jz 0.8.1 → 0.9.1

package/module/typedarray.js

@@ -7,9 +7,11 @@
  * @module typed
  */
 
-import { typed, asF64, asI32, asI64, toNumF64, UNDEF_NAN, allocPtr, mkPtrIR, ptrOffsetIR, ptrTypeEq, temp, tempI32, tempI64, undefExpr, truthyIR } from '../src/ir.js'
+import { typed, asF64, asI32, asI64, toNumF64, UNDEF_NAN, NULL_NAN, TRUE_NAN, FALSE_NAN, allocPtr, mkPtrIR, ptrOffsetIR, ptrTypeEq, temp, tempI32, tempI64, undefExpr, truthyIR } from '../src/ir.js'
 import { emit, idx, deps, call } from '../src/bridge.js'
+import { strHashLiteral } from './collection.js'
 import { valTypeOf } from '../src/kind.js'
+import { typedIdxProven } from '../src/type.js'
 import { VAL, lookupValType } from '../src/reps.js'
 import { nanPrefixHex, TYPED_ELEM_NAMES, TYPED_ELEM_CODE, TYPED_ELEM_BIGINT_FLAG, encodeTypedElemAux } from '../layout.js'
 import { inc, PTR, LAYOUT, registerGetter } from '../src/ctx.js'
@@ -236,6 +238,40 @@ export default (ctx) => {
   const blen = call('__byte_length', 'I', 'i32')
   const boff = call('__byte_offset', 'I', 'i32')
 
+  // Unknown receiver for a buffer-family accessor: only BUFFER/TYPED own
+  // `.buffer`/`.byteLength`/`.byteOffset` in JS — on everything else the name
+  // is an ordinary own property (or undefined). Same dispatch shape as
+  // collection.js's `.size` (the dot-name hijack class, .work/todo.md
+  // 2026-07-11): a PROVEN BUFFER/TYPED receiver keeps the direct helper call;
+  // otherwise tag-dispatch at runtime — the NaN-check guards real numbers
+  // whose bit pattern could false-match the tag compare, and the prehashed
+  // dyn dispatcher covers OBJECT schema slots, HASH keys, sidecars, and
+  // primitives (→ undefined).
+  const bufAccessorDyn = (prop, helper, direct) => (obj) => {
+    const vt = valTypeOf(obj)
+    if (vt === VAL.BUFFER || vt === VAL.TYPED) return direct(obj)
+    inc('__ptr_type', '__dyn_get_expr_t_h', helper)
+    const o = temp('bad'), t = tempI32('badt')
+    const og = ['local.get', `$${o}`]
+    const helperCall = ['call', `$${helper}`, ['i64.reinterpret_f64', og]]
+    return typed(['block', ['result', 'f64'],
+      ['local.set', `$${o}`, asF64(emit(obj))],
+      ['local.set', `$${t}`, ['call', '$__ptr_type', ['i64.reinterpret_f64', og]]],
+      ['if', ['result', 'f64'],
+        ['i32.and',
+          ['f64.ne', og, og],
+          ['i32.or',
+            ['i32.eq', ['local.get', `$${t}`], ['i32.const', PTR.BUFFER]],
+            ['i32.eq', ['local.get', `$${t}`], ['i32.const', PTR.TYPED]]]],
+        ['then', helper === '__to_buffer' ? typed(helperCall, 'f64') : ['f64.convert_i32_s', helperCall]],
+        ['else', ['f64.reinterpret_i64', ['call', '$__dyn_get_expr_t_h',
+          ['i64.reinterpret_f64', og], asI64(emit(['str', prop])), ['local.get', `$${t}`],
+          ['i32.const', strHashLiteral(prop)]]]]]], 'f64')
+  }
+  const bufDyn = bufAccessorDyn('buffer', '__to_buffer', buf)
+  const blenDyn = bufAccessorDyn('byteLength', '__byte_length', blen)
+  const boffDyn = bufAccessorDyn('byteOffset', '__byte_offset', boff)
+
   // === Runtime helpers: byte length, buffer coerce ===
   // __typed_shift lives in core (needed by __len/__cap).
 
