jz 0.8.0 → 0.9.0

package/module/array.js

@@ -8,7 +8,7 @@
  * @module array
  */
 
-import { typed, asF64, asI64, asI32, NULL_NAN, UNDEF_NAN, temp, tempI32, allocPtr, multiCount, arrayLoop, elemLoad, elemStore, truthyIR, extractF64Bits, appendStaticSlots, mkPtrIR, slotAddr, isLiteralStr, resolveValType, undefExpr, ptrTypeEq } from '../src/ir.js'
+import { typed, asF64, asI64, asI32, NULL_NAN, UNDEF_NAN, temp, tempI32, allocPtr, multiCount, arrayLoop, elemLoad, elemStore, truthyIR, extractF64Bits, appendStaticSlots, mkPtrIR, slotAddr, isLiteralStr, resolveValType, undefExpr, ptrTypeEq, carrierF64, isPureIR } from '../src/ir.js'
 import { inBoundsArrIdx } from '../src/type.js'
 import { emit, spread, deps, idx as emitIndex } from '../src/bridge.js'
 import { valTypeOf } from '../src/kind.js'
@@ -17,7 +17,7 @@ import { staticPropertyKey, staticObjectProps, inlineArraySid, staticIndexKey, i
 import { VAL, lookupValType, lookupNotString, updateRep } from '../src/reps.js'
 import { structInline } from '../src/abi/index.js'
 import { ctx, inc, err, warnDeopt, PTR, LAYOUT, followForwardingWat } from '../src/ctx.js'
-import { strHashLiteral } from './collection.js'
+import { strHashLiteral, dynPropsFilterSetIR, durableFwdLogIR } from './collection.js'
 
 
 /** Allocate ARRAY (type=1): header + n*8 data. Returns { local, setup, ptr } where local is data offset. */
@@ -42,7 +42,14 @@ export function staticArrayPtr(slots) {
   dv.setInt32(8, len, true); dv.setInt32(12, len, true)  // off-8: len, off-4: cap (props word at 0..7 stays 0)
   for (let i = 0; i < 16; i++) ctx.runtime.data += String.fromCharCode(hdr[i])
   appendStaticSlots(slots)
-  return mkPtrIR(PTR.ARRAY, 0, headerOff + 16)
+  const ptr = mkPtrIR(PTR.ARRAY, 0, headerOff + 16)
+  // Compile-time identity for the static base/len read fold (see the saArr tag in
+  // the '[]' handler + optimize's foldStaticConstArrayReads): a const global bound
+  // to this literal reads elements with literal base/len instead of the
+  // __ptr_offset call + header load.
+  ptr.staticOff = headerOff + 16
+  ptr.staticLen = len
+  return ptr
 }
 
 function hoistArrayValue(arr) {
@@ -152,7 +159,13 @@ function makeCallback(fn, argReps) {
           const result = emit(subst)
           // Preserve i32 result type so callers (truthyIR, etc.) can skip f64↔i32 round-trips.
           const ty = result.type === 'i32' ? 'i32' : 'f64'
-          return typed(['block', ['result', ty], ...stmts, result], ty)
+          const wrapped = typed(['block', ['result', ty], ...stmts, result], ty)
+          // An i32 result carrying ptrKind is an UNBOXED POINTER (a narrowed-return
+          // callee: the caller must rebox via this metadata) — the block wrapper must
+          // carry it through or downstream asF64 numeric-converts the raw offset
+          // (map stored [1104,1128] instead of the objects a named ctor fn returned).
+          if (result.ptrKind != null) { wrapped.ptrKind = result.ptrKind; wrapped.ptrAux = result.ptrAux }
+          return wrapped
         },
       }
     }
@@ -198,26 +211,61 @@ const arrMethod = (name, nArgs = 0) => (...args) => {
 }
 
 const needsArrayDynMove = () => ctx.core.includes.has('__dyn_set')
+// Whether durableFwdLogIR emits a real call (vs '' — see its own comment): only when
+// __heap_reset exists (owned-memory builds; shared memory never declares it — core.js).
+// Gates the deps() edge below the SAME way, so a shared-memory build (where core.js
+// never registers __durable_fwd_log/__durable_fwd_heal) never requests a name nothing
+// delivers — see collection.js's durableFwdLogIR comment for the full rationale.
+const needsDurableFwdLog = () => ctx.scope.globals.has('__heap_reset')
+// knownArray=true (__arr_grow_known): the raw offset + inline forwarding chase (see
+// arrGrow below) calls $__ptr_offset_fwd directly, not the generic $__ptr_offset.
+// '__durable_fwd_log' is an EXPLICIT edge (not left to the auto-dep scan): arrGrow's
+// body always contains a durableFwdLogIR() call, but self-host's realize/regex-scan
+// auto-deps path silently drops a helper reachable only that way (the exact
+// "Unknown func $__clamp_idx" shape documented in test/selfhost-includes.js) — that
+// test would fail (and the kernel would trap) without this line.
 const arrayGrowDeps = (knownArray = false) => () => [
-  ...(knownArray ? [] : ['__ptr_type']),
-  '__ptr_offset', '__alloc_hdr', '__mkptr',
+  ...(knownArray ? ['__ptr_offset_fwd'] : ['__ptr_type', '__ptr_offset']),
+  '__alloc_hdr', '__mkptr',
+  ...(needsDurableFwdLog() ? ['__durable_fwd_log'] : []),
   ...(needsArrayDynMove() ? ['__dyn_move'] : []),
 ]
 
