jz 0.6.0 → 0.8.0

package/module/typedarray.js

@@ -12,7 +12,7 @@ import { emit, idx, deps, call } from '../src/bridge.js'
 import { valTypeOf } from '../src/kind.js'
 import { VAL, lookupValType } from '../src/reps.js'
 import { nanPrefixHex, TYPED_ELEM_NAMES, TYPED_ELEM_CODE, TYPED_ELEM_BIGINT_FLAG, encodeTypedElemAux } from '../layout.js'
-import { inc, PTR, getter } from '../src/ctx.js'
+import { inc, PTR, LAYOUT, registerGetter } from '../src/ctx.js'
 
 const _NAN_BITS = nanPrefixHex()
 
@@ -28,6 +28,12 @@ const STORE = [
   'i32.store8', 'i32.store8', 'i32.store16', 'i32.store16',
   'i32.store', 'i32.store', 'f32.store', 'f64.store',
 ]
+// f64 value → this element's stored representation (paired with STORE). Signed
+// kinds trunc_s, unsigned trunc_u, f32 demotes, f64 stores as-is (null = identity).
+const FROM_F64 = [
+  'i32.trunc_f64_s', 'i32.trunc_f64_u', 'i32.trunc_f64_s', 'i32.trunc_f64_u',
+  'i32.trunc_f64_s', 'i32.trunc_f64_u', 'f32.demote_f64', null,
+]
 
 // SIMD: vector width per element type (elements per v128)
 const VEC_WIDTH = [16, 16, 8, 8, 4, 4, 4, 2] // 128 bits / element bits
@@ -201,6 +207,18 @@ export default (ctx) => {
     __byte_offset: ['__ptr_type', '__ptr_offset', '__ptr_aux'],
     __to_buffer: ['__ptr_type', '__ptr_offset', '__ptr_aux', '__mkptr'],
     __typed_set_idx: ['__ptr_aux', '__ptr_offset'],
+    __typed_get_idx: ['__ptr_aux', '__ptr_offset'],
+    // __clamp_idx is body-called by every range op (fill/copyWithin/subarray/slice). It has NO
+    // other manual-dep edge in the whole stdlib, so it's reachable ONLY via resolveIncludes'
+    // auto-scan — which diverges under self-host (jz.wasm), dropping it ("Unknown func
+    // $__clamp_idx" on typed .fill/.subarray in the kernel). Declare it manually here so the
+    // reliable dep path includes it. Pinned by test/selfhost-includes.js.
+    __typed_fill: ['__len', '__typed_set_idx', '__clamp_idx'],
+    __typed_reverse: ['__len', '__typed_get_idx', '__typed_set_idx'],
+    __typed_copyWithin: ['__len', '__typed_get_idx', '__typed_set_idx', '__clamp_idx'],
+    __typed_sort: ['__len', '__typed_get_idx', '__typed_set_idx'],
+    __subarray: ['__ptr_aux', '__ptr_offset', '__typed_shift', '__typed_data', '__len', '__mkptr', '__alloc', '__clamp_idx'],
+    __typed_slice_rt: ['__ptr_aux', '__typed_shift', '__typed_data', '__len', '__mkptr', '__alloc_hdr_n', '__clamp_idx'],
     // __str_join uses __typed_idx when typedarray is loaded (plain arrays promoted to
     // Int32Array by promoteIntArrayLiterals can produce PTR.TYPED results via .map()).
     __str_join: [...(ctx.core.stdlibDeps.__str_join ?? []), '__typed_idx'],
@@ -261,6 +279,60 @@ export default (ctx) => {
                   (i32.load (i32.add (local.get $off) (i32.const 8)))))
           (else (call $__mkptr (i32.const ${PTR.BUFFER}) (i32.const 0) (local.get $off)))))))`
 
+  // __subarray(ptr, begin, end, useEnd) — runtime-dispatched `.subarray(...)` for
+  // when the receiver's elem type / view-ness isn't statically known (a binding
+  // reassigned owned→view: `let c = new T(d); c = c.subarray(n)`). Reads elem type
+  // and the view bit off the aux byte, so it is correct whether `ptr` is an owned
+  // typed array or an existing view. Mirrors the static `.typed:subarray` emitter:
+  // builds the 16-byte descriptor [byteLen][dataOff][rootOff] and tags TYPED|view.
+  // Cold path (slicing, not per-element) — correctness over speed.
+  ctx.core.stdlib['__subarray'] = `(func $__subarray (param $ptr i64) (param $begin i32) (param $end i32) (param $useEnd i32) (result f64)
+    (local $aux i32) (local $shift i32) (local $off i32) (local $data i32) (local $root i32)
+    (local $len i32) (local $lo i32) (local $hi i32) (local $n i32) (local $desc i32)
+    (local.set $aux (call $__ptr_aux (local.get $ptr)))
+    (local.set $shift (call $__typed_shift (i32.and (local.get $aux) (i32.const 7))))
+    (local.set $off (call $__ptr_offset (local.get $ptr)))
+    (local.set $data (call $__typed_data (local.get $ptr)))
+    (local.set $root
+      (if (result i32) (i32.and (local.get $aux) (i32.const 8))
+        (then (i32.load (i32.add (local.get $off) (i32.const 8))))
+        (else (local.get $off))))
+    (local.set $len (call $__len (local.get $ptr)))
+    (local.set $lo (call $__clamp_idx (local.get $begin) (local.get $len)))
+    (if (local.get $useEnd)
+      (then
+        (local.set $hi (call $__clamp_idx (local.get $end) (local.get $len))))
+      (else (local.set $hi (local.get $len))))
+    (local.set $n (select (i32.sub (local.get $hi) (local.get $lo)) (i32.const 0) (i32.gt_s (local.get $hi) (local.get $lo))))
+    (local.set $desc (call $__alloc (i32.const 16)))
+    (i32.store (local.get $desc) (i32.shl (local.get $n) (local.get $shift)))
+    (i32.store (i32.add (local.get $desc) (i32.const 4)) (i32.add (local.get $data) (i32.shl (local.get $lo) (local.get $shift))))
+    (i32.store (i32.add (local.get $desc) (i32.const 8)) (local.get $root))
+    (call $__mkptr (i32.const ${PTR.TYPED}) (i32.or (local.get $aux) (i32.const 8)) (local.get $desc)))`
+
+  // __typed_slice_rt(ptr, begin, end, useEnd) — runtime-dispatched `.slice(...)` for
+  // a receiver whose elem type / view-ness isn't statically known. Unlike subarray
+  // this returns a fresh OWNED copy (bit-exact memory.copy, so bigint-safe too). Reads
+  // elem type + data address off the aux byte. Cold path — correctness over speed.
