diff --git a/crates/js/Cargo.toml b/crates/js/Cargo.toml
index 0108b50d9..4cb1e62c2 100644
--- a/crates/js/Cargo.toml
+++ b/crates/js/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "vectorcraft-js"
-description = "JavaScript for scripts: an ECMAScript 5.1 lexer and parser to a syntax tree with source positions"
+description = "JavaScript for scripts: an ECMAScript 5.1 parser, and an interpreter with a garbage-collected heap and execution limits"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs
new file mode 100644
index 000000000..3eda7b6a6
--- /dev/null
+++ b/crates/js/src/builtins.rs
@@ -0,0 +1,352 @@
+//! The built-in objects the interpreter itself needs (ECMA-262 5.1 section 15): `Object` and the
+//! basic methods of `Object.prototype`, `Function` with `Function.prototype.call`, `apply` and
+//! `toString`, `eval`, the error constructors and `Error.prototype.toString`, and the prototypes
+//! primitive values look properties up on. The rest of the standard library is not here yet.
+
+use std::rc::Rc;
+
+use crate::bytecode::{CodeKind, Source};
+use crate::compiler::{CompileFail, compile_constructed_function};
+use crate::heap::{Class, Func, HIDDEN, NativeFn, NativeKind, ObjId, Object, Prop, key, string_bytes};
+use crate::interp::{Abrupt, ErrorType, Interp, JsResult};
+use crate::value::{Str, Value};
+
+fn alloc(interp: &mut Interp, class: Class, proto: Option<ObjId>) -> ObjId {
+    interp.heap.alloc_object(Object::new(class, proto))
+}
+
+/// A built-in function object.
+fn native(interp: &mut Interp, name: &'static str, f: NativeFn, length: u32, kind: NativeKind, constructor: bool) -> JsResult<ObjId> {
+    let proto = interp.intrinsics.function_proto;
+    let o = alloc(interp, Class::Function(Func::Native { f, kind, constructor, name }), Some(proto));
+    interp.define(o, key("length"), Prop::Data { value: Value::Number(f64::from(length)), flags: 0 })?;
+    Ok(o)
+}
+
+fn method(interp: &mut Interp, on: ObjId, name: &'static str, f: NativeFn, length: u32) -> JsResult<()> {
+    let m = native(interp, name, f, length, NativeKind::Plain, false)?;
+    interp.define(on, key(name), Prop::Data { value: Value::Object(m), flags: HIDDEN })
+}
+
+fn data(interp: &mut Interp, on: ObjId, name: &str, value: Value, flags: u8) -> JsResult<()> {
+    interp.define(on, key(name), Prop::Data { value, flags })
+}
+
+/// Links a constructor and its prototype and makes the constructor a global.
+fn constructor(interp: &mut Interp, name: &'static str, ctor: ObjId, proto: ObjId) -> JsResult<()> {
+    data(interp, ctor, "prototype", Value::Object(proto), 0)?;
+    data(interp, proto, "constructor", Value::Object(ctor), HIDDEN)?;
+    let global = interp.global;
+    data(interp, global, name, Value::Object(ctor), HIDDEN)
+}
+
+/// Creates the built-ins and the global object's properties.
+pub(crate) fn install(interp: &mut Interp) {
+    if let Err(e) = try_install(interp) {
+        // Installing touches only objects it has just made, so this does not happen; a realm
+        // that somehow lacks a built-in reports it when a script uses it.
+        let _ = e;
+    }
+}
+
+fn try_install(interp: &mut Interp) -> JsResult<()> {
+    let object_proto = alloc(interp, Class::Ordinary, None);
+    interp.intrinsics.object_proto = object_proto;
+    let function_proto = alloc(
+        interp,
+        Class::Function(Func::Native { f: function_proto_call, kind: NativeKind::Plain, constructor: false, name: "" }),
+        Some(object_proto),
+    );
+    interp.intrinsics.function_proto = function_proto;
+    data(interp, function_proto, "length", Value::Number(0.0), 0)?;
+    let global = interp.global;
+    if let Some(g) = interp.heap.object_mut(global) {
+        g.proto = Some(object_proto);
+    }
+    interp.intrinsics.array_proto = alloc(interp, Class::Array { length: 0, length_writable: true }, Some(object_proto));
+    interp.intrinsics.string_proto = alloc(interp, Class::String(Str::from("")), Some(object_proto));
+    interp.intrinsics.number_proto = alloc(interp, Class::Number, Some(object_proto));
+    interp.intrinsics.boolean_proto = alloc(interp, Class::Boolean, Some(object_proto));
+    interp.intrinsics.regexp_proto = alloc(interp, Class::Ordinary, Some(object_proto));
+    let thrower = native(interp, "", throw_type_error, 0, NativeKind::Plain, false)?;
+    if let Some(t) = interp.heap.object_mut(thrower) {
+        t.extensible = false;
+    }
+    interp.intrinsics.throw_type_error = thrower;
+
+    data(interp, global, "NaN", Value::Number(f64::NAN), 0)?;
+    data(interp, global, "Infinity", Value::Number(f64::INFINITY), 0)?;
+    data(interp, global, "undefined", Value::Undefined, 0)?;
+    let eval = native(interp, "eval", eval, 1, NativeKind::Eval, false)?;
+    interp.intrinsics.eval = eval;
+    data(interp, global, "eval", Value::Object(eval), HIDDEN)?;
+
+    let object = native(interp, "Object", object_ctor, 1, NativeKind::Plain, true)?;
+    constructor(interp, "Object", object, object_proto)?;
+    method(interp, object_proto, "toString", object_to_string, 0)?;
+    method(interp, object_proto, "toLocaleString", object_to_locale_string, 0)?;