+// Marks an ARRAY header slot ($off-16) as "props live in the global __dyn_props
+// table, not here" — written whenever a shift/grow migrates or rekeys an entry
+// there. Any nonzero, non-HASH-tagged i64 works: __dyn_get_t_h / __dyn_set /
+// __dyn_del's ARRAY arms already treat "off-16 nonzero and not HASH-tagged" as
+// "fall through to the global hash" (their only fast-accept is a HASH tag; their
+// only fast-reject is exact zero). -1 decodes to tag 15, which is never PTR.HASH.
+// Without this, a shift migrates props to the global table leaving nonzero
+// leftover header bytes (which happens to satisfy "not zero, so check global") —
+// but a *subsequent grow* allocates a fresh, zeroed header block, erasing that
+// accidental signal and making __dyn_get_t_h wrongly conclude "no props" without
+// ever consulting the global table. Writing this sentinel explicitly (instead of
+// relying on incidental nonzero garbage) closes that gap for both shift and grow.
+const DYN_PROPS_GLOBAL_SENTINEL = '(i64.const -1)'
+
 // Arrays keep dynamic props in the global table because old/new array storage can
-// be forwarded. Relocate that entry when growth moves the backing store.
+// be forwarded. Relocate that entry when growth moves the backing store; mark the
+// new header so a later read/write/delete knows to consult the global table (the
+// fresh __alloc_hdr block zeroes $newOff-16, which alone would read as "no props").
 const maybeDynMoveIR = () => needsArrayDynMove()
-  ? '(call $__dyn_move (local.get $off) (local.get $newOff))'
+  ? `(if (i32.eq (call $__dyn_move (local.get $off) (local.get $newOff)) (i32.const 1))
+      (then (i64.store (i32.sub (local.get $newOff) (i32.const 16)) ${DYN_PROPS_GLOBAL_SENTINEL})))`
   : ''
 
 // Per-object propsPtr lives in the 16-byte header at $off-16. On grow we copy it
 // from old to new header (still HASH-tagged → unshifted ARRAY case). On shift we
 // migrate it to the global __dyn_props because the forwarding writes overwrite
-// the destination's $newOff-16 slot. The HASH-tag check rejects 0 (no props) and
-// forwarding garbage from a prior shift, so chained shift→grow is safe — the
-// global hash takes over and __dyn_move keeps it in sync.
+// the destination's $newOff-16 slot — headerPropsToGlobalIR marks that slot with
+// DYN_PROPS_GLOBAL_SENTINEL so a later grow's fresh (zeroed) header doesn't lose
+// the signal; maybeDynMoveIR marks it again on every subsequent grow/rekey.
 const headerPropsCopyIR = () => needsArrayDynMove() ? `
     (local.set $oldProps (f64.load (i32.sub (local.get $off) (i32.const 16))))
+    ;; strip the runtime-shadowed marker (collection.js bit0) — the relocated
+    ;; header is ephemeral, where markers are meaningless and an odd props
+    ;; offset would corrupt the sidecar probe
+    (local.set $oldProps (f64.reinterpret_i64 (i64.and (i64.reinterpret_f64 (local.get $oldProps)) (i64.const -2))))
     (if (i32.eq
           (i32.wrap_i64 (i64.and (i64.shr_u (i64.reinterpret_f64 (local.get $oldProps)) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
           (i32.const ${PTR.HASH}))
@@ -227,6 +275,7 @@ const headerPropsToGlobalIR = () => needsArrayDynMove() ? `
     (if (i32.ge_u (local.get $off) (i32.const 16))
       (then
         (local.set $oldProps (f64.load (i32.sub (local.get $off) (i32.const 16))))
+        (local.set $oldProps (f64.reinterpret_i64 (i64.and (i64.reinterpret_f64 (local.get $oldProps)) (i64.const -2))))
         (if (i32.eq
               (i32.wrap_i64 (i64.and (i64.shr_u (i64.reinterpret_f64 (local.get $oldProps)) (i64.const ${LAYOUT.TAG_SHIFT})) (i64.const ${LAYOUT.TAG_MASK})))
               (i32.const ${PTR.HASH}))
@@ -238,7 +287,12 @@ const headerPropsToGlobalIR = () => needsArrayDynMove() ? `
               (i64.reinterpret_f64 (local.get $root))
               (i64.reinterpret_f64 (f64.convert_i32_s (local.get $newOff)))
               (i64.reinterpret_f64 (local.get $oldProps)))))
-            (global.set $__dyn_props (local.get $root)))))) ` : ''
+            (global.set $__dyn_props (local.get $root))
+            ${dynPropsFilterSetIR('(local.get $newOff)')}
+            ;; for-in enum cache: sidecar props moved into the global table —
+            ;; enumeration state changed off the cache's key. Clear (see collection.js).
+            (global.set $__enumc_off (i32.const 0))
+            (i64.store (i32.sub (local.get $newOff) (i32.const 16)) ${DYN_PROPS_GLOBAL_SENTINEL}))))) ` : ''
 
 export default (ctx) => {
   deps({
@@ -247,9 +301,11 @@ export default (ctx) => {
     __arr_grow_known: arrayGrowDeps(true),
     __arr_shift: () => [
       '__ptr_offset',
+      ...(needsDurableFwdLog() ? ['__durable_fwd_log'] : []),  // explicit edge — see arrayGrowDeps's comment
       ...(needsArrayDynMove() ? ['__dyn_move', '__hash_new', '__ihash_set_local'] : []),
     ],
     __arr_fill: ['__ptr_offset', '__clamp_idx'],  // body-calls __clamp_idx; declare it (self-host auto-scan can't be relied on — see test/selfhost-includes.js)
+    __arr_copyWithin: ['__ptr_type', '__ptr_offset', '__clamp_idx'],
     __arr_set_idx_ptr: ['__arr_grow', '__ptr_offset'],
     __arr_push1: ['__arr_grow_known', '__ptr_offset_fwd'],
     __arr_set_length: ['__arr_grow_known', '__ptr_offset', '__ptr_type'],
@@ -270,8 +326,17 @@ export default (ctx) => {
 
   inc('__ptr_offset', '__ptr_type', '__len', '__set_len', '__typed_idx', '__is_truthy')
 