+  ctx.core.stdlib['__typed_slice_rt'] = `(func $__typed_slice_rt (param $ptr i64) (param $begin i32) (param $end i32) (param $useEnd i32) (result f64)
+    (local $aux i32) (local $et i32) (local $shift i32) (local $src i32)
+    (local $len i32) (local $lo i32) (local $hi i32) (local $n i32) (local $byteLen i32) (local $dst i32)
+    (local.set $aux (call $__ptr_aux (local.get $ptr)))
+    (local.set $et (i32.and (local.get $aux) (i32.const 7)))
+    (local.set $shift (call $__typed_shift (local.get $et)))
+    (local.set $src (call $__typed_data (local.get $ptr)))
+    (local.set $len (call $__len (local.get $ptr)))
+    (local.set $lo (call $__clamp_idx (local.get $begin) (local.get $len)))
+    (if (local.get $useEnd)
+      (then
+        (local.set $hi (call $__clamp_idx (local.get $end) (local.get $len))))
+      (else (local.set $hi (local.get $len))))
+    (local.set $n (select (i32.sub (local.get $hi) (local.get $lo)) (i32.const 0) (i32.gt_s (local.get $hi) (local.get $lo))))
+    (local.set $byteLen (i32.shl (local.get $n) (local.get $shift)))
+    (local.set $dst (call $__alloc_hdr_n (local.get $byteLen) (local.get $byteLen) (i32.const 1)))
+    (memory.copy (local.get $dst) (i32.add (local.get $src) (i32.shl (local.get $lo) (local.get $shift))) (local.get $byteLen))
+    (call $__mkptr (i32.const ${PTR.TYPED}) (i32.and (local.get $aux) (i32.const 23)) (local.get $dst)))`
+
   // Constructor: new Float64Array(len) | new F64Array(arr) | new F64Array(buf) | new F64Array(buf, off, len)
   for (const [name, elemType] of Object.entries(TYPED_ELEM_CODE)) {
     const aux = typedAux(name)
@@ -273,6 +345,7 @@ export default (ctx) => {
       // and tags the TYPED ptr with aux=elemType|8. Reads/writes alias the parent,
       // .buffer reconstructs the root BUFFER, .byteOffset = dataOff - parentOff.
       if (offsetExpr != null && lenExpr2 != null) {
+        ctx.features.typedView = true  // subview aliases the parent buffer — SLP must not assume disjoint bases
         const src = temp('tvs')
         const parentOff = tempI32('tvp')
         const byteLen = tempI32('tvb')
@@ -298,9 +371,12 @@ export default (ctx) => {
       // TYPED retagged at the same offset — the byteLen header is shared with the parent.
       // __len(view) = byteLen >> shift computes elemCount for this view's elemType.
       if (srcType === VAL.BUFFER || srcType === VAL.TYPED) {
+        ctx.features.typedView = true  // zero-copy reinterpret aliases the source — SLP must not pack across it
         return mkPtrIR(PTR.TYPED, aux, ['call', '$__ptr_offset', ['i64.reinterpret_f64', asF64(emit(lenExpr))]])
       }
       if (srcType == null && ctx.core.emit[`${name}.from`]) {
+        ctx.features.typedView = true  // unknown arg: runtime may take the buffer/typed zero-copy-view branch
+
         // Runtime dispatch: number → allocate; array → copy elements; buffer/typed → zero-copy view.
         const src = temp('ts')
         const len = tempI32('tl')
@@ -405,7 +481,7 @@ export default (ctx) => {
   // .buffer — always aliased (zero-copy). BUFFER: passthrough.
   // Owned TYPED: retag as BUFFER at same offset — the byteLen header is shared.
   // TYPED view (incl. DataView): BUFFER at descriptor[8] (root parent data offset).
-  ctx.core.emit['.buffer'] = getter((obj) => {
+  registerGetter('.buffer', (obj) => {
     if (typeof obj === 'string') {
       const ctor = ctx.types.typedElem?.get(obj)
       if (ctor === 'new.ArrayBuffer') return asF64(emit(obj))
@@ -425,7 +501,7 @@ export default (ctx) => {
 
   // .byteLength — BUFFER: raw __len. Owned TYPED: elemCount * stride.
   // View TYPED (incl. DataView): descriptor[0], via the __byte_length fallback.
-  ctx.core.emit['.byteLength'] = getter((obj) => {
+  registerGetter('.byteLength', (obj) => {
     if (typeof obj === 'string') {
       const ctor = ctx.types.typedElem?.get(obj)
       if (ctor === 'new.ArrayBuffer') {
@@ -449,7 +525,7 @@ export default (ctx) => {
   })
 
   // .byteOffset — owned: 0. View: descriptor[4] - descriptor[8].
-  ctx.core.emit['.byteOffset'] = getter((obj) => {
+  registerGetter('.byteOffset', (obj) => {
     if (typeof obj === 'string') {
       const ctor = ctx.types.typedElem?.get(obj)
       if (ctor?.endsWith('.view')) {
@@ -538,6 +614,10 @@ export default (ctx) => {
   // We treat `undefined`/`null`/`0`/`''` as falsy (BE) per ToBoolean.
   const staticLE = (node) => {
     if (node === undefined) return false                              // arg omitted → BE
+    // Prepare lowers a literal `true`/`false` endianness flag to `['bool', 0|1]`;
+    // fold it so `dv.getInt16(p, true)` is one native load (no per-access LE branch
+    // + dead byte-swap arm — the dominant overhead in DataView codec loops).
+    if (Array.isArray(node) && node[0] === 'bool') return !!node[1]
     if (Array.isArray(node) && node[0] == null) {
       // [] → undefined, [null, x] → literal x
       if (node.length === 1) return false
@@ -598,7 +678,18 @@ export default (ctx) => {
       (f64.reinterpret_i64 (i64.const ${_NAN_BITS}))
       (local.get $v)
       (f64.ne (local.get $v) (local.get $v))))`
-  const canonNaN = (vIR) => { inc('__canon_nan'); return typed(['call', '$__canon_nan', vIR], 'f64') }
+  // Inline the NaN-canonicalization select rather than a call — a DataView float
+  // read runs this per sample in codec loops, and the inlined `(select nan v (v≠v))`
+  // is the exact idiom the auto-vectorizer recognizes (vs an opaque call).
+  const canonNaN = (vIR) => {
+    const t = temp('cn')
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${t}`, vIR],
+      ['select',
+        ['f64.reinterpret_i64', ['i64.const', _NAN_BITS]],
+        ['local.get', `$${t}`],
+        ['f64.ne', ['local.get', `$${t}`], ['local.get', `$${t}`]]]], 'f64')
+  }
 
   // ToIndex for DataView byte offsets (spec 25.1.2.x getViewValue/setViewValue):
   // ToIntegerOrInfinity then reject negatives and >2^53-1 with a RangeError. The
@@ -639,8 +730,25 @@ export default (ctx) => {
   const dvIndexChecked = (offNode, size, viewSize) => {
     ctx.runtime.throws = true
     const idxT = tempI32('dvb')
+    const offIR = emit(offNode)
+    // Fast path: a proven-i32 byte offset (a loop-advanced `p`, `i*2`, a `|0` value)
+    // carries no fraction/NaN/negative-from-ToNumber surprise, so it skips the f64
+    // ToIndex round-trip and the `__dv_index` CALL — the dominant per-sample cost in
+    // DataView-based codec loops. An i32 range (`<0`) + bounds (`>viewSize-size`)
+    // check is all the spec needs here; this lowers `dv.getInt16(p,true)` to one
+    // `i32.load16_s`, matching the explicit-typed-view path.