+    method(interp, object_proto, "valueOf", object_value_of, 0)?;
+    method(interp, object_proto, "hasOwnProperty", has_own_property, 1)?;
+    method(interp, object_proto, "isPrototypeOf", is_prototype_of, 1)?;
+    method(interp, object_proto, "propertyIsEnumerable", property_is_enumerable, 1)?;
+
+    let function = native(interp, "Function", function_ctor, 1, NativeKind::Plain, true)?;
+    constructor(interp, "Function", function, function_proto)?;
+    let call = native(interp, "call", unreachable_native, 1, NativeKind::Call, false)?;
+    data(interp, function_proto, "call", Value::Object(call), HIDDEN)?;
+    let apply = native(interp, "apply", unreachable_native, 2, NativeKind::Apply, false)?;
+    data(interp, function_proto, "apply", Value::Object(apply), HIDDEN)?;
+    method(interp, function_proto, "toString", function_to_string, 0)?;
+
+    install_errors(interp, object_proto)
+}
+
+fn install_errors(interp: &mut Interp, object_proto: ObjId) -> JsResult<()> {
+    let kinds: [(&'static str, NativeFn); 7] = [
+        ("Error", error_ctor),
+        ("EvalError", eval_error_ctor),
+        ("RangeError", range_error_ctor),
+        ("ReferenceError", reference_error_ctor),
+        ("SyntaxError", syntax_error_ctor),
+        ("TypeError", type_error_ctor),
+        ("URIError", uri_error_ctor),
+    ];
+    let mut error_proto = object_proto;
+    for (i, (name, f)) in kinds.into_iter().enumerate() {
+        // Error.prototype and each NativeError prototype are Error objects (sections 15.11.4 and
+        // 15.11.7.7).
+        let proto = alloc(interp, Class::Error, Some(if i == 0 { object_proto } else { error_proto }));
+        if i == 0 {
+            error_proto = proto;
+            method(interp, proto, "toString", error_to_string, 0)?;
+        }
+        if let Some(slot) = interp.intrinsics.error_protos.get_mut(i) {
+            *slot = proto;
+        }
+        data(interp, proto, "name", Value::str(name), HIDDEN)?;
+        data(interp, proto, "message", Value::str(""), HIDDEN)?;
+        let ctor = native(interp, name, f, 1, NativeKind::Plain, true)?;
+        constructor(interp, name, ctor, proto)?;
+    }
+    Ok(())
+}
+
+fn arg(args: &[Value], i: usize) -> Value {
+    args.get(i).cloned().unwrap_or(Value::Undefined)
+}
+
+fn unreachable_native(_: &mut Interp, _: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    Err(Abrupt::Internal("call or apply reached its native body".into()))
+}
+
+fn throw_type_error(interp: &mut Interp, _: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    Err(interp.type_error("'caller', 'callee' and 'arguments' cannot be used on strict mode functions"))
+}
+
+fn function_proto_call(_: &mut Interp, _: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    Ok(Value::Undefined)
+}
+
+// ---- Object ----
+
+/// `Object(value)` and `new Object(value)` (sections 15.2.1 and 15.2.2).
+fn object_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    let v = arg(args, 0);
+    if v.is_nullish() {
+        return Ok(Value::Object(interp.new_object()));
+    }
+    interp.to_object(&v).map(Value::Object)
+}
+
+/// `Object.prototype.toString` (section 15.2.4.2).
+fn object_to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    let class = match &this {
+        Value::Undefined => "Undefined",
+        Value::Null => "Null",
+        _ => {
+            let o = interp.to_object(&this)?;
+            interp.heap.object(o).map_or("Object", |o| o.class.name())
+        }
+    };
+    Ok(Value::str(&format!("[object {class}]")))
+}
+
+fn object_to_locale_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    let o = interp.to_object(&this)?;
+    let f = interp.get_from(o, &key("toString"), &this)?;
+    if !interp.is_callable(&f) {
+        return Err(interp.type_error("toString is not a function"));
+    }
+    interp.call(&f, &this, &[])
+}
+
+fn object_value_of(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    interp.to_object(&this).map(Value::Object)
+}
+
+fn has_own_property(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    let k = interp.to_key(&arg(args, 0))?;
+    let o = interp.to_object(&this)?;
+    Ok(Value::Bool(interp.get_own_property(o, &k)?.is_some()))
+}
+
+fn is_prototype_of(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    let Value::Object(mut v) = arg(args, 0) else { return Ok(Value::Bool(false)) };
+    let o = interp.to_object(&this)?;
+    while let Some(p) = interp.heap.object(v).and_then(|v| v.proto) {
+        if p == o {
+            return Ok(Value::Bool(true));
+        }
+        v = p;
+        interp.use_fuel()?;
+    }
+    Ok(Value::Bool(false))
+}
+
+fn property_is_enumerable(interp: &mut Interp, this: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    let k = interp.to_key(&arg(args, 0))?;
+    let o = interp.to_object(&this)?;
+    Ok(Value::Bool(interp.get_own_property(o, &k)?.is_some_and(|p| p.enumerable())))
+}
+
+// ---- Function ----
+
+/// `Function(p1, …, body)` and `new Function(…)` (section 15.3.2.1): the source is read as
+/// `(function anonymous(p1,…\n) {\nbody\n})` and must be exactly that one function.