-  // Array.isArray(x): check ptr_type === PTR.ARRAY
+  // Array.isArray(x): check ptr_type === PTR.ARRAY.
+  // Statically-known ARRAY values must answer from the FACT, not the carrier —
+  // a rep-narrowed array (raw base local, e.g. a slice() result) is not a
+  // NaN-box, so the runtime tag test would read a plain number and say false.
   ctx.core.emit['Array.isArray'] = (x) => {
+    const vt = valTypeOf(x)
+    if (vt === VAL.ARRAY) {
+      const v = emit(x)
+      return isPureIR(v) ? typed(['i32.const', 1], 'i32')
+        : typed(['block', ['result', 'i32'], ['drop', asF64(v)], ['i32.const', 1]], 'i32')
+    }
     const v = asF64(emit(x))
     const t = temp('t')
     return typed(['i32.and',
@@ -449,6 +514,11 @@ export default (ctx) => {
   // guard (non-array ptr → fresh 4-cap buffer) for untyped call sites; the `_known`
   // variant skips it for hot paths that already proved the receiver is an array.
   // Single source of truth: both stdlib entries share the grow/relocate tail.
+  // `_known` callers (all `deps()`-verified ARRAY-only: __arr_push1, __arr_set_length,
+  // the inline-len array store) already proved the tag, so it inlines the raw offset +
+  // forwarding chase (mirrors __arr_idx_known) instead of paying __ptr_offset's
+  // tag-extract + FORWARDING_MASK dispatch — ARRAY always needs the chase (it's
+  // forwarding-capable) but never needs the re-check this variant would otherwise repeat.
   const arrGrow = (name, defensive) => `(func $${name} (param $ptr i64) (param $minCap i32) (result f64)
     ${defensive ? '(local $t i32) ' : ''}(local $off i32) (local $oldCap i32) (local $newCap i32) (local $newOff i32) (local $len i32)
     ${needsArrayDynMove() ? '(local $oldProps f64)' : ''}
@@ -462,7 +532,8 @@ export default (ctx) => {
       (then
         (local.set $newCap (select (local.get $minCap) (i32.const 4) (i32.gt_s (local.get $minCap) (i32.const 4))))
         (local.set $newOff (call $__alloc_hdr (i32.const 0) (local.get $newCap)))
-        (return (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))))` : `(local.set $off (call $__ptr_offset (local.get $ptr)))`}
+        (return (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))))` : `(local.set $off (i32.wrap_i64 (i64.and (local.get $ptr) (i64.const ${LAYOUT.OFFSET_MASK}))))
+    ${followForwardingWat('$off', { lowGuard: true })}`}
     (local.set $oldCap (i32.load (i32.sub (local.get $off) (i32.const 4))))
     (if (i32.ge_s (local.get $oldCap) (local.get $minCap))
       (then (return (f64.reinterpret_i64 (local.get $ptr)))))
@@ -475,6 +546,7 @@ export default (ctx) => {
     (memory.copy (local.get $newOff) (local.get $off) (i32.shl (local.get $len) (i32.const 3)))
     ${headerPropsCopyIR()}
     ${maybeDynMoveIR()}
+    ${durableFwdLogIR('off', 'newOff', 'len', 'oldCap')}
     (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $newOff))
     (i32.store (i32.sub (local.get $off) (i32.const 4)) (i32.const -1))
     (call $__mkptr (i32.const ${PTR.ARRAY}) (i32.const 0) (local.get $newOff)))`
@@ -574,15 +646,28 @@ export default (ctx) => {
       // so `const x = [1, 2, 3]` is a data segment, not an alloc.
       if (ctx.func.atModuleScope && len >= 1 && !ctx.memory.shared) {
         // asF64 folds i32.const → f64.const literally, so int-literal arrays also qualify.
-        const slots = elems.map(e => extractF64Bits(asF64(emit(e))))
-        if (slots.every(b => b !== null)) return staticArrayPtr(slots)
+        // carrierF64: a bool literal folds to its TRUE/FALSE atom const — still
+        // static-extractable, and the element keeps boolean identity in the segment.
+        const vals = elems.map(e => carrierF64(e, emit(e)))
+        const slots = vals.map(v => extractF64Bits(v))
+        if (slots.every(b => b !== null)) {
+          const ptr = staticArrayPtr(slots)
+          // Every element a capture-free closure → tag the candidate set (funcIdx +
+          // uniform-ABI body name) so a `const ops = [...arrows]` indexed CALL can
+          // lower to a br_table of direct calls (emit.js tryConstFnArrayDispatch) —
+          // the AOT form of a polymorphic inline cache, with the generic
+          // call_indirect as the always-sound default arm.
+          if (vals.length && vals.every(v => v.closureBodyName != null && v.closureFuncIdx != null))
+            ptr.fnElements = vals.map(v => ({ idx: v.closureFuncIdx, name: v.closureBodyName }))
+          return ptr
+        }
       }
       // L3/'speed' bumps the cap floor (default 4) to skip more growth cycles.
       const minCap = Math.max(ctx.transform.optimize?.arrayMinCap | 0, 4)
       const a = allocArray(len, Math.max(len, minCap))
       const body = [...a.setup]
       for (let i = 0; i < len; i++)
-        body.push(['f64.store', slotAddr(a.local, i), asF64(emit(elems[i]))])
+        body.push(['f64.store', slotAddr(a.local, i), carrierF64(elems[i], emit(elems[i]))])
       body.push(a.ptr)
       return typed(['block', ['result', 'f64'], ...body], 'f64')
     }
@@ -614,6 +699,14 @@ export default (ctx) => {
       // Emit-time rep seed on fresh hoist-temp `h` so the recursive emit
       // below (`ctx.core.emit['[]'](h, idx)`) takes the typed-arr fast path.
       if (vtArr) updateRep(h, { val: vtArr })
+      // Inline field-read receiver (`plan.tw[i]`): carry the schema slot's
+      // program-wide typed kind onto the temp — VAL.TYPED alone has no element
+      // width, so without the ctor the read decays to the dynamic path.
+      if (vtArr === VAL.TYPED && Array.isArray(arr) && (arr[0] === '.' || arr[0] === '?.') &&
+          typeof arr[1] === 'string' && typeof arr[2] === 'string' && ctx.schema?.slotTypedCtorAt) {
+        const fc = ctx.schema.slotTypedCtorAt(arr[1], arr[2])
+        if (fc) (ctx.types.typedElem ||= new Map()).set(h, fc)
+      }
       const setup = ['local.set', `$${h}`, asF64(emit(arr))]
       const result = ctx.core.emit['[]'](h, idx)
       return typed(['block', ['result', 'f64'], setup, asF64(result)], 'f64')
@@ -708,23 +801,34 @@ export default (ctx) => {
     }