+    if (offIR.type === 'i32') {
+      return typed(['block', ['result', 'i32'],
+        ['local.set', `$${idxT}`, offIR],
+        ['if', ['i32.or',
+            ['i32.lt_s', ['local.get', `$${idxT}`], ['i32.const', 0]],
+            ['i32.gt_s', ['local.get', `$${idxT}`], ['i32.sub', viewSize, ['i32.const', size]]]],
+          ['then', ['throw', '$__jz_err', ['f64.const', 0]]]],
+        ['local.get', `$${idxT}`]], 'i32')
+    }
+    inc('__dv_index')
     return typed(['block', ['result', 'i32'],
-      ['local.set', `$${idxT}`, dvIndex(offNode)],
+      ['local.set', `$${idxT}`, typed(['call', '$__dv_index', toNumF64(offNode, offIR)], 'i32')],
       ['if', ['i32.gt_s', ['local.get', `$${idxT}`], ['i32.sub', viewSize, ['i32.const', size]]],
         ['then', ['throw', '$__jz_err', ['f64.const', 0]]]],
       ['local.get', `$${idxT}`]], 'i32')
@@ -807,16 +915,11 @@ export default (ctx) => {
         len: ['i32.mul', ['local.get', `$${len}`], ['i32.const', stride]], stride: 1, tag: 'tf' })
       const t = out.local
       const id = ctx.func.uniq++
-      const storeExpr = elemType === 7 ? ['f64.store',
-          ['i32.add', ['local.get', `$${t}`], ['i32.mul', ['local.get', `$${i}`], ['i32.const', stride]]],
-          ['f64.load', ['i32.add', ['local.get', `$${off}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]]
-        : elemType === 6 ? ['f32.store',
-          ['i32.add', ['local.get', `$${t}`], ['i32.mul', ['local.get', `$${i}`], ['i32.const', stride]]],
-          ['f32.demote_f64', ['f64.load', ['i32.add', ['local.get', `$${off}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]]]
-        : [store,
-          ['i32.add', ['local.get', `$${t}`], ['i32.mul', ['local.get', `$${i}`], ['i32.const', stride]]],
-          [(elemType & 1) ? 'i32.trunc_f64_u' : 'i32.trunc_f64_s',
-            ['f64.load', ['i32.add', ['local.get', `$${off}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]]]
+      const conv = FROM_F64[elemType]
+      const srcF64 = ['f64.load', ['i32.add', ['local.get', `$${off}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', 3]]]]
+      const storeExpr = [store,
+        ['i32.add', ['local.get', `$${t}`], ['i32.mul', ['local.get', `$${i}`], ['i32.const', stride]]],
+        conv ? [conv, srcF64] : srcF64]
       return typed(['block', ['result', 'f64'],
         ['local.set', `$${srcL}`, asF64(emit(src))],
         ['local.set', `$${off}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${srcL}`]]]],
@@ -842,18 +945,28 @@ export default (ctx) => {
    *      at the chain output (the result is always an owned typed array). */
   const TYPED_CHAIN_METHODS = new Set(['map', 'filter', 'slice'])
   const resolveElem = (arr) => {
-    let receiver = arr, chainOutput = false
+    let receiver = arr, chainOutput = false, viewOutput = false
     // Walk method-call chain inward. `arr.method(...)` parses as
-    // ['()', ['.', recv, 'method'], ...args] — peel until we hit a name.
+    // ['()', ['.', recv, 'method'], ...args] — peel until we hit a name. The OUTERMOST
+    // op decides view-ness: `.subarray(...)` yields a zero-copy VIEW (reads must indirect
+    // through the descriptor), whereas `.map`/`.slice`/… yield a fresh non-view copy.
     while (Array.isArray(receiver) && receiver[0] === '()' &&
         Array.isArray(receiver[1]) && receiver[1][0] === '.' &&
-        TYPED_CHAIN_METHODS.has(receiver[1][2])) {
+        (TYPED_CHAIN_METHODS.has(receiver[1][2]) || receiver[1][2] === 'subarray')) {
+      if (!chainOutput) viewOutput = receiver[1][2] === 'subarray'
       receiver = receiver[1][1]
       chainOutput = true
     }
-    const ctor = typeof receiver === 'string' && ctx.types.typedElem?.get(receiver)
+    // Nested receiver `arr[i]` where `arr`'s elements are typed arrays of a known
+    // ctor (`Array.from(n, () => new Float32Array())` — codec channelData). The i-th
+    // element IS that owned typed array; emit(receiver) already loads its pointer, so
+    // the standard typedDataAddr path inlines `arr[i][j]` to a direct load/store.
+    const ctor = (Array.isArray(receiver) && receiver[0] === '[]' && receiver.length === 3 && typeof receiver[1] === 'string'
+        ? ctx.func.localReps?.get(receiver[1])?.arrayElemTypedCtor
+        : null)
+      || (typeof receiver === 'string' && ctx.types.typedElem?.get(receiver))
     if (!ctor) return null
-    const isView = !chainOutput && ctor.endsWith('.view')
+    const isView = viewOutput || (!chainOutput && ctor.endsWith('.view'))
     const name = ctor.endsWith('.view') ? ctor.slice(4, -5) : ctor.slice(4)
     const et = TYPED_ELEM_CODE[name]
     return et == null ? null : { et, isView, isBigInt: name === 'BigInt64Array' || name === 'BigUint64Array' }
@@ -863,71 +976,22 @@ export default (ctx) => {
    *  Owned: low 32 bits of the NaN-box (or the unboxed local directly).
    *  View: load descriptor[4]. Uses ptrOffsetIR so unboxed-TYPED locals pass through
    *  without a rebox-then-unbox round trip, and globals fold to inline bit-extract. */
+  // A typed array (Float64Array/Int32Array/…) is a FIXED-SIZE allocation — it has no
+  // grow op, so it can never relocate, so its base needs no realloc-forwarding follow.
+  // An already-unboxed pointer is the offset itself; a boxed f64 pointer extracts its
+  // low-32 offset directly — no __ptr_offset call. (The general ptrOffsetIR keeps the
+  // forwarding follow because ARRAY/HASH/SET/MAP relocate and an *inferred* OBJECT can
+  // alias a relocated ARRAY — but VAL.TYPED is a narrow type that can only be a real
+  // typed array, so the follow is provably dead here.)
+  const typedBase = (objIR) => objIR.ptrKind != null && objIR.ptrKind !== VAL.ARRAY
+    ? objIR
+    : ['i32.wrap_i64', ['i64.and', ['i64.reinterpret_f64', asF64(objIR)], ['i64.const', LAYOUT.OFFSET_MASK]]]
   const typedDataAddr = (objIR, isView) => isView
-    ? ['i32.load', ['i32.add', ptrOffsetIR(objIR, VAL.TYPED), ['i32.const', 4]]]
-    : ptrOffsetIR(objIR, VAL.TYPED)
+    ? ['i32.load', ['i32.add', typedBase(objIR), ['i32.const', 4]]]
+    : typedBase(objIR)
 
   // Runtime-dispatch typed index: checks ptr_type + aux to load with correct stride.
   // For TYPED views (aux bit 3), $off indirects through descriptor[4] to real data.
-  // Factory — collapses to ARRAY-only f64 indexing when no TYPED pointer can reach here.
-  // Identical factory in array.js; whichever module loads last wins the registration.
-  ctx.core.stdlib['__typed_idx'] = () => {
-    if (!ctx.features.typedarray && !ctx.features.external) {
-      return `(func $__typed_idx (param $ptr i64) (param $i i32) (result f64)
-    (local $len i32)
-    (local.set $len (call $__len (local.get $ptr)))
-    (if (result f64)
-      (i32.or
-        (i32.lt_s (local.get $i) (i32.const 0))
-        (i32.ge_u (local.get $i) (local.get $len)))
-      (then (f64.const nan:${UNDEF_NAN}))
-      (else (f64.load (i32.add (call $__ptr_offset (local.get $ptr)) (i32.shl (local.get $i) (i32.const 3)))))))`
-    }
-    return `(func $__typed_idx (param $ptr i64) (param $i i32) (result f64)
-    (local $off i32) (local $et i32) (local $len i32) (local $aux i32)
-    (local.set $off (call $__ptr_offset (local.get $ptr)))
-    ;; ARRAY fast path: __ptr_offset already followed any forwarding — read header len + f64.load, no $__len call.