+fn function_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    const HEAD: &str = "(function anonymous(";
+    const MID: &str = "\n) {\n";
+    const TAIL: &str = "\n})";
+    let mut parts = Vec::with_capacity(args.len());
+    for a in args {
+        parts.push(interp.to_str(a)?);
+    }
+    let body = parts.pop().unwrap_or_else(|| Str::from(""));
+    // The length is checked against the source limit before any argument is flattened or copied.
+    let total = parts
+        .iter()
+        .map(Str::len)
+        .chain([parts.len().saturating_sub(1), HEAD.len() + MID.len() + TAIL.len(), body.len()])
+        .fold(0usize, usize::saturating_add);
+    interp.check_source_units(total).map_err(|e| interp.compile_error_to_abrupt(e))?;
+    let mut units = Vec::with_capacity(total);
+    units.extend(HEAD.encode_utf16());
+    for (i, p) in parts.iter().enumerate() {
+        if i > 0 {
+            units.push(u16::from(b','));
+        }
+        units.extend_from_slice(&p.flat());
+    }
+    units.extend(MID.encode_utf16());
+    units.extend_from_slice(&body.flat());
+    units.extend(TAIL.encode_utf16());
+    interp.source_units = interp.source_units.saturating_add(units.len());
+    let remaining = interp.options.max_source_units.saturating_sub(interp.source_units.saturating_sub(units.len()));
+    let options = crate::Options { strict: false, max_source_units: remaining, ..interp.options.clone() };
+    let program = match crate::parse_utf16(&units, &options) {
+        Ok(p) => p,
+        Err(e) => return Err(interp.throw(ErrorType::Syntax, &e.message)),
+    };
+    let source = Rc::new(Source { lines: program.lines.clone(), text: units.into() });
+    let code = match compile_constructed_function(&program, &source) {
+        Ok(Some(code)) => code,
+        Ok(None) => return Err(interp.throw(ErrorType::Syntax, "the parameters or body do not form one function")),
+        Err(CompileFail::Syntax(e)) => return Err(interp.throw(ErrorType::Syntax, &e.message)),
+        Err(CompileFail::Internal(m)) => return Err(Abrupt::Internal(m)),
+    };
+    interp.charge_code(&code, 0)?;
+    let env = interp.global_env;
+    interp.make_closure(code, env).map(Value::Object)
+}
+
+/// `Function.prototype.toString` (section 15.3.4.2): a function's source text, or a stand-in
+/// for a built-in.
+fn function_to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    let func = this.as_object().and_then(|o| interp.heap.object(o)).and_then(|o| match &o.class {
+        Class::Function(f) => Some(f.clone()),
+        _ => None,
+    });
+    let text = match func {
+        Some(Func::Closure { code, .. }) => {
+            let (start, end) = (code.span.0 as usize, code.span.1 as usize);
+            let units = code.source.text.get(start..end).unwrap_or_default();
+            let bytes = string_bytes(units.len());
+            interp.reserve_heap(bytes)?;
+            interp.heap.bytes = interp.heap.bytes.saturating_add(bytes);
+            return Ok(Value::String(Str::from_units(units.to_vec())));
+        }
+        Some(Func::Native { name, .. }) => format!("function {name}() {{ [native code] }}"),
+        Some(Func::Host { name, .. }) => format!("function {name}() {{ [native code] }}"),
+        None => return Err(interp.type_error("Function.prototype.toString was called on a value that is not a function")),
+    };
+    Ok(Value::str(&text))
+}
+
+/// The global `eval` called indirectly (section 15.1.2.1.1): global code in the global
+/// environment.
+fn eval(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    let x = arg(args, 0);
+    let Value::String(s) = &x else { return Ok(x) };
+    interp.check_source_units(s.len()).map_err(|e| interp.compile_error_to_abrupt(e))?;
+    let units = s.flat();
+    let code = interp.compile_source(&units, false, CodeKind::Eval).map_err(|e| interp.compile_error_to_abrupt(e))?;
+    interp.run_global(code, true)
+}
+
+// ---- errors ----
+
+fn make_error(interp: &mut Interp, t: ErrorType, args: &[Value]) -> JsResult<Value> {
+    let message = arg(args, 0);
+    let text = if matches!(message, Value::Undefined) { None } else { Some(interp.to_str(&message)?) };
+    let o = interp.error_object(t, "");
+    if let Some(text) = text {
+        interp.define(o, key("message"), Prop::Data { value: Value::String(text), flags: HIDDEN })?;
+    }
+    Ok(Value::Object(o))
+}
+
+fn error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Error, args)
+}
+
+fn eval_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Eval, args)
+}
+
+fn range_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Range, args)
+}
+
+fn reference_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Reference, args)
+}
+
+fn syntax_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Syntax, args)
+}
+
+fn type_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Type, args)
+}
+
+fn uri_error_ctor(interp: &mut Interp, _: Value, args: &[Value], _: bool) -> JsResult<Value> {
+    make_error(interp, ErrorType::Uri, args)
+}
+
+/// `Error.prototype.toString` (section 15.11.4.4).