@@ -364,20 +400,51 @@ export default (ctx) => {
             ['local.get', `$${parentOff}`]],
           mkPtrIR(PTR.TYPED, typedAux(name, true), ['local.get', `$${dst}`])], 'f64')
       }
+      // TypedArray(typedArray) COPIES into fresh storage with element conversion —
+      // spec: only (buffer[, off, len]) constructs a view. Element reads go through
+      // __typed_idx (the source's elemType lives in its aux at runtime), stores
+      // convert to THIS view's elemType — `new Float64Array(int32Arr)` converts.
+      const copyFromTyped = (srcTemp) => {
+        inc('__typed_idx', '__len')
+        const cl = tempI32('tcl'), ci = tempI32('tci')
+        const out = allocPtr({ type: PTR.TYPED, aux,
+          len: ['i32.mul', ['local.get', `$${cl}`], ['i32.const', stride]], stride: 1, tag: 'tc' })
+        const conv = FROM_F64[elemType]
+        const srcElem = ['call', '$__typed_idx', ['i64.reinterpret_f64', ['local.get', `$${srcTemp}`]], ['local.get', `$${ci}`]]
+        const cid = ctx.func.uniq++
+        return ['block', ['result', 'f64'],
+          ['local.set', `$${cl}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${srcTemp}`]]]],
+          out.init,
+          ['local.set', `$${ci}`, ['i32.const', 0]],
+          ['block', `$tcb${cid}`, ['loop', `$tclp${cid}`,
+            ['br_if', `$tcb${cid}`, ['i32.ge_s', ['local.get', `$${ci}`], ['local.get', `$${cl}`]]],
+            [STORE[elemType],
+              ['i32.add', ['local.get', `$${out.local}`], ['i32.mul', ['local.get', `$${ci}`], ['i32.const', stride]]],
+              conv ? [conv, srcElem] : srcElem],
+            ['local.set', `$${ci}`, ['i32.add', ['local.get', `$${ci}`], ['i32.const', 1]]],
+            ['br', `$tclp${cid}`]]],
+          out.ptr]
+      }
       // Single arg array-like source: copy elements instead of treating the pointer as a length.
       if (srcType === VAL.ARRAY && ctx.core.emit[`${name}.from`])
         return ctx.core.emit[`${name}.from`](lenExpr)
-      // Reinterpret on a buffer or another typed array: zero-copy view.
-      // TYPED retagged at the same offset — the byteLen header is shared with the parent.
-      // __len(view) = byteLen >> shift computes elemCount for this view's elemType.
-      if (srcType === VAL.BUFFER || srcType === VAL.TYPED) {
+      if (srcType === VAL.TYPED) {
+        const src = temp('ts')
+        return typed(['block', ['result', 'f64'],
+          ['local.set', `$${src}`, asF64(emit(lenExpr))],
+          copyFromTyped(src)], 'f64')
+      }
+      // Reinterpret on a buffer: zero-copy view. TYPED retagged at the same offset —
+      // the byteLen header is shared with the parent. __len(view) = byteLen >> shift
+      // computes elemCount for this view's elemType.
+      if (srcType === VAL.BUFFER) {
         ctx.features.typedView = true  // zero-copy reinterpret aliases the source — SLP must not pack across it
         return mkPtrIR(PTR.TYPED, aux, ['call', '$__ptr_offset', ['i64.reinterpret_f64', asF64(emit(lenExpr))]])
       }
       if (srcType == null && ctx.core.emit[`${name}.from`]) {
-        ctx.features.typedView = true  // unknown arg: runtime may take the buffer/typed zero-copy-view branch
+        ctx.features.typedView = true  // unknown arg: runtime may take the buffer zero-copy-view branch
 
-        // Runtime dispatch: number → allocate; array → copy elements; buffer/typed → zero-copy view.
+        // Runtime dispatch: number → allocate; array/typed → copy elements; buffer → zero-copy view.
         const src = temp('ts')
         const len = tempI32('tl')
         const shift = SHIFT[elemType]
@@ -392,12 +459,15 @@ export default (ctx) => {
               ['local.set', `$${len}`, ['i32.trunc_sat_f64_s', ['local.get', `$${src}`]]],
               numAlloc.init,
               numAlloc.ptr]],
-            // Pointer: array → copy elements; buffer/typed → zero-copy view on same offset
+            // Pointer: array → boxed-slot copy; typed → converted element copy; buffer → zero-copy view
             ['else', ['if', ['result', 'f64'],
               ptrTypeEq(['local.get', `$${src}`], PTR.ARRAY),
               ['then', ctx.core.emit[`${name}.from`](src)],
-              ['else', mkPtrIR(PTR.TYPED, aux,
-                ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${src}`]]])]]]]], 'f64')
+              ['else', ['if', ['result', 'f64'],
+                ptrTypeEq(['local.get', `$${src}`], PTR.TYPED),
+                ['then', copyFromTyped(src)],
+                ['else', mkPtrIR(PTR.TYPED, aux,
+                  ['call', '$__ptr_offset', ['i64.reinterpret_f64', ['local.get', `$${src}`]]])]]]]]]], 'f64')
       }
       // Normal: allocate fresh typed array (lenExpr is numeric size). Header stores byteLen.
       const shift = SHIFT[elemType]
@@ -496,7 +566,7 @@ export default (ctx) => {
         }
       }
     }
-    return buf(obj)
+    return bufDyn(obj)
   })
 