-    (if (i32.and (i32.eq (call $__ptr_type (local.get $ptr)) (i32.const ${PTR.ARRAY})) (i32.ge_u (local.get $off) (i32.const 8)))
-      (then (return (if (result f64)
-        (i32.and (i32.ge_s (local.get $i) (i32.const 0)) (i32.lt_u (local.get $i) (i32.load (i32.sub (local.get $off) (i32.const 8)))))
-        (then (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))
-        (else (f64.const nan:${UNDEF_NAN}))))))
-    (local.set $aux (call $__ptr_aux (local.get $ptr)))
-    (if
-      (i32.and
-        (i32.eq (call $__ptr_type (local.get $ptr)) (i32.const ${PTR.TYPED}))
-        (i32.ne (i32.and (local.get $aux) (i32.const 8)) (i32.const 0)))
-      (then (local.set $off (i32.load (i32.add (local.get $off) (i32.const 4))))))
-    (local.set $len (call $__len (local.get $ptr)))
-    (if (result f64)
-      (i32.or
-        (i32.lt_s (local.get $i) (i32.const 0))
-        (i32.ge_u (local.get $i) (local.get $len)))
-      (then (f64.const nan:${UNDEF_NAN}))
-      (else
-        (if (result f64) (i32.eq (call $__ptr_type (local.get $ptr)) (i32.const ${PTR.TYPED}))
-          (then
-            (local.set $et (i32.and (local.get $aux) (i32.const 7)))
-            (if (result f64) (i32.ge_u (local.get $et) (i32.const 6))
-              (then (if (result f64) (i32.eq (local.get $et) (i32.const 7))
-                (then (if (result f64) (i32.and (local.get $aux) (i32.const ${TYPED_ELEM_BIGINT_FLAG}))
-                  (then (f64.reinterpret_i64 (i64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3))))))
-                  (else (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))))
-                (else (f64.promote_f32 (f32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))))
-              (else (if (result f64) (i32.ge_u (local.get $et) (i32.const 4))
-                (then (if (result f64) (i32.and (local.get $et) (i32.const 1))
-                  (then (f64.convert_i32_u (i32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))
-                  (else (f64.convert_i32_s (i32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))))
-                (else (if (result f64) (i32.ge_u (local.get $et) (i32.const 2))
-                  (then (if (result f64) (i32.and (local.get $et) (i32.const 1))
-                    (then (f64.convert_i32_u (i32.load16_u (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 1))))))
-                    (else (f64.convert_i32_s (i32.load16_s (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 1))))))))
-                  (else (if (result f64) (i32.and (local.get $et) (i32.const 1))
-                    (then (f64.convert_i32_u (i32.load8_u (i32.add (local.get $off) (local.get $i)))))
-                    (else (f64.convert_i32_s (i32.load8_s (i32.add (local.get $off) (local.get $i)))))))))))))
-          (else (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))))))`
-  }
-
   ctx.core.stdlib['__typed_set_idx'] = `(func $__typed_set_idx (param $ptr i64) (param $i i32) (param $v f64) (result f64)
     (local $off i32) (local $aux i32) (local $et i32) (local $bits i32)
     (local.set $aux (call $__ptr_aux (local.get $ptr)))
@@ -956,6 +1020,209 @@ export default (ctx) => {
                     (else (i32.store8 (i32.add (local.get $off) (local.get $i)) (local.get $bits))))))))))))
     (local.get $v))`
 
+  // .fill(value, start?, end?) for typed arrays. The plain-array __arr_fill gates
+  // on PTR.ARRAY and silently no-ops a typed receiver (the storage layout and
+  // element width differ); this loops the element-width-aware __typed_set_idx
+  // over the clamped range so every element kind (u8…f64, BigInt) fills correctly.
+  // start/end default 0/length, accept negatives, and clamp to [0, length].
+  ctx.core.stdlib['__typed_fill'] = `(func $__typed_fill (param $ptr i64) (param $val f64) (param $start i32) (param $end i32) (result f64)
+    (local $len i32) (local $i i32)
+    (local.set $len (call $__len (local.get $ptr)))
+    (local.set $start (call $__clamp_idx (local.get $start) (local.get $len)))
+    (local.set $end (call $__clamp_idx (local.get $end) (local.get $len)))
+    (local.set $i (local.get $start))
+    (block $done (loop $fill
+      (br_if $done (i32.ge_s (local.get $i) (local.get $end)))
+      (drop (call $__typed_set_idx (local.get $ptr) (local.get $i) (local.get $val)))
+      (local.set $i (i32.add (local.get $i) (i32.const 1)))
+      (br $fill)))
+    (f64.reinterpret_i64 (local.get $ptr)))`
+
+  // Element-width/-kind-aware read: arr[i] → f64, the read mirror of __typed_set_idx.
+  // Integers convert by signedness (et&1 ⇒ unsigned); BigInt returns the raw i64 bits
+  // reinterpreted as f64 so a get→set roundtrip is bit-exact (set_idx stores the bits
+  // back unchanged). Used by the in-place algorithms below for random-access reads.
+  ctx.core.stdlib['__typed_get_idx'] = `(func $__typed_get_idx (param $ptr i64) (param $i i32) (result f64)
+    (local $off i32) (local $aux i32) (local $et i32)
+    (local.set $aux (call $__ptr_aux (local.get $ptr)))
+    (local.set $off (call $__ptr_offset (local.get $ptr)))
+    (if (i32.and (local.get $aux) (i32.const 8))
+      (then (local.set $off (i32.load (i32.add (local.get $off) (i32.const 4))))))
+    (local.set $et (i32.and (local.get $aux) (i32.const 7)))
+    (if (result f64) (i32.and (local.get $aux) (i32.const ${TYPED_ELEM_BIGINT_FLAG}))
+      (then (f64.reinterpret_i64 (i64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3))))))
+      (else (if (result f64) (i32.eq (local.get $et) (i32.const 7))
+        (then (f64.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3)))))
+        (else (if (result f64) (i32.eq (local.get $et) (i32.const 6))
+          (then (f64.promote_f32 (f32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))
+          (else (if (result f64) (i32.ge_u (local.get $et) (i32.const 4))
+            (then (if (result f64) (i32.and (local.get $et) (i32.const 1))
+              (then (f64.convert_i32_u (i32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))
+              (else (f64.convert_i32_s (i32.load (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 2))))))))
+            (else (if (result f64) (i32.ge_u (local.get $et) (i32.const 2))
+              (then (if (result f64) (i32.and (local.get $et) (i32.const 1))
+                (then (f64.convert_i32_u (i32.load16_u (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 1))))))
+                (else (f64.convert_i32_s (i32.load16_s (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 1))))))))
+              (else (if (result f64) (i32.and (local.get $et) (i32.const 1))
+                (then (f64.convert_i32_u (i32.load8_u (i32.add (local.get $off) (local.get $i)))))
+                (else (f64.convert_i32_s (i32.load8_s (i32.add (local.get $off) (local.get $i)))))))))))))))))`
+
+  // .reverse() — in-place, element-kind-agnostic via get/set (bit-exact for BigInt).