+fn error_to_string(interp: &mut Interp, this: Value, _: &[Value], _: bool) -> JsResult<Value> {
+    let Value::Object(o) = this else { return Err(interp.type_error("Error.prototype.toString was called on a value that is not an object")) };
+    let name = interp.get_from(o, &key("name"), &this)?;
+    let name = if matches!(name, Value::Undefined) { Str::from("Error") } else { interp.to_str(&name)? };
+    let message = interp.get_from(o, &key("message"), &this)?;
+    let message = if matches!(message, Value::Undefined) { Str::from("") } else { interp.to_str(&message)? };
+    if name.len() == 0 {
+        return Ok(Value::String(message));
+    }
+    if message.len() == 0 {
+        return Ok(Value::String(name));
+    }
+    let sep = Str::from(": ");
+    let head = interp.concat(&name, &sep)?;
+    interp.concat(&head, &message).map(Value::String)
+}
diff --git a/crates/js/src/bytecode.rs b/crates/js/src/bytecode.rs
new file mode 100644
index 000000000..b23d9a525
--- /dev/null
+++ b/crates/js/src/bytecode.rs
@@ -0,0 +1,362 @@
+//! Bytecode: the instructions a function, a script or eval code compiles to, and the verifier
+//! that checks them before they run.
+//!
+//! The interpreter is a stack machine. Each instruction takes its operands from the top of the
+//! frame's operand stack and pushes its result there; jumps name an instruction index. The
+//! verifier walks every path through the code and checks that each jump target, exception handler
+//! and `finally` dispatch target is an instruction, that each constant, name and function index is
+//! in its table, that the stack never goes below the frame's base, that every path reaching an
+//! instruction arrives with the same stack depth, and that no path runs past the last
+//! instruction. Code that fails is reported as an internal error and never runs.
+
+use std::rc::Rc;
+
+use crate::LineTable;
+use crate::ast::BinaryOp;
+use crate::heap::Key;
+use crate::value::Str;
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum Op {
+    Undefined,
+    Null,
+    True,
+    False,
+    /// Pushes `numbers[i]`.
+    Number(u32),
+    /// Pushes `strings[i]`.
+    String(u32),
+    This,
+    Pop,
+    /// Removes the `n` values under the top one.
+    PopUnder(u32),
+    Dup,
+    /// `a b` → `a b a b`.
+    Dup2,
+    Swap,
+    /// `a b c` → `b c a`.
+    Rot3,
+    /// Pushes the value of the variable `names[i]`.
+    GetVar(u32),
+    /// Pushes the value of the variable and the `this` a call to it gets.
+    GetVarThis(u32),
+    /// `value` → `value`, assigned to the variable.
+    SetVar(u32),
+    /// Pushes the base of the reference to the variable `names[i]`, resolved before the
+    /// right-hand side of an assignment runs.
+    RefVar(u32),
+    /// `base` → `value`: the variable's value read through the resolved base.
+    GetRef(u32),
+    /// `base value` → `value`, assigned to the variable through the resolved base.
+    PutRef(u32),
+    TypeofVar(u32),
+    DeleteVar(u32),
+    IncVar {
+        name: u32,
+        prefix: bool,
+        dec: bool,
+    },
+    /// `object` → `object.name`.
+    GetMember(u32),
+    /// `object` → `object.name object`.
+    GetMemberThis(u32),
+    /// `object value` → `value`.
+    SetMember(u32),
+    DeleteMember(u32),
+    IncMember {
+        name: u32,
+        prefix: bool,
+        dec: bool,
+    },
+    /// `object key` → `object name`: checks that the object can have properties and turns the key
+    /// into a property name, before the right-hand side of an assignment runs.
+    ToKey,
+    /// `object` → `object`: throws a `TypeError` when it is `undefined` or `null`, before the
+    /// right-hand side of an assignment to one of its properties runs.
+    CheckObject,
+    /// `object key` → `object[key]`.
+    GetIndex,
+    /// `object key` → `object[key] object`.
+    GetIndexThis,
+    /// `object key value` → `value`.
+    SetIndex,
+    DeleteIndex,
+    IncIndex {
+        prefix: bool,
+        dec: bool,
+    },
+    /// `function this arg…` → result.
+    Call(u32),
+    /// Like `Call`, but a direct eval when the function is the global `eval`.
+    CallEval(u32),
+    /// `function arg…` → the new object.
+    New(u32),
+    Binary(BinaryOp),
+    Neg,
+    Plus,
+    BitNot,
+    Not,
+    Typeof,
+    ToNumber,
+    Jump(u32),
+    /// Pops the top value and jumps when it is falsy.
+    JumpIfFalse(u32),
+    JumpIfTrue(u32),
+    /// Jumps, keeping the top value, when it is falsy; otherwise pops it.
+    JumpIfFalseKeep(u32),
+    JumpIfTrueKeep(u32),
+    Return,
+    /// Returns the value of the last expression statement (script and eval code).
+    ReturnCompletion,
+    Throw,
+    /// Throws a `ReferenceError` with the message `strings[i]` (an assignment to something that
+    /// cannot be assigned to).