     // HASH receiver with runtime string key: probe the HASH directly via
     // __hash_get_local. Mirrors the literal-key path above but defers the
-    // hash computation to runtime. When the key's val-type is unknown at
-    // compile time, gate on __is_str_key — HASH has no numeric-key
-    // semantics, so non-string keys return undef.
+    // hash computation to runtime. Non-string keys (known-numeric, or the
+    // runtime-dispatch else-arm) go through __dyn_get_expr, whose entry
+    // ToPropertyKey-normalizes — `h[97]` reads the '97' slot the (also
+    // normalizing) write stored. A known HASH is never an array, so there is
+    // no hot array-index path to protect here.
     if (vt === VAL.HASH) {
       if (keyType === VAL.STRING) {
         inc('__hash_get_local')
         return typed(['f64.reinterpret_i64', ['call', '$__hash_get_local', ['i64.reinterpret_f64', ptrExpr], asI64(emit(idx))]], 'f64')
       }
       if (useRuntimeKeyDispatch) {
-        inc('__hash_get_local', '__is_str_key')
+        inc('__hash_get_local', '__is_str_key', '__dyn_get_expr')
         const keyTmp = temp()
         return typed(['block', ['result', 'f64'],
           ['local.set', `$${keyTmp}`, asF64(emit(idx))],
           ['if', ['result', 'f64'], ['call', '$__is_str_key', ['i64.reinterpret_f64', ['local.get', `$${keyTmp}`]]],
             ['then', ['f64.reinterpret_i64', ['call', '$__hash_get_local', ['i64.reinterpret_f64', ptrExpr], ['i64.reinterpret_f64', ['local.get', `$${keyTmp}`]]]]],
-            ['else', undefExpr()]]], 'f64')
+            ['else', ['f64.reinterpret_i64', ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ptrExpr], ['i64.reinterpret_f64', ['local.get', `$${keyTmp}`]]]]]]], 'f64')
       }
+      inc('__dyn_get_expr')
+      return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ptrExpr], asI64(emit(idx))]], 'f64')
+    }
+    // OBJECT receiver with a non-string key: never an array element — route to the
+    // ToPropertyKey-normalizing dyn read (the WRITE side already goes to __dyn_set;
+    // see the numeric-index design note below, which stays scoped to UNKNOWN receivers).
+    if (vt === VAL.OBJECT && keyType !== VAL.STRING) {
+      inc('__dyn_get_expr')
+      return typed(['f64.reinterpret_i64', ['call', '$__dyn_get_expr', ['i64.reinterpret_f64', ptrExpr], asI64(emit(idx))]], 'f64')
     }
     // Known array → direct f64 element load, skip string check
     if (keyType === VAL.STRING)
@@ -785,14 +889,33 @@ export default (ctx) => {
       const idxProvenInBounds = keyIsNum
         && typeof arr === 'string' && typeof idx === 'string'
         && inBoundsArrIdx(ctx).has(arr + '\x00' + idx)
+      // Tag reads whose receiver folded to a compile-time constant box: when the
+      // decl registers the same bits as a STATIC array (ctx.scope.staticArrs) and
+      // the program never resizes/aliases the name, optimize's
+      // foldStaticConstArrayReads collapses base+len to literals (the decl's
+      // data-segment offset isn't known until module init emits, so emit can
+      // only tag — same phasing as the constFnArrays devirt).
+      const saTag = (node) => {
+        if (typeof arr !== 'string') return node
+        // Identity proof, either form: the receiver resolved to a DIRECT read of the
+        // module global `arr` (global names are unique — same name the decl registers),
+        // or it already folded to a constant box whose bits the decl records. A local
+        // shadowing `arr` emits a local.get receiver — neither form matches, no tag.
+        if (Array.isArray(ptrExpr) && ptrExpr[0] === 'global.get' && ptrExpr[1] === `$${arr}`) node.saArr = arr
+        else {
+          const bits = extractF64Bits(ptrExpr)
+          if (bits !== null) { node.saArr = arr; node.saBits = bits }
+        }
+        return node
+      }
       if (idxProvenInBounds) {
         // base local must be i32. Flat tee form so downstream peepholes can fold
         // `i32.wrap_i64 (i64.reinterpret_f64 (f64.load …))` → `i32.load …`
         // when this load feeds a ptrUnboxed OBJECT field.
         const baseI32 = tempI32('ab')
-        return typed(ctx.abi.array.ops.load(
+        return typed(saTag(ctx.abi.array.ops.load(
           ['local.tee', `$${baseI32}`, arrBase()],
-          vi), 'f64')
+          vi)), 'f64')
       }
       // Known plain array, numeric key, NOT proven in-bounds → inline bounds-checked
       // load: `idx < len ? load : undefined`. Same semantics as __arr_idx_known but
@@ -801,14 +924,14 @@ export default (ctx) => {
       // the check would read raw memory for OOB indices (e.g. `a[1]` on a length-1 array).
       if (keyIsNum) {
         const baseI32 = tempI32('ab'), idxI32 = tempI32('ai')
-        return typed(['if', ['result', 'f64'],
+        return typed(saTag(['if', ['result', 'f64'],
           ['i32.lt_u',
             ['local.tee', `$${idxI32}`, vi],
             ['i32.load', ['i32.sub',
               ['local.tee', `$${baseI32}`, arrBase()],
               ['i32.const', 8]]]],
           ['then', ctx.abi.array.ops.load(['local.get', `$${baseI32}`], ['local.get', `$${idxI32}`])],
-          ['else', undefExpr()]], 'f64')
+          ['else', undefExpr()]]), 'f64')
       }
       const baseTmp = temp()
       // Numeric key (literal or known-NUMBER name) → skip __is_str_key dispatch;
@@ -913,7 +1036,7 @@ export default (ctx) => {
       const isGlobal = !box && ctx.scope.globals.has(arr) && !ctx.func.locals?.has(arr)
       const readVar = box ? ['f64.load', ['local.get', `$${box}`]] : isGlobal ? ['global.get', `$${arr}`] : ['local.get', `$${arr}`]
       const writeVar = v => box ? ['f64.store', ['local.get', `$${box}`], v] : isGlobal ? ['global.set', `$${arr}`, v] : ['local.set', `$${arr}`, v]
-      const vv = asF64(emit(vals[0]))
+      const vv = carrierF64(vals[0], emit(vals[0]))
       const pushed = ['call', '$__arr_push1', ['i64.reinterpret_f64', readVar], vv]
       if (void_) return typed(['block', writeVar(pushed)], 'void')
       return typed(['block', ['result', 'f64'],
@@ -966,7 +1089,7 @@ export default (ctx) => {
 