   // .byteLength — BUFFER: raw __len. Owned TYPED: elemCount * stride.
@@ -521,7 +591,7 @@ export default (ctx) => {
         }
       }
     }
-    return blen(obj)
+    return blenDyn(obj)
   })
 
   // .byteOffset — owned: 0. View: descriptor[4] - descriptor[8].
@@ -539,7 +609,7 @@ export default (ctx) => {
       }
       if (ctor?.startsWith('new.') && TYPED_ELEM_CODE[ctor.slice(4)] != null) return typed(['f64.const', 0], 'f64')
     }
-    return boff(obj)
+    return boffDyn(obj)
   })
 
   // Runtime fallback for .byteOffset when variable view-ness is unknown.
@@ -580,20 +650,22 @@ export default (ctx) => {
 
   // buf.slice(begin?, end?) on a BUFFER → fresh BUFFER with the byte range copied.
   // Only dispatches statically when obj is a tracked ArrayBuffer/DataView variable.
+  // Indices normalize through __clamp_idx (negative wraps from the end, then
+  // clamp to [0, byteLength]) — the same bounds dance as every other range op.
   ctx.core.emit['.buf:slice'] = (obj, beginExpr, endExpr) => {
+    inc('__clamp_idx')
     const src = temp('bss')
     const beg = tempI32('bsb')
     const end = tempI32('bse')
     const bytes = tempI32('bsn')
     const out = allocPtr({ type: PTR.BUFFER, len: ['local.get', `$${bytes}`], stride: 1, tag: 'bsd' })
+    const lenWat = ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${src}`]]]
     const beginWat = beginExpr == null ? ['i32.const', 0] : asI32(emit(beginExpr))
-    const endWat = endExpr == null
-      ? ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${src}`]]]
-      : asI32(emit(endExpr))
+    const endWat = endExpr == null ? lenWat : asI32(emit(endExpr))
     return typed(['block', ['result', 'f64'],
       ['local.set', `$${src}`, asF64(emit(obj))],
-      ['local.set', `$${beg}`, beginWat],
-      ['local.set', `$${end}`, endWat],
+      ['local.set', `$${beg}`, ['call', '$__clamp_idx', beginWat, lenWat]],
+      ['local.set', `$${end}`, ['call', '$__clamp_idx', endWat, lenWat]],
       ['local.set', `$${bytes}`, ['i32.sub', ['local.get', `$${end}`], ['local.get', `$${beg}`]]],
       ['if',
         ['i32.lt_s', ['local.get', `$${bytes}`], ['i32.const', 0]],
@@ -909,6 +981,29 @@ export default (ctx) => {
     const stride = STRIDE[elemType], store = STORE[elemType]
     ctx.core.emit[`${name}.from`] = (src) => {
       ctx.features.typedarray = true
+      // Bare array-literal source (`Int32Array.from([…])`, `new Int32Array([…])`): build the
+      // typed array directly — alloc + one native-typed store per element — instead of
+      // materializing an intermediate f64 ARRAY (every element a 9-byte f64.const) plus a
+      // per-element f64→elem copy loop. For an integer view each element then stores as an
+      // i32.const (2 B for small values), so a constant program / lookup table stops
+      // round-tripping through the boxed-f64 array. Fresh alloc per evaluation, so identity
+      // and mutation semantics are unchanged. BigInt views (elemType>7) keep the loop.
+      if (Array.isArray(src) && src[0] === '[' && elemType <= 7
+          && !src.slice(1).some(e => Array.isArray(e) && e[0] === '...')) {
+        const elems = src.slice(1)
+        const out = allocPtr({ type: PTR.TYPED, aux, len: ['i32.const', elems.length * stride], stride: 1, tag: 'tf' })
+        const body = [out.init]
+        for (let k = 0; k < elems.length; k++) {
+          const addr = k === 0 ? ['local.get', `$${out.local}`]
+            : ['i32.add', ['local.get', `$${out.local}`], ['i32.const', k * stride]]
+          const v = elemType <= 5 ? asI32(emit(elems[k]))
+            : elemType === 6 ? ['f32.demote_f64', asF64(emit(elems[k]))]
+            : asF64(emit(elems[k]))
+          body.push([store, addr, v])
+        }
+        body.push(out.ptr)
+        return typed(['block', ['result', 'f64'], ...body], 'f64')
+      }
       const srcL = temp('tfs')
       const len = tempI32('tfl'), i = tempI32('tfi'), off = tempI32('tfo')
       const out = allocPtr({ type: PTR.TYPED, aux,
@@ -993,7 +1088,7 @@ export default (ctx) => {
   // Runtime-dispatch typed index: checks ptr_type + aux to load with correct stride.
   // For TYPED views (aux bit 3), $off indirects through descriptor[4] to real data.
   ctx.core.stdlib['__typed_set_idx'] = `(func $__typed_set_idx (param $ptr i64) (param $i i32) (param $v f64) (result f64)
-    (local $off i32) (local $aux i32) (local $et i32) (local $bits i32)
+    (local $off i32) (local $aux i32) (local $et i32) (local $bits i32) (local $vb i64)
     (local.set $aux (call $__ptr_aux (local.get $ptr)))
     (local.set $off (call $__ptr_offset (local.get $ptr)))
     (if (i32.ne (i32.and (local.get $aux) (i32.const 8)) (i32.const 0))
@@ -1002,6 +1097,19 @@ export default (ctx) => {
     (if (i32.and (local.get $aux) (i32.const ${TYPED_ELEM_BIGINT_FLAG}))
       (then (i64.store (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3))) (i64.reinterpret_f64 (local.get $v))))
       (else
+        ;; ToNumber for NaN-boxed values (spec: typed element writes coerce).
+        ;; true/false/null atoms store 1/0/0; other boxes (undefined, string,
+        ;; object) store canonical NaN. Skipped on the BigInt arm above — raw
+        ;; bigint i64 bits legitimately look like NaN through the f64 param.
+        (if (f64.ne (local.get $v) (local.get $v))
+          (then
+            (local.set $vb (i64.reinterpret_f64 (local.get $v)))
+            (local.set $v (f64.const nan))
+            (if (i64.eq (local.get $vb) (i64.const ${TRUE_NAN}))
+              (then (local.set $v (f64.const 1))))
+            (if (i32.or (i64.eq (local.get $vb) (i64.const ${FALSE_NAN}))
+                        (i64.eq (local.get $vb) (i64.const ${NULL_NAN})))
+              (then (local.set $v (f64.const 0))))))
         (if (i32.eq (local.get $et) (i32.const 7))
           (then (f64.store (i32.add (local.get $off) (i32.shl (local.get $i) (i32.const 3))) (local.get $v)))
           (else
@@ -1223,55 +1331,107 @@ export default (ctx) => {
   }
   ctx.core.emit['.typed:sort'] = (arr, fn) => emitTypedSort(emit(arr), fn)
 