+    ThrowReferenceError(u32),
+    /// Ends a `finally` block: `value kind` on the stack say how it was entered. Kind 0 (normal)
+    /// pops both and goes on, kind 1 throws the value, and kind `2 + k` jumps to entry `k` of
+    /// `finally_tables[i]` with the value left on the stack.
+    EndFinally(u32),
+    NewObject,
+    NewArray,
+    /// `array value` → `array`, the value appended.
+    ArrayPush,
+    /// `array` → `array`, one longer.
+    ArrayHole,
+    /// `object value` → `object`.
+    InitProp(u32),
+    /// `object function` → `object`.
+    InitGetter(u32),
+    InitSetter(u32),
+    /// Pushes a new function made from `functions[i]` and the current environment.
+    Closure(u32),
+    /// Pushes a new regular expression object for `regexps[i]`.
+    RegExp(u32),
+    /// `object` → nothing: enters a `with` statement's environment.
+    PushWith,
+    /// `exception` → nothing: enters a catch clause's environment, binding `names[i]`.
+    PushCatch(u32),
+    PopEnv,
+    /// `object` → `iterator`.
+    ForInStart,
+    /// `iterator` → `iterator name`, or jumps with `iterator` when the names are used up.
+    ForInNext(u32),
+    /// Pops the value of an expression statement into the completion value.
+    SetCompletion,
+    /// Pushes the completion value, which a `finally` block in script and eval code keeps and
+    /// sets back with `SetCompletion` when it ends normally.
+    GetCompletion,
+}
+
+/// What code is: a function body, a script, or eval code.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum CodeKind {
+    Function,
+    Global,
+    Eval,
+}
+
+/// A range of instructions an exception thrown in jumps out of: to `target`, with the operand
+/// stack cut back to `depth` values and the environments to `env_depth`, and the exception pushed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) struct Handler {
+    pub(crate) start: u32,
+    pub(crate) end: u32,
+    pub(crate) target: u32,
+    pub(crate) depth: u32,
+    pub(crate) env_depth: u32,
+}
+
+/// The source a piece of code came from, for error positions and `Function.prototype.toString`.
+#[derive(Debug)]
+pub(crate) struct Source {
+    pub(crate) lines: LineTable,
+    pub(crate) text: Rc<[u16]>,
+}
+
+#[derive(Debug)]
+pub(crate) struct Code {
+    pub(crate) ops: Vec<Op>,
+    /// The source offset each instruction comes from.
+    pub(crate) positions: Vec<u32>,
+    pub(crate) numbers: Vec<f64>,
+    pub(crate) strings: Vec<Str>,
+    pub(crate) names: Vec<Key>,
+    pub(crate) functions: Vec<Rc<Code>>,
+    pub(crate) regexps: Vec<(Str, Str)>,
+    pub(crate) handlers: Vec<Handler>,
+    pub(crate) finally_tables: Vec<Vec<u32>>,
+    /// The most values the code keeps on the operand stack, set by the verifier.
+    pub(crate) max_stack: u32,
+    pub(crate) strict: bool,
+    /// A function expression's own name, bound inside it.
+    pub(crate) self_name: Option<Key>,
+    pub(crate) params: Vec<Key>,
+    pub(crate) vars: Vec<Key>,
+    /// Function declarations to instantiate on entry: their names and indices in `functions`.
+    pub(crate) fun_decls: Vec<(Key, u32)>,
+    /// The body refers to `arguments` or calls `eval`.
+    pub(crate) uses_arguments: bool,
+    pub(crate) source: Rc<Source>,
+    /// Where the function's text starts and ends in the source.
+    pub(crate) span: (u32, u32),
+}
+
+impl Code {
+    /// The innermost handler around instruction `pc`.
+    pub(crate) fn handler(&self, pc: usize) -> Option<Handler> {
+        self.handlers.iter().copied().find(|h| (h.start as usize) <= pc && pc < h.end as usize)
+    }
+
+    /// The line and column of instruction `pc`.
+    pub(crate) fn line_column(&self, pc: usize) -> (u32, u32) {
+        let offset = self.positions.get(pc).copied().unwrap_or(self.span.0);
+        self.source.lines.line_column(offset)
+    }
+}
+
+/// What an instruction does to the stack on each way out of it.
+struct Effect {
+    pops: u32,
+    /// Values pushed when it goes on to the next instruction; `None` when it never does.
+    next: Option<u32>,
+    /// Instruction indices it may jump to, each with the values it pushes on that path.
+    jumps: Vec<(u32, u32)>,
+}
+
+/// The values an instruction pops, and pushes when it goes on to the next instruction (0 for one
+/// that never does), for the compiler's count of the stack depth.