     // Store each value and increment len
     for (const val of vals) {
-      const vv = asF64(emit(val))
+      const vv = carrierF64(val, emit(val))
       body.push(
         ['f64.store',
           ['i32.add', ['local.get', `$${pushBase}`], ['i32.shl', ['local.get', `$${len}`], ['i32.const', 3]]],
@@ -1019,6 +1142,21 @@ export default (ctx) => {
   ctx.core.emit['.shift'] = (arr) => (inc('__arr_shift'),
     typed(['call', '$__arr_shift', asI64(emit(arr))], 'f64'))
 
+  // durableFwdLogIR on the off->newOff mark below: unlike grow (whose newOff is always
+  // a FRESH allocation, unconditionally ephemeral whenever off reads durable), shift's
+  // newOff is just off+8 — normally still in the SAME durability class as off, so a
+  // shift of a durable array is ordinarily legitimate persistent state that must survive
+  // `_clear`. It only crosses into ephemeral in the one-in-8-bytes edge case where off
+  // sits exactly at __heap_reset-8, which durableFwdLogIR's two-sided check (source
+  // durable AND target ephemeral) catches without misfiring on the common case.
+  // rawOff's OWN path-compression rewrite (off->newOff becomes rawOff->newOff two lines
+  // below the mark) needs no separate log call: if rawOff is durable, its header no
+  // longer holds real (len, cap) at this point — it already holds a forward — so
+  // whichever EARLIER relocation first turned rawOff from real data into a forward
+  // record (the only place a durable rawOff's true pre-relocation state could still be
+  // read) already logged it then, under its own off/newOff names. Healing restores
+  // rawOff's header wholesale from that entry, independent of how many times its
+  // forward target is rewritten afterward by path compression.
   ctx.core.stdlib['__arr_shift'] = () => `(func $__arr_shift (param $arr i64) (result f64)
     (local $rawOff i32) (local $off i32) (local $newOff i32) (local $len i32) (local $cap i32) (local $val f64)
     ${needsArrayDynMove() ? '(local $oldProps f64) (local $root f64)' : ''}
@@ -1039,8 +1177,11 @@ export default (ctx) => {
             (i32.store (i32.add (local.get $off) (i32.const 4))
               (select (i32.sub (local.get $cap) (i32.const 1)) (i32.const 0) (i32.gt_s (local.get $cap) (i32.const 0))))
             ${maybeDynMoveIR()}
+            ${durableFwdLogIR('off', 'newOff', 'len', 'cap')}
             (i32.store (i32.sub (local.get $off) (i32.const 8)) (local.get $newOff))
             (i32.store (i32.sub (local.get $off) (i32.const 4)) (i32.const -1))
+            ;; rawOff path-compression below needs no durableFwdLogIR call of its own —
+            ;; see the comment above this function.
             (if (i32.and (i32.ne (local.get $rawOff) (local.get $off)) (i32.ge_u (local.get $rawOff) (i32.const 8)))
               (then
                 (i32.store (i32.sub (local.get $rawOff) (i32.const 8)) (local.get $newOff))
@@ -1054,7 +1195,7 @@ export default (ctx) => {
     inc('__arr_fill')
     return typed(['call', '$__arr_fill',
       asI64(emit(arr)),
-      val == null ? undefExpr() : asF64(emit(val)),
+      val == null ? undefExpr() : carrierF64(val, emit(val)),
       start == null ? ['i32.const', 0] : asI32(emit(start)),
       end == null ? ['i32.const', 0x7FFFFFFF] : asI32(emit(end))], 'f64')
   }
@@ -1139,9 +1280,36 @@ export default (ctx) => {
     return typed(['block', ['result', 'f64'], ...body], 'f64')
   }
 