-  // Type-aware TypedArray read: arr[i]
+  // Type-aware TypedArray read: arr[i]. The DIRECT unchecked load is gated on the
+  // structural in-bounds proof (inBoundsArrIdx — the same canonical `for (i=C≥0;
+  // i<arr.length; i++)` scan the generic ARRAY read uses), which keeps every proven
+  // hot loop byte-identical (the vectorizer's shapes). An UNPROVEN index takes the
+  // checked form: JS reads `undefined` past the end — the unchecked load read
+  // ADJACENT HEAP or trapped past memory (the Root F silent-corruption class).
+  // `i32.lt_u` folds the negative case in (a negative i32 is a huge u32). The
+  // checked result is number|undefined, so it carries NO valKind tag.
   ctx.core.emit['.typed:[]'] = (arr, i) => {
     const r = resolveElem(arr)
     if (r == null) return null // unknown type, fallback to generic
     const { et, isView, isBigInt } = r
+    const proven = typedIdxProven(arr, i)
+    const loadOf = (off) => isBigInt ? ['f64.reinterpret_i64', ['i64.load', off]]
+      : et === 7 ? ['f64.load', off]
+      : et === 6 ? ['f64.promote_f32', ['f32.load', off]]
+      : [(et & 1) ? 'f64.convert_i32_u' : 'f64.convert_i32_s', [LOAD[et], off]]
+    if (!proven) {
+      // BRANCHLESS checked read: `select(load(in ? idx : 0), undefined, in)`. The
+      // address clamp makes the load unconditionally safe (index 0 of the data
+      // region is mapped arena even for a 0-length array — the loaded value is
+      // select-discarded), and the branch-free shape keeps checked reads inside
+      // straight-line kernel bodies the SIMD recognizers can still lift.
+      // len inlines to one header load for a RESOLVED elem type (no call — the
+      // SIMD recognizers require call-free kernel bodies): owned byteLen at
+      // base-8, view byteLen at descriptor[0]; elemCount = byteLen >> shift.
+      const ti = tempI32('tbi'), tin = tempI32('tbn')
+      const lenIR = ['i32.shr_u',
+        ['i32.load', isView ? typedBase(emit(arr)) : ['i32.sub', typedBase(emit(arr)), ['i32.const', 8]]],
+        ['i32.const', SHIFT[et]]]
+      const off = ['i32.add', typedDataAddr(emit(arr), isView),
+        ['i32.shl', ['select', ['local.get', `$${ti}`], ['i32.const', 0], ['local.get', `$${tin}`]],
+          ['i32.const', SHIFT[et]]]]
+      return typed(['block', ['result', 'f64'],
+        ['local.set', `$${ti}`, idx(i)],
+        ['local.set', `$${tin}`, ['i32.lt_u', ['local.get', `$${ti}`], lenIR]],
+        ['select', loadOf(off), undefExpr(), ['local.get', `$${tin}`]]], 'f64')
+    }
     const objIR = emit(arr), vi = idx(i)
     const off = ['i32.add', typedDataAddr(objIR, isView), ['i32.shl', vi, ['i32.const', SHIFT[et]]]]
-    if (isBigInt) return typed(['f64.reinterpret_i64', ['i64.load', off]], 'f64')
-    if (et === 7) return typed(['f64.load', off], 'f64') // Float64Array
-    if (et === 6) return typed(['f64.promote_f32', ['f32.load', off]], 'f64') // Float32Array
-    // Integer types: load and convert to f64 (unsigned types use unsigned conversion)
-    return typed([(et & 1) ? 'f64.convert_i32_u' : 'f64.convert_i32_s', [LOAD[et], off]], 'f64')
+    if (isBigInt) return typed(loadOf(off), 'f64')
+    // Non-bigint typed elements are plain NUMBERS — tag the load so numeric-arm
+    // predicates (isNumArm: `+` dispatch numSide, ?:/?? canon) skip box guards.
+    const t = typed(loadOf(off), 'f64'); t.valKind = VAL.NUMBER; return t
   }
 