+pub(crate) fn fallthrough_effect(op: Op) -> (u32, u32) {
+    match op {
+        Op::EndFinally(_) => (2, 0),
+        _ => effect(op, &[]).map_or((0, 0), |fx| (fx.pops, fx.next.unwrap_or(0))),
+    }
+}
+
+fn effect(op: Op, finally_tables: &[Vec<u32>]) -> Result<Effect, String> {
+    let e = |pops, pushes| Effect { pops, next: Some(pushes), jumps: Vec::new() };
+    let end = |pops| Effect { pops, next: None, jumps: Vec::new() };
+    Ok(match op {
+        Op::Undefined | Op::Null | Op::True | Op::False | Op::Number(_) | Op::String(_) | Op::This => e(0, 1),
+        Op::GetVar(_) | Op::TypeofVar(_) | Op::DeleteVar(_) | Op::IncVar { .. } | Op::RefVar(_) => e(0, 1),
+        Op::GetRef(_) => e(1, 1),
+        Op::PutRef(_) => e(2, 1),
+        Op::NewObject | Op::NewArray | Op::Closure(_) | Op::RegExp(_) | Op::GetCompletion => e(0, 1),
+        Op::Pop | Op::PushWith | Op::PushCatch(_) | Op::SetCompletion => e(1, 0),
+        Op::PopUnder(n) => e(n.checked_add(1).ok_or("operand too large")?, 1),
+        Op::Dup => e(1, 2),
+        Op::Dup2 => e(2, 4),
+        Op::Swap | Op::ToKey => e(2, 2),
+        Op::Rot3 => e(3, 3),
+        Op::GetVarThis(_) => e(0, 2),
+        Op::SetVar(_) | Op::GetMember(_) | Op::DeleteMember(_) | Op::IncMember { .. } => e(1, 1),
+        Op::Neg | Op::Plus | Op::BitNot | Op::Not | Op::Typeof | Op::ToNumber | Op::ArrayHole | Op::ForInStart | Op::CheckObject => e(1, 1),
+        Op::GetMemberThis(_) => e(1, 2),
+        Op::SetMember(_) | Op::GetIndex | Op::DeleteIndex | Op::IncIndex { .. } | Op::Binary(_) => e(2, 1),
+        Op::ArrayPush | Op::InitProp(_) | Op::InitGetter(_) | Op::InitSetter(_) => e(2, 1),
+        Op::GetIndexThis => e(2, 2),
+        Op::SetIndex => e(3, 1),
+        Op::Call(n) | Op::CallEval(n) => e(n.checked_add(2).ok_or("operand too large")?, 1),
+        Op::New(n) => e(n.checked_add(1).ok_or("operand too large")?, 1),
+        Op::PopEnv => e(0, 0),
+        Op::Jump(t) => Effect { pops: 0, next: None, jumps: vec![(t, 0)] },
+        Op::JumpIfFalse(t) | Op::JumpIfTrue(t) => Effect { pops: 1, next: Some(0), jumps: vec![(t, 0)] },
+        Op::JumpIfFalseKeep(t) | Op::JumpIfTrueKeep(t) => Effect { pops: 1, next: Some(0), jumps: vec![(t, 1)] },
+        Op::Return | Op::Throw => end(1),
+        Op::ReturnCompletion | Op::ThrowReferenceError(_) => end(0),
+        Op::EndFinally(t) => {
+            let table = finally_tables.get(t as usize).ok_or_else(|| format!("finally table {t} out of range"))?;
+            Effect { pops: 2, next: Some(0), jumps: table.iter().map(|&target| (target, 1)).collect() }
+        }
+        Op::ForInNext(t) => Effect { pops: 1, next: Some(2), jumps: vec![(t, 1)] },
+    })
+}
+
+/// Checks the constant, name, function and regular expression indices an instruction uses.
+fn check_indices(op: Op, code: &Code) -> Result<(), String> {
+    let check = |i: u32, len: usize, what: &str| if (i as usize) < len { Ok(()) } else { Err(format!("{what} {i} out of range")) };
+    match op {
+        Op::Number(i) => check(i, code.numbers.len(), "number"),
+        Op::String(i) | Op::ThrowReferenceError(i) => check(i, code.strings.len(), "string"),
+        Op::GetVar(i)
+        | Op::GetVarThis(i)
+        | Op::SetVar(i)
+        | Op::RefVar(i)
+        | Op::GetRef(i)
+        | Op::PutRef(i)
+        | Op::TypeofVar(i)
+        | Op::DeleteVar(i)
+        | Op::IncVar { name: i, .. }
+        | Op::GetMember(i)
+        | Op::GetMemberThis(i)
+        | Op::SetMember(i)
+        | Op::DeleteMember(i)
+        | Op::IncMember { name: i, .. }
+        | Op::InitProp(i)
+        | Op::InitGetter(i)
+        | Op::InitSetter(i)
+        | Op::PushCatch(i) => check(i, code.names.len(), "name"),
+        Op::Closure(i) => check(i, code.functions.len(), "function"),
+        Op::RegExp(i) => check(i, code.regexps.len(), "regular expression"),
+        _ => Ok(()),
+    }
+}
+
+/// Verifies `code` (not the functions inside it, which are verified when they are compiled) and
+/// returns the most values it keeps on the stack.