-  // .unshift(val) → prepend element, shift existing right
-  ctx.core.emit['.unshift'] = (arr, val) => (inc('__arr_unshift'),
-    typed(['call', '$__arr_unshift', asI64(emit(arr)), asF64(emit(val))], 'f64'))
+  // .unshift(...vals) → prepend elements, shift existing right. Multi-arg per ES:
+  // `a.unshift(1, 2, 3)` yields [1, 2, 3, …existing] and returns the NEW LENGTH
+  // (the helper's contract — it mutates in place; a grow leaves a forwarding
+  // pointer so the receiver box stays valid, no write-back). Args EVALUATE
+  // left-to-right (spilled to temps in source order) but INSERT last-to-first
+  // through the single-value helper so the block lands in argument order; the
+  // receiver is evaluated ONCE. (The old emitter silently DROPPED every argument
+  // past the first — in the self-host kernel that broke assemble.js's own
+  // `inject.unshift(setBase, ...stores)`, the last byte-parity ordering
+  // divergence.)
+  ctx.core.emit['.unshift'] = (arr, ...rawVals) => {
+    inc('__arr_unshift')
+    // Flatten comma-grouped args: [',', v1, v2] → [v1, v2] (same unwrap as '{}')
+    const vals = rawVals.length === 1 && Array.isArray(rawVals[0]) && rawVals[0][0] === ','
+      ? rawVals[0].slice(1) : rawVals
+    if (vals.length <= 1) {
+      const val = vals[0]
+      return typed(['call', '$__arr_unshift', asI64(emit(arr)), val === undefined ? undefExpr() : carrierF64(val, emit(val))], 'f64')
+    }
+    const recv = temp('usr')
+    const temps = vals.map(() => temp('us'))
+    const body = [
+      ['local.set', `$${recv}`, asF64(emit(arr))],
+      ...vals.map((v, i) => ['local.set', `$${temps[i]}`, carrierF64(v, emit(v))]),
+    ]
+    for (let i = vals.length - 1; i >= 1; i--)
+      body.push(['drop', ['call', '$__arr_unshift', ['i64.reinterpret_f64', ['local.get', `$${recv}`]], ['local.get', `$${temps[i]}`]]])
+    body.push(['call', '$__arr_unshift', ['i64.reinterpret_f64', ['local.get', `$${recv}`]], ['local.get', `$${temps[0]}`]])
+    return typed(['block', ['result', 'f64'], ...body], 'f64')
+  }
 
   ctx.core.stdlib['__arr_unshift'] = `(func $__arr_unshift (param $arr i64) (param $val f64) (result f64)
     (local $off i32) (local $len i32) (local $a f64)
@@ -1480,8 +1648,13 @@ export default (ctx) => {
     const recv = hoistArrayValue(arr)
     const acc = temp('ra')
     // reduce cb signature: (acc, item, idx). Item rep mirrors recv's elem val type.
+    // A BIGINT init seeds the acc's kind: the fold can't silently change type
+    // (mixed BigInt arithmetic rejects at compile), and without the seed the
+    // acc param reads as unknown/number and trips the mix guard on jz's own
+    // SWAR packing idiom (`arr.reduce((a, b, k) => a | (BigInt(b) << …), 0n)`).
     const reps = callbackArgReps(arr)
-    const cb = makeCallback(fn, [null, reps[0], { val: VAL.NUMBER }])
+    const accRep = init !== undefined && valTypeOf(init) === VAL.BIGINT ? { val: VAL.BIGINT } : null
+    const cb = makeCallback(fn, [accRep, reps[0], { val: VAL.NUMBER }])
     // No initial value: JS seeds the accumulator with element 0 and folds from
     // index 1 — NOT a 0 seed folded over every element. A 0 seed is invisible
     // for `+` (additive identity) but wrong for `*` (→0) and corrupts non-numeric
@@ -1562,8 +1735,10 @@ export default (ctx) => {
   }
 