+  ctx.core.stdlib['__typed_reverse'] = `(func $__typed_reverse (param $ptr i64) (result f64)
+    (local $len i32) (local $i i32) (local $j i32) (local $t f64)
+    (local.set $len (call $__len (local.get $ptr)))
+    (local.set $i (i32.const 0))
+    (local.set $j (i32.sub (local.get $len) (i32.const 1)))
+    (block $done (loop $rev
+      (br_if $done (i32.ge_s (local.get $i) (local.get $j)))
+      (local.set $t (call $__typed_get_idx (local.get $ptr) (local.get $i)))
+      (drop (call $__typed_set_idx (local.get $ptr) (local.get $i) (call $__typed_get_idx (local.get $ptr) (local.get $j))))
+      (drop (call $__typed_set_idx (local.get $ptr) (local.get $j) (local.get $t)))
+      (local.set $i (i32.add (local.get $i) (i32.const 1)))
+      (local.set $j (i32.sub (local.get $j) (i32.const 1)))
+      (br $rev)))
+    (f64.reinterpret_i64 (local.get $ptr)))`
+
+  // .copyWithin(target, start, end) — in-place overlap-safe move. Indices accept
+  // negatives (from end) and clamp to [0, len]; count = min(end-start, len-target).
+  // Direction picked so overlapping ranges don't clobber unread source elements.
+  ctx.core.stdlib['__typed_copyWithin'] = `(func $__typed_copyWithin (param $ptr i64) (param $target i32) (param $start i32) (param $end i32) (result f64)
+    (local $len i32) (local $count i32) (local $k i32)
+    (local.set $len (call $__len (local.get $ptr)))
+    (local.set $target (call $__clamp_idx (local.get $target) (local.get $len)))
+    (local.set $start (call $__clamp_idx (local.get $start) (local.get $len)))
+    (local.set $end (call $__clamp_idx (local.get $end) (local.get $len)))
+    (local.set $count (i32.sub (local.get $end) (local.get $start)))
+    (if (i32.gt_s (local.get $count) (i32.sub (local.get $len) (local.get $target)))
+      (then (local.set $count (i32.sub (local.get $len) (local.get $target)))))
+    (if (i32.lt_s (local.get $target) (local.get $start))
+      (then
+        (local.set $k (i32.const 0))
+        (block $fd (loop $fl
+          (br_if $fd (i32.ge_s (local.get $k) (local.get $count)))
+          (drop (call $__typed_set_idx (local.get $ptr) (i32.add (local.get $target) (local.get $k))
+            (call $__typed_get_idx (local.get $ptr) (i32.add (local.get $start) (local.get $k)))))
+          (local.set $k (i32.add (local.get $k) (i32.const 1)))
+          (br $fl))))
+      (else
+        (local.set $k (local.get $count))
+        (block $bd (loop $bl
+          (br_if $bd (i32.le_s (local.get $k) (i32.const 0)))
+          (local.set $k (i32.sub (local.get $k) (i32.const 1)))
+          (drop (call $__typed_set_idx (local.get $ptr) (i32.add (local.get $target) (local.get $k))
+            (call $__typed_get_idx (local.get $ptr) (i32.add (local.get $start) (local.get $k)))))
+          (br $bl)))))
+    (f64.reinterpret_i64 (local.get $ptr)))`
+
+  // .sort() — default numeric order (insertion sort, stable). NaN sorts to the end,
+  // -0 before +0 (the equal-value tiebreak via signed-bit compare). BigInt arrays are
+  // compared as signed i64 on their exact bits. A user comparator is handled inline by
+  // the .typed:sort emitter (this helper is the no-argument numeric path).
+  ctx.core.stdlib['__typed_sort'] = `(func $__typed_sort (param $ptr i64) (result f64)
+    (local $isbig i32) (local $len i32) (local $i i32) (local $j i32) (local $saved f64) (local $nb f64)
+    (local.set $isbig (i32.and (call $__ptr_aux (local.get $ptr)) (i32.const ${TYPED_ELEM_BIGINT_FLAG})))
+    (local.set $len (call $__len (local.get $ptr)))
+    (local.set $i (i32.const 1))
+    (block $od (loop $ol
+      (br_if $od (i32.ge_s (local.get $i) (local.get $len)))
+      (local.set $saved (call $__typed_get_idx (local.get $ptr) (local.get $i)))
+      (local.set $j (i32.sub (local.get $i) (i32.const 1)))
+      (block $id (loop $il
+        (br_if $id (i32.lt_s (local.get $j) (i32.const 0)))
+        (local.set $nb (call $__typed_get_idx (local.get $ptr) (local.get $j)))
+        (br_if $id (i32.eqz
+          (if (result i32) (local.get $isbig)
+            (then (i64.gt_s (i64.reinterpret_f64 (local.get $nb)) (i64.reinterpret_f64 (local.get $saved))))
+            (else (if (result i32) (f64.ne (local.get $nb) (local.get $nb))
+              (then (i32.eqz (f64.ne (local.get $saved) (local.get $saved))))
+              (else (if (result i32) (f64.ne (local.get $saved) (local.get $saved))
+                (then (i32.const 0))
+                (else (if (result i32) (f64.gt (local.get $nb) (local.get $saved))
+                  (then (i32.const 1))
+                  (else (if (result i32) (f64.lt (local.get $nb) (local.get $saved))
+                    (then (i32.const 0))
+                    (else (i64.gt_s (i64.reinterpret_f64 (local.get $nb)) (i64.reinterpret_f64 (local.get $saved)))))))))))))))
+        (drop (call $__typed_set_idx (local.get $ptr) (i32.add (local.get $j) (i32.const 1)) (local.get $nb)))
+        (local.set $j (i32.sub (local.get $j) (i32.const 1)))
+        (br $il)))
+      (drop (call $__typed_set_idx (local.get $ptr) (i32.add (local.get $j) (i32.const 1)) (local.get $saved)))
+      (local.set $i (i32.add (local.get $i) (i32.const 1)))
+      (br $ol)))
+    (f64.reinterpret_i64 (local.get $ptr)))`
+
+  ctx.core.emit['.typed:fill'] = (arr, val, start, end) => {
+    inc('__typed_fill')
+    return typed(['call', '$__typed_fill',
+      asI64(emit(arr)),
+      val == null ? undefExpr() : asF64(emit(val)),
+      start == null ? ['i32.const', 0] : asI32(emit(start)),
+      end == null ? ['i32.const', 0x7FFFFFFF] : asI32(emit(end))], 'f64')
+  }
+
+  // .reverse() / .copyWithin(...) for typed arrays. The plain-array helpers gate on
+  // PTR.ARRAY and silently no-op a typed receiver; these go through the element-kind-
+  // aware get/set helpers so every width and signedness reverses/moves correctly.
+  ctx.core.emit['.typed:reverse'] = (arr) => {
+    inc('__typed_reverse')
+    return typed(['call', '$__typed_reverse', asI64(emit(arr))], 'f64')
+  }
+
+  ctx.core.emit['.typed:copyWithin'] = (arr, target, start, end) => {
+    inc('__typed_copyWithin')
+    return typed(['call', '$__typed_copyWithin',
+      asI64(emit(arr)),
+      target == null ? ['i32.const', 0] : asI32(emit(target)),
+      start == null ? ['i32.const', 0] : asI32(emit(start)),
+      end == null ? ['i32.const', 0x7FFFFFFF] : asI32(emit(end))], 'f64')
+  }
+
+  // .sort(compareFn?) for typed arrays. No argument → the numeric __typed_sort helper
+  // (typed-array default is NUMERIC, unlike Array.sort's lexicographic default — so it
+  // must NOT route through the plain-array string comparator). With a comparator, an
+  // insertion sort is emitted inline, calling the closure per neighbor compare; a
+  // positive return shifts (same convention as Array.prototype.sort).
+  // Sort the typed array VALUE `arrValIR` in place and return it. Factored out so
+  // .typed:sort sorts the receiver and .typed:toSorted sorts a fresh copy with one body.