+pub(crate) fn verify(code: &Code) -> Result<u32, String> {
+    let len = code.ops.len();
+    if len == 0 {
+        return Err("no instructions".into());
+    }
+    if code.positions.len() != len {
+        return Err("the position table does not match the instructions".into());
+    }
+    for (name, _) in &code.fun_decls {
+        if name.is_empty() {
+            return Err("a function declaration without a name".into());
+        }
+    }
+    if code.fun_decls.iter().any(|(_, i)| *i as usize >= code.functions.len()) {
+        return Err("function declaration index out of range".into());
+    }
+    let mut depth: Vec<Option<u32>> = vec![None; len];
+    let mut work: Vec<(u32, u32)> = vec![(0, 0)];
+    for h in &code.handlers {
+        if h.start > h.end || h.end as usize > len {
+            return Err(format!("handler range {}..{} out of range", h.start, h.end));
+        }
+        work.push((h.target, h.depth.checked_add(1).ok_or("handler depth too large")?));
+    }
+    let mut max = 0;
+    while let Some((pc, d)) = work.pop() {
+        let slot = depth.get_mut(pc as usize).ok_or_else(|| format!("jump to {pc}, past the end"))?;
+        match *slot {
+            Some(seen) if seen == d => continue,
+            Some(seen) => return Err(format!("instruction {pc} reached with stack depths {seen} and {d}")),
+            None => *slot = Some(d),
+        }
+        max = max.max(d);
+        let op = code.ops.get(pc as usize).copied().ok_or("instruction out of range")?;
+        check_indices(op, code)?;
+        let fx = effect(op, &code.finally_tables)?;
+        let base = d.checked_sub(fx.pops).ok_or_else(|| format!("instruction {pc} ({op:?}) pops below the stack"))?;
+        if let Some(pushes) = fx.next {
+            if pc as usize + 1 >= len {
+                return Err("the code runs past its last instruction".into());
+            }
+            work.push((pc + 1, base + pushes));
+        }
+        for (target, pushes) in fx.jumps {
+            work.push((target, base + pushes));
+        }
+    }
+    for h in &code.handlers {
+        if let Some(Some(d)) = depth.get(h.start as usize)
+            && *d < h.depth
+            && h.start < h.end
+        {
+            return Err(format!("handler at {} expects {} values but its range starts with {d}", h.target, h.depth));
+        }
+    }
+    Ok(max)
+}
diff --git a/crates/js/src/chars.rs b/crates/js/src/chars.rs
index 75c0b92aa..eb61fe763 100644
--- a/crates/js/src/chars.rs
+++ b/crates/js/src/chars.rs
@@ -58,6 +58,39 @@ pub fn hex_value(c: u32) -> Option<u32> {
     }
 }
 
+/// The value of the digit values `digits` in `radix` (8 or 16), rounded once to the nearest number
+/// with ties to even (sections 7.8.3 and 9.3.1), or `None` when there are no digits. Digits are
+/// kept exactly in a `u128` while they fit; past that, each later digit counts only for its
+/// position and for whether any of the dropped bits is set.
+pub fn radix_value(digits: impl IntoIterator<Item = u32>, radix: u32) -> Option<f64> {
+    let bits = radix.trailing_zeros();
+    let mut kept: u128 = 0;
+    let mut dropped_bits: u32 = 0;
+    let mut sticky = false;
+    let mut any = false;
+    for d in digits {
+        any = true;
+        if kept.leading_zeros() >= bits {
+            kept = kept << bits | u128::from(d);
+        } else {
+            dropped_bits = dropped_bits.saturating_add(bits);
+            sticky |= d != 0;
+        }
+    }
+    if !any {
+        return None;
+    }
+    // `kept` holds at least 125 bits once a digit is dropped, so its lowest bit lies below the
+    // rounding bit and stands in for every dropped bit.
+    let mut value = (kept | u128::from(sticky)) as f64;
+    while dropped_bits > 0 && value.is_finite() {
+        let step = dropped_bits.min(64);
+        value *= (1_u128 << step) as f64;
+        dropped_bits -= step;
+    }
+    Some(value)
+}
+
 pub fn is_decimal_digit(c: u32) -> bool {
     (0x30..=0x39).contains(&c)
 }
diff --git a/crates/js/src/compiler.rs b/crates/js/src/compiler.rs
new file mode 100644
index 000000000..ae470be44
--- /dev/null
+++ b/crates/js/src/compiler.rs
@@ -0,0 +1,1260 @@
+//! The compiler: a syntax tree to bytecode, one [`Code`] per function, script or eval code.
+//!
+//! Variables are looked up by name at run time through the environment chain, as ECMA-262 5.1
+//! section 10 describes, so `with` and direct `eval` need no special analysis. Declarations are
+//! hoisted: each code lists its `var` names and function declarations, and the interpreter binds
+//! them when the code is entered (section 10.5).
+//!
+//! The compiler counts the operand stack depth as it emits, so `break`, `continue` and `return`
+//! know how many values to drop. A jump out of a `try` with a `finally` block goes through the
+//! block: it pushes a completion (a value and a kind number) and jumps to the block, whose
+//! `EndFinally` instruction goes on with the jump afterwards. Long left-nested runs of binary
+//! operators and member accesses, right-nested assignment chains, prefix operators, `else if`
+//! chains and labels are compiled with loops; every other kind of nesting is counted, and code
+//! nested deeper than [`MAX_DEPTH`] gives a `SyntaxError` instead of exhausting the stack.
+
+use std::collections::{HashMap, HashSet};
+use std::rc::Rc;
+
+use crate::ast::{
+    AssignOp, Ast, BinaryOp, Expr, ExprId, ForInTarget, ForInit, FunctionId, FunctionKind, LogicalOp, PropertyValue, Stmt, StmtId, UnaryOp, UpdateOp,
+    VarDecl,
+};
+use crate::bytecode::{Code, CodeKind, Handler, Op, Source, fallthrough_effect, verify};
+use crate::error::{SyntaxError, TOO_DEEP};
+use crate::heap::Key;
+use crate::value::Str;
+
+/// How deeply the compiler may recurse: past the parser's default nesting limit, and shallow
+/// enough for a 1 MiB stack.