   // .reverse() → in-place swap arr[i] ↔ arr[len-1-i], returns the array.
-  ctx.core.emit['.reverse'] = (arr) => {
-    const recv = hoistArrayValue(arr)
+  // Reverse an array VALUE in place, returning it. `.reverse` mutates the
+  // receiver (setup hoists it once); `.toReversed` (ES2023) reverses a fresh
+  // __arr_from copy so the receiver is untouched.
+  function emitArrayReverseInPlace(setup, value) {
     const arrTmp = temp('rv')
     const base = tempI32('rb')
     const len = tempI32('rl')
@@ -1578,8 +1753,8 @@ export default (ctx) => {
     const addr = (idxIR) => ['i32.add', ['local.get', `$${base}`], ['i32.shl', idxIR, ['i32.const', 3]]]
 
     return typed(['block', ['result', 'f64'],
-      recv.setup,
-      ['local.set', `$${arrTmp}`, recv.value],
+      setup,
+      ['local.set', `$${arrTmp}`, value],
       ['local.set', `$${base}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${arrTmp}`]]]],
       ['local.set', `$${len}`, ['i32.load', ['i32.sub', ['local.get', `$${base}`], ['i32.const', 8]]]],
       ['local.set', `$${i}`, ['i32.const', 0]],
@@ -1596,14 +1771,25 @@ export default (ctx) => {
       ['local.get', `$${arrTmp}`]
     ], 'f64')
   }
+  ctx.core.emit['.reverse'] = (arr) => {
+    const recv = hoistArrayValue(arr)
+    return emitArrayReverseInPlace(recv.setup, recv.value)
+  }
+  ctx.core.emit['.toReversed'] = (arr) => {
+    inc('__arr_from')
+    return emitArrayReverseInPlace(['nop'], typed(['call', '$__arr_from', asI64(emit(arr))], 'f64'))
+  }
 
   // Insertion sort — stable, in-place, O(n²). The comparator is called per
   // shift; positive return → swap. NaN returns become "no swap" via f64.gt's
   // IEEE 754 semantics (NaN compares false), matching the spec's NaN-as-0
   // behavior. When fn is omitted, elements are compared as strings via
   // __to_str → __str_cmp (byte-wise; NOT locale-aware).
-  ctx.core.emit['.sort'] = (arr, fn) => {
-    const recv = hoistArrayValue(arr)
+  // Insertion-sort an array VALUE in place, returning it. `.sort` mutates the
+  // receiver; `.toSorted` (ES2023) sorts a fresh __arr_from copy. Default (no
+  // comparator) is lexicographic-string order per spec — NOT the numeric
+  // default typed arrays use (see .typed:sort).
+  function emitArraySortInPlace(setup, value, fn) {
     const arrTmp = temp('sr')
     const base = tempI32('sb')
     const len = tempI32('sl')
@@ -1617,6 +1803,9 @@ export default (ctx) => {
 
     let cmpExpr, cmpSetup
     if (fn == null) {
+      // default comparator is ToString + byte compare — both live in the string
+      // module, which an all-numeric program hasn't loaded (dangling inc otherwise)
+      ctx.module.include('string')
       inc('__to_str', '__str_cmp')
       cmpExpr = (aIR, bIR) => typed(['f64.convert_i32_s',
         ['call', '$__str_cmp',
@@ -1640,9 +1829,9 @@ export default (ctx) => {
     const jPlus1 = ['i32.add', ['local.get', `$${j}`], ['i32.const', 1]]
 
     return typed(['block', ['result', 'f64'],
-      recv.setup,
+      setup,
       cmpSetup,
-      ['local.set', `$${arrTmp}`, recv.value],
+      ['local.set', `$${arrTmp}`, value],
       ['local.set', `$${base}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${arrTmp}`]]]],
       ['local.set', `$${len}`, ['i32.load', ['i32.sub', ['local.get', `$${base}`], ['i32.const', 8]]]],
 