+  const emitTypedSort = (arrValIR, fn) => {
+    if (fn == null) {
+      inc('__typed_sort')
+      return typed(['call', '$__typed_sort', asI64(arrValIR)], 'f64')
+    }
+    inc('__len', '__typed_get_idx', '__typed_set_idx')
+    const arrL = temp('tsa'), cbL = temp('tsf')
+    const len = tempI32('tsn'), i = tempI32('tsi'), j = tempI32('tsj')
+    const cur = temp('tsc'), nb = temp('tsb')
+    const id = ctx.func.uniq++
+    const oE = `$tsoe${id}`, oL = `$tsol${id}`, iE = `$tsie${id}`, iL = `$tsil${id}`
+    const ptr = () => ['i64.reinterpret_f64', ['local.get', `$${arrL}`]]
+    const jp1 = ['i32.add', ['local.get', `$${j}`], ['i32.const', 1]]
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${arrL}`, asF64(arrValIR)],
+      ['local.set', `$${cbL}`, asF64(emit(fn))],
+      ['local.set', `$${len}`, ['call', '$__len', ptr()]],
+      ['local.set', `$${i}`, ['i32.const', 1]],
+      ['block', oE, ['loop', oL,
+        ['br_if', oE, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${len}`]]],
+        ['local.set', `$${cur}`, ['call', '$__typed_get_idx', ptr(), ['local.get', `$${i}`]]],
+        ['local.set', `$${j}`, ['i32.sub', ['local.get', `$${i}`], ['i32.const', 1]]],
+        ['block', iE, ['loop', iL,
+          ['br_if', iE, ['i32.lt_s', ['local.get', `$${j}`], ['i32.const', 0]]],
+          ['local.set', `$${nb}`, ['call', '$__typed_get_idx', ptr(), ['local.get', `$${j}`]]],
+          // Break unless cmp(neighbor, cur) > 0. f64.gt is false for NaN (spec NaN-as-0).
+          ['br_if', iE, ['i32.eqz', ['f64.gt',
+            asF64(ctx.closure.call(typed(['local.get', `$${cbL}`], 'f64'),
+              [typed(['local.get', `$${nb}`], 'f64'), typed(['local.get', `$${cur}`], 'f64')])),
+            ['f64.const', 0]]]],
+          ['drop', ['call', '$__typed_set_idx', ptr(), jp1, ['local.get', `$${nb}`]]],
+          ['local.set', `$${j}`, ['i32.sub', ['local.get', `$${j}`], ['i32.const', 1]]],
+          ['br', iL]]],
+        ['drop', ['call', '$__typed_set_idx', ptr(), jp1, ['local.get', `$${cur}`]]],
+        ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
+        ['br', oL]]],
+      ['local.get', `$${arrL}`]], 'f64')
+  }
+  ctx.core.emit['.typed:sort'] = (arr, fn) => emitTypedSort(emit(arr), fn)
+
   // Type-aware TypedArray read: arr[i]
   ctx.core.emit['.typed:[]'] = (arr, i) => {
     const r = resolveElem(arr)
@@ -1007,20 +1274,28 @@ export default (ctx) => {
         ['f32.store', off, ['f32.demote_f64', ['local.get', `$${vt}`]]],
         ['local.get', `$${vt}`]], void_ ? 'void' : 'f64') // Float32Array
     }
-    // Integer store: when the source is already i32-typed (bitwise ops, |0,
-    // typed-array load, known-i32 var), store it directly — skip the f64
-    // detour that costs a sign branch + i64 trunc + i32 wrap on every write.
-    if (valIR.type === 'i32') {
-      const cheap = Array.isArray(valIR) &&
-        ((valIR[0] === 'local.get' && typeof valIR[1] === 'string') ||
-         (valIR[0] === 'i32.const' && (typeof valIR[1] === 'number' || typeof valIR[1] === 'string')))
-      if (void_ && cheap) return typed([STORE[et], off, valIR], 'void')
+    // Integer store: when the source is already i32-typed (bitwise ops, |0, known-i32 var) —
+    // OR an `f64.convert_i32_*` that peels back to i32 (an Int8/Uint8/Int16/… element READ
+    // materialized as f64 by the universal value model) — store the i32 low bits directly,
+    // skipping the f64 detour that costs a sign branch + i64 trunc + i32 wrap on every write.
+    // This eradicates the f64 round-trip on byte/typed-array TRANSFORMS — `out[i] = table[in[j]]`
+    // and `dst[i] = src[j]` (base64, qoi, wav, blur) — where both sides are integer elements.
+    // `store8/16` mask the low bits, so storing the convert's i32 source is bit-identical; the
+    // non-void result reboxes that i32 to f64 (the assignment's RHS value, in element range here).
+    const i32Backed = valIR.type === 'i32' ||
+      (Array.isArray(valIR) && (valIR[0] === 'f64.convert_i32_s' || valIR[0] === 'f64.convert_i32_u'))
+    if (i32Backed) {
+      const vi = asI32(valIR)
+      const cheap = Array.isArray(vi) &&
+        ((vi[0] === 'local.get' && typeof vi[1] === 'string') ||
+         (vi[0] === 'i32.const' && (typeof vi[1] === 'number' || typeof vi[1] === 'string')))
+      if (void_ && cheap) return typed([STORE[et], off, vi], 'void')
       const v32 = tempI32('tw')
       return typed(void_ ? ['block',
-        ['local.set', `$${v32}`, valIR],
+        ['local.set', `$${v32}`, vi],
         [STORE[et], off, ['local.get', `$${v32}`]]]
         : ['block', ['result', 'f64'],
-        ['local.set', `$${v32}`, valIR],
+        ['local.set', `$${v32}`, vi],
         [STORE[et], off, ['local.get', `$${v32}`]],
         [(et & 1) ? 'f64.convert_i32_u' : 'f64.convert_i32_s', ['local.get', `$${v32}`]]], void_ ? 'void' : 'f64')
     }
@@ -1257,18 +1532,54 @@ export default (ctx) => {
 
   // .indexOf: scalar value-equality search. Returns -1 on miss. Compare on f64
   // — Array.prototype.indexOf uses strict equality (NaN ≠ NaN).
-  ctx.core.emit['.typed:indexOf'] = (arr, val) => {
-    const found = tempI32('tif'), needle = temp('tin')
-    const loop = typedLoop(arr, (load, i, _len, _ptr, exit) => [
-      ['if', ['f64.eq', load(), ['local.get', `$${needle}`]],
-        ['then',
-          ['local.set', `$${found}`, ['local.get', `$${i}`]],
-          ['br', exit]]]
-    ])
+  // Effective start index for a fromIndex arg: negative counts from the end. The match
+  // guard is `i >= start` and i ≥ 0, so a start below 0 needs no clamp (always passes).
+  const fromStart = (fiL, len) => ['if', ['result', 'i32'],
+    ['i32.lt_s', ['local.get', `$${fiL}`], ['i32.const', 0]],
+    ['then', ['i32.add', ['local.get', `$${fiL}`], ['local.get', `$${len}`]]],
+    ['else', ['local.get', `$${fiL}`]]]
+
+  ctx.core.emit['.typed:indexOf'] = (arr, val, fromIndex) => {
+    const found = tempI32('tif'), needle = temp('tin'), fiL = tempI32('tifx')
+    const loop = typedLoop(arr, (load, i, len, _ptr, exit) => {
+      const matched = ['f64.eq', load(), ['local.get', `$${needle}`]]
+      const cond = fromIndex == null ? matched
+        : ['i32.and', ['i32.ge_s', ['local.get', `$${i}`], fromStart(fiL, len)], matched]
+      return [['if', cond, ['then',
+        ['local.set', `$${found}`, ['local.get', `$${i}`]], ['br', exit]]]]
+    })
     if (!loop) return null
     return typed(['block', ['result', 'f64'],
       ['local.set', `$${needle}`, asF64(emit(val))],
       ['local.set', `$${found}`, ['i32.const', -1]],
+      ...(fromIndex == null ? [] : [['local.set', `$${fiL}`, asI32(emit(fromIndex))]]),
+      ...loop.setup,
+      ['f64.convert_i32_s', ['local.get', `$${found}`]]], 'f64')
+  }
+
+  // .lastIndexOf(val): the last index whose element strictly-equals val, else -1.