-  // Type-aware TypedArray write: arr[i] = val
+  // Type-aware TypedArray write: arr[i] = val. Same proof gate as the read: proven
+  // indexes keep the direct unchecked store byte-identical; unproven ones evaluate
+  // the RHS (its effects and the assignment's value are unconditional per spec),
+  // then store only when `i u< len` — JS silently IGNORES out-of-bounds typed
+  // writes, where the unchecked store corrupted adjacent heap (Root F).
   ctx.core.emit['.typed:[]='] = (arr, i, val, void_ = false) => {
     const r = resolveElem(arr)
     if (r == null) return null
     const { et, isView, isBigInt } = r
-    const objIR = emit(arr), vi = idx(i), valIR = emit(val)
+    const proven = typedIdxProven(arr, i)
+    const pre = []
+    let vi
+    if (proven) vi = idx(i)
+    else {
+      inc('__len')
+      const ti = tempI32('tbi')
+      pre.push(['local.set', `$${ti}`, idx(i)])
+      vi = ['local.get', `$${ti}`]
+    }
+    // Wrap a store statement in the bounds guard on the unproven path. The value
+    // temp is set OUTSIDE the guard (spec: RHS evaluates regardless).
+    const guard = (store) => proven ? store
+      : ['if', ['i32.lt_u', vi, ['i32.shr_u',
+          ['i32.load', isView ? typedBase(emit(arr)) : ['i32.sub', typedBase(emit(arr)), ['i32.const', 8]]],
+          ['i32.const', SHIFT[et]]]], ['then', store]]
+    const objIR = emit(arr), valIR = emit(val)
     const off = ['i32.add', typedDataAddr(objIR, isView), ['i32.shl', vi, ['i32.const', SHIFT[et]]]]
     if (isBigInt) {
       const vt = temp('tw')
-      return typed(void_ ? ['block',
+      return typed(void_ ? ['block', ...pre,
         ['local.set', `$${vt}`, asF64(valIR)],
-        ['i64.store', off, ['i64.reinterpret_f64', ['local.get', `$${vt}`]]]]
-        : ['block', ['result', 'f64'],
+        guard(['i64.store', off, ['i64.reinterpret_f64', ['local.get', `$${vt}`]]])]
+        : ['block', ['result', 'f64'], ...pre,
         ['local.set', `$${vt}`, asF64(valIR)],
-        ['i64.store', off, ['i64.reinterpret_f64', ['local.get', `$${vt}`]]],
+        guard(['i64.store', off, ['i64.reinterpret_f64', ['local.get', `$${vt}`]]]),
         ['local.get', `$${vt}`]], void_ ? 'void' : 'f64')
     }
     if (et === 7) {
       const vt = temp('tw')
-      return typed(void_ ? ['block',
+      return typed(void_ ? ['block', ...pre,
         ['local.set', `$${vt}`, asF64(valIR)],
-        ['f64.store', off, ['local.get', `$${vt}`]]]
-        : ['block', ['result', 'f64'],
+        guard(['f64.store', off, ['local.get', `$${vt}`]])]
+        : ['block', ['result', 'f64'], ...pre,
         ['local.set', `$${vt}`, asF64(valIR)],
-        ['f64.store', off, ['local.get', `$${vt}`]],
+        guard(['f64.store', off, ['local.get', `$${vt}`]]),
         ['local.get', `$${vt}`]], void_ ? 'void' : 'f64') // Float64Array
     }
     if (et === 6) {
       const vt = temp('tw')
-      return typed(void_ ? ['block',
+      return typed(void_ ? ['block', ...pre,
         ['local.set', `$${vt}`, asF64(valIR)],