@@ -1673,6 +1862,72 @@ export default (ctx) => {
       ['local.get', `$${arrTmp}`]
     ], 'f64')
   }
+  ctx.core.emit['.sort'] = (arr, fn) => {
+    const recv = hoistArrayValue(arr)
+    return emitArraySortInPlace(recv.setup, recv.value, fn)
+  }
+  ctx.core.emit['.toSorted'] = (arr, fn) => {
+    inc('__arr_from')
+    return emitArraySortInPlace(['nop'], typed(['call', '$__arr_from', asI64(emit(arr))], 'f64'), fn)
+  }
+
+  // .with(index, value) (ES2023) — a COPY with one element replaced. Negative
+  // index counts from the end; an out-of-range index throws (RangeError in JS —
+  // jz collapses Error subclasses to one generic throw, like .typed:with).
+  ctx.core.emit['.with'] = (arr, index, value) => {
+    inc('__arr_from', '__ptr_offset')
+    ctx.runtime.throws = true
+    const c = temp('awc'), base = tempI32('awb'), len = tempI32('awl'), idx = tempI32('awi')
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${c}`, typed(['call', '$__arr_from', asI64(emit(arr))], 'f64')],
+      ['local.set', `$${base}`, ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${c}`]]]],
+      ['local.set', `$${len}`, ['i32.load', ['i32.sub', ['local.get', `$${base}`], ['i32.const', 8]]]],
+      ['local.set', `$${idx}`, asI32(emit(index))],
+      ['if', ['i32.lt_s', ['local.get', `$${idx}`], ['i32.const', 0]],
+        ['then', ['local.set', `$${idx}`, ['i32.add', ['local.get', `$${idx}`], ['local.get', `$${len}`]]]]],
+      ['if', ['i32.or',
+        ['i32.lt_s', ['local.get', `$${idx}`], ['i32.const', 0]],
+        ['i32.ge_s', ['local.get', `$${idx}`], ['local.get', `$${len}`]]],
+        ['then', ['throw', '$__jz_err', ['f64.const', 0]]]],
+      ['f64.store',
+        ['i32.add', ['local.get', `$${base}`], ['i32.shl', ['local.get', `$${idx}`], ['i32.const', 3]]],
+        carrierF64(value, emit(value))],
+      ['local.get', `$${c}`]], 'f64')
+  }
+
+  // .copyWithin(target, start, end?) — in-place overlap-safe move, returns the
+  // receiver. memory.copy is memmove-semantic (bulk-memory), so unlike the
+  // element-kind-aware __typed_copyWithin, plain arrays need no direction loop.
+  ctx.core.emit['.copyWithin'] = (arr, target, start, end) => {
+    inc('__arr_copyWithin')
+    return typed(['call', '$__arr_copyWithin', asI64(emit(arr)),
+      target == null ? ['i32.const', 0] : asI32(emit(target)),
+      start == null ? ['i32.const', 0] : asI32(emit(start)),
+      end == null ? ['i32.const', 0x7FFFFFFF] : asI32(emit(end))], 'f64')
+  }
+  ctx.core.stdlib['__arr_copyWithin'] = `(func $__arr_copyWithin (param $arr i64) (param $target i32) (param $start i32) (param $end i32) (result f64)
+    (local $off i32) (local $len i32) (local $count i32)
+    (if (i32.eq (call $__ptr_type (local.get $arr)) (i32.const ${PTR.ARRAY}))
+      (then
+        (local.set $off (call $__ptr_offset (local.get $arr)))
+        (local.set $len (i32.load (i32.sub (local.get $off) (i32.const 8))))
+        (local.set $target (call $__clamp_idx (local.get $target) (local.get $len)))
+        (local.set $start (call $__clamp_idx (local.get $start) (local.get $len)))
+        (local.set $end (call $__clamp_idx (local.get $end) (local.get $len)))
+        (local.set $count (i32.sub (local.get $end) (local.get $start)))
+        (if (i32.gt_s (local.get $count) (i32.sub (local.get $len) (local.get $target)))
+          (then (local.set $count (i32.sub (local.get $len) (local.get $target)))))
+        (if (i32.gt_s (local.get $count) (i32.const 0))
+          (then (memory.copy
+            (i32.add (local.get $off) (i32.shl (local.get $target) (i32.const 3)))
+            (i32.add (local.get $off) (i32.shl (local.get $start) (i32.const 3)))
+            (i32.shl (local.get $count) (i32.const 3)))))))
+    (f64.reinterpret_i64 (local.get $arr)))`
+
+  // Array.of(...items) — spec-identical to the array literal `[...items]`; the
+  // `[` emitter already handles spread-tagged args and the static-data path.
+  // (Distinct from `Array(n)`, which makes a length-n hole array.)
+  ctx.core.emit['Array.of'] = (...items) => ctx.core.emit['['](...items)
 
   // Boxed pointer values (strings/objects/etc.) carry NaN payloads, and
   // f64.eq treats NaN as not-equal to anything — even bit-identical NaN —
@@ -1688,7 +1943,7 @@ export default (ctx) => {
 
   ctx.core.emit['.indexOf'] = (arr, val) => {
     const recv = hoistArrayValue(arr)
-    const vv = asF64(emit(val))
+    const vv = carrierF64(val, emit(val))
     const eq = arrEqIR(val)
     const result = tempI32('ix')
     const exit = `$exit${ctx.func.uniq++}`
@@ -1705,7 +1960,7 @@ export default (ctx) => {
 
   ctx.core.emit['.includes'] = (arr, val) => {
     const recv = hoistArrayValue(arr)
-    const vv = asF64(emit(val))
+    const vv = carrierF64(val, emit(val))
     const eq = arrEqIR(val)
     const result = tempI32('ic')
     const exit = `$exit${ctx.func.uniq++}`
@@ -1720,6 +1975,26 @@ export default (ctx) => {
       ['f64.convert_i32_s', ['local.get', `$${result}`]]], 'f64')
   }
 
+  // Mirror of .indexOf scanning to the highest matching index — no early break, the last hit wins.
+  // Registering it (alongside .string:lastIndexOf) is what lets lastIndexOf leave STRING_ONLY_METHODS:
+  // an untyped receiver now forks string-vs-array at runtime instead of force-narrowing to string
+  // (which returned -1 for every array). fromIndex is unsupported, matching .indexOf's array path.
+  ctx.core.emit['.lastIndexOf'] = (arr, val) => {
+    const recv = hoistArrayValue(arr)
+    const vv = carrierF64(val, emit(val))
+    const eq = arrEqIR(val)
+    const result = tempI32('lx')
+    const loop = arrayLoop(recv.value, (_ptr, _len, i, item) => [
+      ['if', eq(item, vv),
+        ['then', ['local.set', `$${result}`, ['local.get', `$${i}`]]]]
+    ])
+    return typed(['block', ['result', 'f64'],
+      recv.setup,
+      ['local.set', `$${result}`, ['i32.const', -1]],
+      ...loop,
+      ['f64.convert_i32_s', ['local.get', `$${result}`]]], 'f64')
+  }
+
   // .at(i) → array element with negative index support
   ctx.core.emit['.array:at'] = (arr, idx) => {
     const vt = typeof arr === 'string' ? lookupValType(arr) : valTypeOf(arr)