+  // Was unimplemented for typed arrays (threw). A forward scan that keeps the latest
+  // match needs no reverse iteration — equivalent for the no-fromIndex form, which is
+  // the common case. With a fromIndex the matcher additionally bounds i ≤ fromIndex
+  // (negative counts from the end, resolved against the typedLoop len). NaN never
+  // strict-equals (f64.eq), matching JS.
+  ctx.core.emit['.typed:lastIndexOf'] = (arr, val, fromIndex) => {
+    const found = tempI32('tlf'), needle = temp('tln'), fiL = tempI32('tlfi')
+    const loop = typedLoop(arr, (load, i, len) => {
+      const matched = ['f64.eq', load(), ['local.get', `$${needle}`]]
+      if (fromIndex == null)
+        return [['if', matched, ['then', ['local.set', `$${found}`, ['local.get', `$${i}`]]]]]
+      const lim = ['if', ['result', 'i32'], ['i32.lt_s', ['local.get', `$${fiL}`], ['i32.const', 0]],
+        ['then', ['i32.add', ['local.get', `$${fiL}`], ['local.get', `$${len}`]]],
+        ['else', ['local.get', `$${fiL}`]]]
+      return [['if', ['i32.and', ['i32.le_s', ['local.get', `$${i}`], lim], matched],
+        ['then', ['local.set', `$${found}`, ['local.get', `$${i}`]]]]]
+    })
+    if (!loop) return null
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${needle}`, asF64(emit(val))],
+      ['local.set', `$${found}`, ['i32.const', -1]],
+      ...(fromIndex == null ? [] : [['local.set', `$${fiL}`, asI32(emit(fromIndex))]]),
       ...loop.setup,
       ['f64.convert_i32_s', ['local.get', `$${found}`]]], 'f64')
   }
@@ -1276,21 +1587,23 @@ export default (ctx) => {
   // .includes: like indexOf but NaN-equal-NaN (JS spec). Stash needle bits as
   // i64 and compare via i64.eq so two NaNs with matching bit patterns match
   // (f64.eq would say false).
-  ctx.core.emit['.typed:includes'] = (arr, val) => {
-    const found = tempI32('thf'), needle = temp('thn')
-    const loop = typedLoop(arr, (load, _i, _len, _ptr, exit) => [
-      ['if',
-        ['i32.or',
-          ['f64.eq', load(), ['local.get', `$${needle}`]],
-          ['i64.eq',
-            ['i64.reinterpret_f64', load()],
-            ['i64.reinterpret_f64', ['local.get', `$${needle}`]]]],
-        ['then', ['local.set', `$${found}`, ['i32.const', 1]], ['br', exit]]]
-    ])
+  ctx.core.emit['.typed:includes'] = (arr, val, fromIndex) => {
+    const found = tempI32('thf'), needle = temp('thn'), fiL = tempI32('thx')
+    const loop = typedLoop(arr, (load, i, len, _ptr, exit) => {
+      const matched = ['i32.or',
+        ['f64.eq', load(), ['local.get', `$${needle}`]],
+        ['i64.eq',
+          ['i64.reinterpret_f64', load()],
+          ['i64.reinterpret_f64', ['local.get', `$${needle}`]]]]
+      const cond = fromIndex == null ? matched
+        : ['i32.and', ['i32.ge_s', ['local.get', `$${i}`], fromStart(fiL, len)], matched]
+      return [['if', cond, ['then', ['local.set', `$${found}`, ['i32.const', 1]], ['br', exit]]]]
+    })
     if (!loop) return null
     return typed(['block', ['result', 'f64'],
       ['local.set', `$${needle}`, asF64(emit(val))],
       ['local.set', `$${found}`, ['i32.const', 0]],
+      ...(fromIndex == null ? [] : [['local.set', `$${fiL}`, asI32(emit(fromIndex))]]),
       ...loop.setup,
       ['f64.convert_i32_s', ['local.get', `$${found}`]]], 'f64')
   }
@@ -1328,6 +1641,40 @@ export default (ctx) => {
   ctx.core.emit['.typed:find'] = (arr, fn) => findCommon(arr, fn, false)
   ctx.core.emit['.typed:findIndex'] = (arr, fn) => findCommon(arr, fn, true)
 
+  // .findLast / .findLastIndex — like find/findIndex but keep the LAST match instead of
+  // the first, so no early break (a forward scan that overwrites on each hit). Without a
+  // typed handler these routed through the plain-array versions, which read elements as
+  // raw f64 and returned garbage for non-f64 typed arrays.
+  const findLastCommon = (arr, fn, returnIndex) => {
+    const cbLoc = temp('tLc'), result = temp('tLr'), foundIdx = tempI32('tLi')
+    const loop = typedLoop(arr, (load, i) => {
+      const itemLoc = temp('tLit')
+      return [
+        ['local.set', `$${itemLoc}`, load()],
+        ['if', truthyIR(ctx.closure.call(
+          typed(['local.get', `$${cbLoc}`], 'f64'),
+          [typed(['local.get', `$${itemLoc}`], 'f64'),
+           typed(['f64.convert_i32_s', ['local.get', `$${i}`]], 'f64')])),
+          ['then',
+            returnIndex
+              ? ['local.set', `$${foundIdx}`, ['local.get', `$${i}`]]
+              : ['local.set', `$${result}`, typed(['local.get', `$${itemLoc}`], 'f64')]]]
+      ]
+    })
+    if (!loop) return null
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${cbLoc}`, asF64(emit(fn))],
+      returnIndex
+        ? ['local.set', `$${foundIdx}`, ['i32.const', -1]]
+        : ['local.set', `$${result}`, undefExpr()],
+      ...loop.setup,
+      returnIndex
+        ? typed(['f64.convert_i32_s', ['local.get', `$${foundIdx}`]], 'f64')
+        : typed(['local.get', `$${result}`], 'f64')], 'f64')
+  }
+  ctx.core.emit['.typed:findLast'] = (arr, fn) => findLastCommon(arr, fn, false)
+  ctx.core.emit['.typed:findLastIndex'] = (arr, fn) => findLastCommon(arr, fn, true)
+
   // .some / .every: short-circuit boolean reduction. some=∃, every=∀.
   const anyAllCommon = (arr, fn, isEvery) => {
     const cbLoc = temp('tac'), result = tempI32('tar')
@@ -1411,7 +1758,17 @@ export default (ctx) => {
   // Bulk copy via `memory.copy`.
   ctx.core.emit['.typed:slice'] = (arr, start, end) => {
     const r = resolveElem(arr)
-    if (!r || r.isBigInt) return null
+    if (!r) {
+      // Elem type / view-ness not statically known (owned→view reassigned binding).
+      // Dispatch off the runtime aux byte instead of crashing on empty IR.