-        ['f32.store', off, ['f32.demote_f64', ['local.get', `$${vt}`]]]]
-        : ['block', ['result', 'f64'],
+        guard(['f32.store', off, ['f32.demote_f64', ['local.get', `$${vt}`]]])]
+        : ['block', ['result', 'f64'], ...pre,
         ['local.set', `$${vt}`, asF64(valIR)],
-        ['f32.store', off, ['f32.demote_f64', ['local.get', `$${vt}`]]],
+        guard(['f32.store', off, ['f32.demote_f64', ['local.get', `$${vt}`]]]),
         ['local.get', `$${vt}`]], void_ ? 'void' : 'f64') // Float32Array
     }
     // Integer store: when the source is already i32-typed (bitwise ops, |0, known-i32 var) —
@@ -1285,18 +1445,19 @@ export default (ctx) => {
     const i32Backed = valIR.type === 'i32' ||
       (Array.isArray(valIR) && (valIR[0] === 'f64.convert_i32_s' || valIR[0] === 'f64.convert_i32_u'))
     if (i32Backed) {
-      const vi = asI32(valIR)
-      const cheap = Array.isArray(vi) &&
-        ((vi[0] === 'local.get' && typeof vi[1] === 'string') ||
-         (vi[0] === 'i32.const' && (typeof vi[1] === 'number' || typeof vi[1] === 'string')))
-      if (void_ && cheap) return typed([STORE[et], off, vi], 'void')
+      const vi32 = asI32(valIR)
+      const cheap = Array.isArray(vi32) &&
+        ((vi32[0] === 'local.get' && typeof vi32[1] === 'string') ||
+         (vi32[0] === 'i32.const' && (typeof vi32[1] === 'number' || typeof vi32[1] === 'string')))
+      if (void_ && cheap && proven) return typed([STORE[et], off, vi32], 'void')
+      if (void_ && cheap) return typed(['block', ...pre, guard([STORE[et], off, vi32])], 'void')
       const v32 = tempI32('tw')
-      return typed(void_ ? ['block',
-        ['local.set', `$${v32}`, vi],
-        [STORE[et], off, ['local.get', `$${v32}`]]]
-        : ['block', ['result', 'f64'],
-        ['local.set', `$${v32}`, vi],
-        [STORE[et], off, ['local.get', `$${v32}`]],
+      return typed(void_ ? ['block', ...pre,
+        ['local.set', `$${v32}`, vi32],
+        guard([STORE[et], off, ['local.get', `$${v32}`]])]
+        : ['block', ['result', 'f64'], ...pre,
+        ['local.set', `$${v32}`, vi32],
+        guard([STORE[et], off, ['local.get', `$${v32}`]]),
         [(et & 1) ? 'f64.convert_i32_u' : 'f64.convert_i32_s', ['local.get', `$${v32}`]]], void_ ? 'void' : 'f64')
     }
     const vt = temp('tw')
@@ -1304,12 +1465,12 @@ export default (ctx) => {
       ['if', ['result', 'i64'], ['f64.lt', ['local.get', `$${vt}`], ['f64.const', 0]],
         ['then', ['i64.trunc_sat_f64_s', ['local.get', `$${vt}`]]],
         ['else', ['i64.trunc_sat_f64_u', ['local.get', `$${vt}`]]]]]
-    return typed(void_ ? ['block',
+    return typed(void_ ? ['block', ...pre,
       ['local.set', `$${vt}`, asF64(valIR)],
-      [STORE[et], off, i32val]]
-      : ['block', ['result', 'f64'],
+      guard([STORE[et], off, i32val])]
+      : ['block', ['result', 'f64'], ...pre,
       ['local.set', `$${vt}`, asF64(valIR)],
-      [STORE[et], off, i32val],
+      guard([STORE[et], off, i32val]),
       ['local.get', `$${vt}`]], void_ ? 'void' : 'f64')
   }
 
