `$${fpos}`, ['i32.const', 0]]] : []),
+        ...(seeded ? [['local.set', `$${seeded}`, ['i32.const', 0]]] : []),
+        ['local.set', `$${acc}`, init !== undefined ? asF64(emit(init)) : ['f64.const', 0]],
         ...loop, ['local.get', `$${acc}`]], 'f64')
     }
     const recv = hoistArrayValue(arr)
@@ -1346,13 +1494,47 @@ export default (ctx) => {
     // reduce cb signature: (acc, item, idx). Item rep mirrors recv's elem val type.
     const reps = callbackArgReps(arr)
     const cb = makeCallback(fn, [null, reps[0], { val: VAL.NUMBER }])
-    const loop = arrayLoop(recv.value, (_ptr, _len, _i, item) => [
-      ['local.set', `$${acc}`, asF64(cb.call([typed(['local.get', `$${acc}`], 'f64'), item]))]
+    // No initial value: JS seeds the accumulator with element 0 and folds from
+    // index 1 — NOT a 0 seed folded over every element. A 0 seed is invisible
+    // for `+` (additive identity) but wrong for `*` (→0) and corrupts non-numeric
+    // folds (string reduce emits a bare `0` in the joined result). Seed at i==0.
+    const fold = (item, i) => ['local.set', `$${acc}`, asF64(cb.call([typed(['local.get', `$${acc}`], 'f64'), item, idxArg(cb, i, 2)]))]
+    const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
+      init !== undefined ? fold(item, i)
+        : ['if', ['i32.eqz', ['local.get', `$${i}`]],
+            ['then', ['local.set', `$${acc}`, asF64(item)]],
+            ['else', fold(item, i)]]
     ])
     return typed(['block', ['result', 'f64'],
       recv.setup,
       cb.setup,
-      ['local.set', `$${acc}`, init ? asF64(emit(init)) : ['f64.const', 0]],
+      ['local.set', `$${acc}`, init !== undefined ? asF64(emit(init)) : ['f64.const', 0]],
+      ...loop,
+      ['local.get', `$${acc}`]], 'f64')
+  }
+
+  // .reduceRight(fn, init) — same accumulator fold as .reduce but the last
+  // arrayLoop arg (reverse) walks elements len-1→0. No map/filter fusion: the
+  // reverse-fused shapes don't occur in practice and the base case is the only
+  // form jz emits. (Previously absent despite being autoload-declared + test262-
+  // tracked — a phantom builtin that silently returned undefined.)
+  ctx.core.emit['.reduceRight'] = (arr, fn, init) => {
+    const recv = hoistArrayValue(arr)
+    const acc = temp('ra')
+    const reps = callbackArgReps(arr)
+    const cb = makeCallback(fn, [null, reps[0], { val: VAL.NUMBER }])
+    // No-init: reverse walk seeds with the last element (i == len-1), folds down.
+    const fold = (item, i) => ['local.set', `$${acc}`, asF64(cb.call([typed(['local.get', `$${acc}`], 'f64'), item, idxArg(cb, i, 2)]))]
+    const loop = arrayLoop(recv.value, (_ptr, len, i, item) => [
+      init !== undefined ? fold(item, i)
+        : ['if', ['i32.eq', ['local.get', `$${i}`], ['i32.sub', ['local.get', `$${len}`], ['i32.const', 1]]],
+            ['then', ['local.set', `$${acc}`, asF64(item)]],
+            ['else', fold(item, i)]]
+    ], null, null, true)
+    return typed(['block', ['result', 'f64'],
+      recv.setup,
+      cb.setup,
+      ['local.set', `$${acc}`, init !== undefined ? asF64(emit(init)) : ['f64.const', 0]],
       ...loop,
       ['local.get', `$${acc}`]], 'f64')
   }
@@ -1391,23 +1573,6 @@ export default (ctx) => {
     return typed(['block', ['result', 'f64'], recv.setup, cb.setup, ...loop, ['f64.const', 0]], 'f64')
   }
 
-  ctx.core.emit['.find'] = (arr, fn) => {
-    const recv = hoistArrayValue(arr)
-    const result = temp('ff')
-    const exit = `$exit${ctx.func.uniq++}`
-    const cb = makeCallback(fn, callbackArgReps(arr))
-    const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
-      ['if', truthyIR(cb.call([item, idxArg(cb, i)])),
-        ['then', ['local.set', `$${result}`, item], ['br', exit]]]
-    ])
-    return typed(['block', ['result', 'f64'],
-      recv.setup,
-      cb.setup,
-      ['local.set', `$${result}`, ['f64.reinterpret_i64', ['i64.const', NULL_NAN]]],
-      ['block', exit, ...loop],
-      ['local.get', `$${result}`]], 'f64')
-  }
-
   // .reverse() → in-place swap arr[i] ↔ arr[len-1-i], returns the array.
   ctx.core.emit['.reverse'] = (arr) => {
     const recv = hoistArrayValue(arr)
@@ -1697,6 +1862,10 @@ export default (ctx) => {
     body.push(out.ptr)
     return typed(['block', ['result', 'f64'], ...body], 'f64')
   }
+  // Unqualified alias so an untyped-receiver `.concat` gets emit's runtime
+  // string-vs-array ptr-type branch (string → `.string:concat`, array → this),
+  // mirroring `.at`. A known-ARRAY receiver still dispatches here directly.
+  ctx.core.emit['.concat'] = ctx.core.emit['.array:concat']
 
   // .flat() → flatten one level of nested arrays
   ctx.core.stdlib['__arr_flat'] = `(func $__arr_flat (param $src i64) (result f64)