+      inc('__typed_slice_rt')
+      return typed(['call', '$__typed_slice_rt',
+        ['i64.reinterpret_f64', asF64(emit(arr))],
+        start == null ? ['i32.const', 0] : asI32(emit(start)),
+        end == null ? ['i32.const', 0] : asI32(emit(end)),
+        ['i32.const', end == null ? 0 : 1]], 'f64')
+    }
+    if (r.isBigInt) return null
     const { et, isView } = r
     const arrLoc = temp('tsa'), srcPtr = tempI32('tssp'), srcLen = tempI32('tssl')
     const lo = tempI32('tslo'), hi = tempI32('tshi'), n = tempI32('tsn')
@@ -1460,4 +1817,100 @@ export default (ctx) => {
         ['i32.shl', ['local.get', `$${n}`], ['i32.const', SHIFT[et]]]],
       dst.ptr], 'f64')
   }
+
+  // .toReversed() — a reversed COPY (receiver unchanged): full slice-copy, then reverse
+  // the copy in place. (slice bails on BigInt, so BigInt receivers fall back to a throw.)
+  ctx.core.emit['.typed:toReversed'] = (arr) => {
+    const copy = ctx.core.emit['.typed:slice'](arr)
+    if (!copy) return null
+    inc('__typed_reverse')
+    const c = temp('ttv')
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${c}`, asF64(copy)],
+      ['call', '$__typed_reverse', ['i64.reinterpret_f64', ['local.get', `$${c}`]]]], 'f64')
+  }
+
+  // .toSorted(fn?) — a sorted COPY (receiver unchanged): slice-copy, then sort in place.
+  ctx.core.emit['.typed:toSorted'] = (arr, fn) => {
+    const copy = ctx.core.emit['.typed:slice'](arr)
+    return copy ? emitTypedSort(copy, fn) : null
+  }
+
+  // .with(index, value) — a COPY with one element replaced (receiver unchanged). Negative
+  // index counts from the end; out of range throws RangeError ($__jz_err), per spec.
+  ctx.core.emit['.typed:with'] = (arr, index, value) => {
+    const copy = ctx.core.emit['.typed:slice'](arr)
+    if (!copy) return null
+    ctx.runtime.throws = true
+    inc('__len', '__typed_set_idx')
+    const c = temp('twc'), idx = tempI32('twi'), len = tempI32('twl')
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${c}`, asF64(copy)],
+      ['local.set', `$${len}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${c}`]]]],
+      ['local.set', `$${idx}`, asI32(emit(index))],
+      ['if', ['i32.lt_s', ['local.get', `$${idx}`], ['i32.const', 0]],
+        ['then', ['local.set', `$${idx}`, ['i32.add', ['local.get', `$${idx}`], ['local.get', `$${len}`]]]]],
+      ['if', ['i32.or',
+          ['i32.lt_s', ['local.get', `$${idx}`], ['i32.const', 0]],
+          ['i32.ge_s', ['local.get', `$${idx}`], ['local.get', `$${len}`]]],
+        ['then', ['throw', '$__jz_err', ['f64.const', 0]]]],
+      ['drop', ['call', '$__typed_set_idx', ['i64.reinterpret_f64', ['local.get', `$${c}`]],
+        ['local.get', `$${idx}`], asF64(emit(value))]],
+      ['local.get', `$${c}`]], 'f64')
+  }
+
+  // .subarray(begin, end) — a zero-copy VIEW sharing the receiver's buffer (writes alias,
+  // NOT a copy). Builds the 16-byte descriptor [byteLen][dataOff][parentOff] and tags the
+  // TYPED ptr with aux|view, exactly like new TypedArray(buffer, byteOffset, length).
+  ctx.core.emit['.typed:subarray'] = (arr, begin, end) => {
+    ctx.features.typedView = true  // zero-copy view aliases the receiver — covers inline `a.subarray(1)[i]=…` the bound-decl path in analyze.js misses
+    const r = resolveElem(arr)
+    if (!r) {
+      // Elem type / view-ness not statically known (owned→view reassigned binding).
+      // Dispatch off the runtime aux byte instead of crashing on empty IR.
+      inc('__subarray')
+      return typed(['call', '$__subarray',
+        ['i64.reinterpret_f64', asF64(emit(arr))],
+        begin == null ? ['i32.const', 0] : asI32(emit(begin)),
+        end == null ? ['i32.const', 0] : asI32(emit(end)),
+        ['i32.const', end == null ? 0 : 1]], 'f64')
+    }
+    const { et, isView, isBigInt } = r
+    const shift = SHIFT[et]
+    const viewAux = et | 8 | (isBigInt ? 16 : 0)
+    const arrL = temp('tua'), srcOff = tempI32('tuo'), data = tempI32('tud'), root = tempI32('tur')
+    const len = tempI32('tul'), lo = tempI32('tulo'), hi = tempI32('tuhi'), n = tempI32('tun'), desc = tempI32('tude')
+    inc('__len')
+    const off4 = (o) => ['i32.load', ['i32.add', ['local.get', `$${srcOff}`], ['i32.const', o]]]
+    const clamp = (boundExpr, dflt, name) => {
+      if (boundExpr == null) return dflt
+      const v = tempI32(name)
+      return ['block', ['result', 'i32'],
+        ['local.set', `$${v}`, asI32(emit(boundExpr))],
+        ['if', ['i32.lt_s', ['local.get', `$${v}`], ['i32.const', 0]],
+          ['then', ['local.set', `$${v}`, ['i32.add', ['local.get', `$${v}`], ['local.get', `$${len}`]]]]],
+        ['if', ['i32.lt_s', ['local.get', `$${v}`], ['i32.const', 0]],
+          ['then', ['local.set', `$${v}`, ['i32.const', 0]]]],
+        ['if', ['i32.gt_s', ['local.get', `$${v}`], ['local.get', `$${len}`]],
+          ['then', ['local.set', `$${v}`, ['local.get', `$${len}`]]]],
+        ['local.get', `$${v}`]]
+    }
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${arrL}`, asF64(emit(arr))],
+      ['local.set', `$${srcOff}`, typedBase(typed(['local.get', `$${arrL}`], 'f64'))],
+      ['local.set', `$${data}`, isView ? off4(4) : ['local.get', `$${srcOff}`]],
+      ['local.set', `$${root}`, isView ? off4(8) : ['local.get', `$${srcOff}`]],
+      ['local.set', `$${len}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${arrL}`]]]],
+      ['local.set', `$${lo}`, clamp(begin, ['i32.const', 0], 'tub')],
+      ['local.set', `$${hi}`, clamp(end, ['local.get', `$${len}`], 'tue')],
+      ['local.set', `$${n}`, ['select',
+        ['i32.sub', ['local.get', `$${hi}`], ['local.get', `$${lo}`]], ['i32.const', 0],
+        ['i32.gt_s', ['local.get', `$${hi}`], ['local.get', `$${lo}`]]]],
+      ['local.set', `$${desc}`, ['call', '$__alloc', ['i32.const', 16]]],
+      ['i32.store', ['local.get', `$${desc}`], ['i32.shl', ['local.get', `$${n}`], ['i32.const', shift]]],
+      ['i32.store', ['i32.add', ['local.get', `$${desc}`], ['i32.const', 4]],
+        ['i32.add', ['local.get', `$${data}`], ['i32.shl', ['local.get', `$${lo}`], ['i32.const', shift]]]],
+      ['i32.store', ['i32.add', ['local.get', `$${desc}`], ['i32.const', 8]], ['local.get', `$${root}`]],
+      mkPtrIR(PTR.TYPED, viewAux, ['local.get', `$${desc}`])], 'f64')
+  }
 }