@@ -1436,9 +1597,7 @@ export default (ctx) => {
   // typedLoop(arr, bodyFn, opts?) emits the common shape every typed iteration
   // method needs: resolve elemType from the receiver's tracked ctor, set up
   // (ptr, len, i) locals, walk i in [0, len), per iteration load arr[i] as f64
-  // and pass it to bodyFn. Returns the IR setup statements. Returns null if the
-  // element type can't be resolved — callers fall back to the generic array
-  // emitter.
+  // and pass it to bodyFn. Returns the IR setup statements.
   //
   // bodyFn(loadElem, i, len, ptr, exitLabel) returns IR statements. loadElem is
   // a function (called lazily so it isn't materialized for unused-item paths)
@@ -1447,30 +1606,63 @@ export default (ctx) => {
   // resolution). `i`/`len`/`ptr` are i32 local-name strings.
   const typedLoop = (arr, bodyFn) => {
     const r = resolveElem(arr)
-    if (!r) return null
-    const { et, isView, isBigInt } = r
-    if (isBigInt) return null  // BigInt: defer to generic .map (returns BigInts via f64-bits NaN-box)
-    const va = emit(arr)
-    const len = tempI32('tll'), ptr = tempI32('tlp'), i = tempI32('tli')
     const id = ctx.func.uniq++
     const exit = `$brk${id}`
-    inc('__len')
-    const loadElem = () => {
-      const off = ['i32.add', ['local.get', `$${ptr}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', SHIFT[et]]]]
-      if (et === 7) return typed(['f64.load', off], 'f64')
-      if (et === 6) return typed(['f64.promote_f32', ['f32.load', off]], 'f64')
-      return typed([(et & 1) ? 'f64.convert_i32_u' : 'f64.convert_i32_s', [LOAD[et], off]], 'f64')
+    const len = tempI32('tll'), i = tempI32('tli')
+    // Static fast path: concrete element kind (and non-BigInt-ness) proven at
+    // compile time — direct-typed load, no per-element dispatch.
+    if (r && !r.isBigInt) {
+      const { et, isView } = r
+      const va = emit(arr)
+      const ptr = tempI32('tlp')
+      inc('__len')
+      const loadElem = () => {
+        const off = ['i32.add', ['local.get', `$${ptr}`], ['i32.shl', ['local.get', `$${i}`], ['i32.const', SHIFT[et]]]]
+        if (et === 7) return typed(['f64.load', off], 'f64')
+        if (et === 6) return typed(['f64.promote_f32', ['f32.load', off]], 'f64')
+        return typed([(et & 1) ? 'f64.convert_i32_u' : 'f64.convert_i32_s', [LOAD[et], off]], 'f64')
+      }
+      const setup = [
+        ['local.set', `$${ptr}`, typedDataAddr(asF64(va), isView)],
+        ['local.set', `$${len}`, ['call', '$__len', ['i64.reinterpret_f64', asF64(va)]]],
+        ['local.set', `$${i}`, ['i32.const', 0]],
+        ['block', exit, ['loop', `$loop${id}`,
+          ['br_if', exit, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${len}`]]],
+          ...bodyFn(loadElem, i, len, ptr, exit),
+          ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
+          ['br', `$loop${id}`]]]]
+      return { setup, ptr, len, i, exit, et, isView, loadElem }
     }
+    // Dynamic fallback: concrete element kind (or BigInt-ness) isn't provable
+    // statically — `resolveElem` only tracks a receiver traced back to a bare
+    // `new XArray(...)` binding, so a TYPED value that instead flowed through
+    // an object field, a return value, or any other opaque path (still proven
+    // *some* typed array — that's how it dispatched here at all — just not
+    // WHICH one) has no ctor to key off. Read every element through
+    // __typed_get_idx: the SAME runtime aux-tag dispatch .reverse/.sort/.fill/
+    // .copyWithin already use UNCONDITIONALLY (module/core.js), correct for
+    // any concrete kind including BigInt, one indirect call slower per
+    // element than the static path above. This used to `return null`, which
+    // every caller propagated as "unsupported" up to emitMethodCall — for a
+    // receiver already proven VAL.TYPED that either crashed downstream (null
+    // IR reaching a consumer) or, if a caller "fell back to the generic array
+    // emitter" instead, would misread the typed array's packed native bytes
+    // as 8-byte f64 slots (module/array.js's arrayLoop is ARRAY-only) —
+    // silent corruption, not a fallback. This is the sound one.
+    inc('__typed_get_idx', '__len')
+    const av = temp('tla')
+    const loadElem = () => typed(['call', '$__typed_get_idx',
+      ['i64.reinterpret_f64', ['local.get', `$${av}`]], ['local.get', `$${i}`]], 'f64')
     const setup = [
-      ['local.set', `$${ptr}`, typedDataAddr(asF64(va), isView)],
-      ['local.set', `$${len}`, ['call', '$__len', ['i64.reinterpret_f64', asF64(va)]]],
+      ['local.set', `$${av}`, asF64(emit(arr))],
+      ['local.set', `$${len}`, ['call', '$__len', ['i64.reinterpret_f64', ['local.get', `$${av}`]]]],
       ['local.set', `$${i}`, ['i32.const', 0]],
       ['block', exit, ['loop', `$loop${id}`,
         ['br_if', exit, ['i32.ge_s', ['local.get', `$${i}`], ['local.get', `$${len}`]]],
-        ...bodyFn(loadElem, i, len, ptr, exit),
+        ...bodyFn(loadElem, i, len, null, exit),
         ['local.set', `$${i}`, ['i32.add', ['local.get', `$${i}`], ['i32.const', 1]]],
         ['br', `$loop${id}`]]]]
-    return { setup, ptr, len, i, exit, et, isView, loadElem }
+    return { setup, ptr: null, len, i, exit, et: null, isView: false, loadElem }
   }
 
   // === Typed iteration emitters ===

package/module/web.js

@@ -0,0 +1,36 @@
+/**
+ * web — callable host web globals (`fetch(...)`), bound automatically.
+ *
+ * Under host:'js' a bare `fetch(url, opts?)` lowers to an `env.fetch` import
+ * that interop wires from `globalThis.fetch` with full marshalling — the
+ * returned thenable adopts into a jz promise, so `await fetch(url)` works and
+ * the Response crosses as an external handle (`.text()`/`.json()` dispatch
+ * host-side and are awaitable in turn). No import statement needed.
+ *
+ * Under host:'wasi' there is no JS host to bind — a warning is emitted and
+ * the env import is still declared, so an embedder MAY wire `env.fetch`
+ * itself; an unwired module fails at instantiation, not silently.
+ *
+ * @module web
+ */
+
+import { typed, asI64, UNDEF_NAN } from '../src/ir.js'
+import { emit, hostImport } from '../src/bridge.js'
+import { warn } from '../src/ctx.js'
+
+const ARITY = { fetch: 2 }
+
+export default (ctx) => {
+  for (const [name, arity] of Object.entries(ARITY)) {
+    ctx.core.emit[name] = (...args) => {
+      if (ctx.transform.host === 'wasi')
+        warn('host-global', `\`${name}\` binds from the JS host — under host:'wasi' wire env.${name} yourself or instantiation will fail`, {})
+      hostImport('env', name, ['func', `$__env_${name}`,
+        ...Array.from({ length: arity }, () => ['param', 'i64']), ['result', 'i64']])
+      const ir = [`call`, `$__env_${name}`]
+      for (let i = 0; i < arity; i++)
+        ir.push(args[i] != null ? asI64(emit(args[i])) : ['i64.const', UNDEF_NAN])
+      return typed(['f64.reinterpret_i64', ir], 'f64')
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jz",
-  "version": "0.8.1",
+  "version": "0.9.1",
   "description": "Ahead-of-time compiler for the numeric core of JavaScript (DSP, audio, math, parsers) to lean GC-free WASM — valid jz is valid JS, no type annotations, no runtime.",
   "main": "index.js",
   "types": "index.d.ts",
@@ -46,7 +46,7 @@
     "test:bench": "node test/bench.js",
     "test:fuzz": "node test/fuzz.js --count=5000",
     "test:ratchet": "node test/perf-ratchet.js",
-    "test:self": "node test/selfhost.js",
+    "test:self": "node test/selfhost.js && node test/selfhost-perf.js",
     "test:262": "node test/test262.js",
     "test:262:builtins": "node test/test262-builtins.js",
     "test:all": "npm run test:matrix && npm run test:262 && npm run test:262:builtins && npm run test:bench && npm run test:self",
@@ -60,7 +60,7 @@
     "audit:as": "node scripts/audit-assemblyscript.mjs",
     "build": "node scripts/build-dist.mjs",
     "build:examples": "node examples/build.mjs all",
-    "prepublishOnly": "npm test && npm run build && npm run test:self",
+    "prepublishOnly": "npm test && npm run test:self",
     "prepare": "npm run build",
     "audit:fixpoint": "node scripts/audit-fixpoint.mjs"
   },
@@ -75,8 +75,8 @@
   "author": "Dmitry Iv",
   "license": "MIT",
   "dependencies": {
-    "subscript": "^10.4.17",
-    "watr": "^5.0.0"
+    "subscript": "^10.7.0",
+    "watr": "^5.4.2"
   },
   "keywords": [
     "javascript",