+pub(crate) const MAX_DEPTH: u32 = 600;
+
+/// Why code could not be compiled.
+#[derive(Debug)]
+pub(crate) enum CompileFail {
+    Syntax(SyntaxError),
+    /// The compiler made code the verifier rejects.
+    Internal(String),
+}
+
+type CResult<T> = Result<T, CompileFail>;
+
+fn internal<T>(message: impl Into<String>) -> CResult<T> {
+    Err(CompileFail::Internal(message.into()))
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct Label(usize);
+
+/// Where `break`, `continue` and `return` go.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum Exit {
+    /// To the end of the jump context at this index.
+    Break(usize),
+    /// To the continue point of the loop at this index.
+    Continue(usize),
+    Return,
+}
+
+enum Ctx {
+    /// A loop, a `switch` or a labeled statement.
+    Jump { labels: Vec<String>, is_loop: bool, plain_break: bool, brk: Label, cont: Option<Label>, depth: u32, env_depth: u32 },
+    /// The protected part (and catch clause) of a `try` with a `finally` block.
+    Finally { try_depth: u32, env_depth: u32, entry: Label, exits: Vec<Exit> },
+}
+
+struct FnCompiler<'a> {
+    ast: &'a Ast,
+    source: &'a Rc<Source>,
+    kind: CodeKind,
+    strict: bool,
+    ops: Vec<Op>,
+    positions: Vec<u32>,
+    pos: u32,
+    numbers: Vec<f64>,
+    number_index: HashMap<u64, u32>,
+    strings: Vec<Str>,
+    string_index: HashMap<Vec<u16>, u32>,
+    names: Vec<Key>,
+    name_index: HashMap<Key, u32>,
+    functions: Vec<Rc<Code>>,
+    regexps: Vec<(Str, Str)>,
+    handlers: Vec<(u32, u32, Label, u32, u32)>,
+    finally_tables: Vec<Vec<Label>>,
+    labels: Vec<Option<u32>>,
+    patches: Vec<(usize, Label)>,
+    depth: u32,
+    env_depth: u32,
+    contexts: Vec<Ctx>,
+    uses_arguments: bool,
+    recursion: u32,
+}
+
+/// The `var` names and function declarations a body hoists.
+#[derive(Default)]
+struct Hoisted {
+    vars: Vec<Key>,
+    fun_decls: Vec<(Key, u32)>,
+}
+
+fn key_of(name: &str) -> Key {
+    crate::heap::key(name)
+}
+
+impl<'a> FnCompiler<'a> {
+    fn new(ast: &'a Ast, source: &'a Rc<Source>, kind: CodeKind, strict: bool, recursion: u32) -> Self {
+        Self {
+            ast,
+            source,
+            kind,
+            strict,
+            ops: Vec::new(),
+            positions: Vec::new(),
+            pos: 0,
+            numbers: Vec::new(),
+            number_index: HashMap::new(),
+            strings: Vec::new(),
+            string_index: HashMap::new(),
+            names: Vec::new(),
+            name_index: HashMap::new(),
+            functions: Vec::new(),
+            regexps: Vec::new(),
+            handlers: Vec::new(),
+            finally_tables: Vec::new(),
+            labels: Vec::new(),
+            patches: Vec::new(),
+            depth: 0,
+            env_depth: 0,
+            contexts: Vec::new(),
+            uses_arguments: false,
+            recursion,
+        }
+    }
+
+    // ---- emitting ----
+
+    fn emit(&mut self, op: Op) {
+        let (pops, pushes) = fallthrough_effect(op);
+        self.depth = self.depth.saturating_sub(pops) + pushes;
+        self.ops.push(op);
+        self.positions.push(self.pos);
+    }
+
+    fn new_label(&mut self) -> Label {
+        self.labels.push(None);
+        Label(self.labels.len() - 1)
+    }
+
+    fn bind(&mut self, label: Label) {
+        if let Some(slot) = self.labels.get_mut(label.0) {
+            *slot = Some(u32::try_from(self.ops.len()).unwrap_or(u32::MAX));
+        }
+    }
+
+    /// Emits a jump instruction (`make` builds it from its target) to `label`, patched when the
+    /// code is finished.
+    fn jump(&mut self, make: fn(u32) -> Op, label: Label) {
+        self.patches.push((self.ops.len(), label));
+        self.emit(make(0));
+    }
+
+    fn at(&mut self, offset: u32) {
+        self.pos = offset;
+    }
+
+    fn number(&mut self, n: f64) -> u32 {
+        if let Some(&i) = self.number_index.get(&n.to_bits()) {
+            return i;
+        }
+        let i = u32::try_from(self.numbers.len()).unwrap_or(u32::MAX);
+        self.numbers.push(n);
+        self.number_index.insert(n.to_bits(), i);
+        i
+    }
+
+    fn string(&mut self, units: &[u16]) -> u32 {
+        if let Some(&i) = self.string_index.get(units) {
+            return i;
+        }
+        let i = u32::try_from(self.strings.len()).unwrap_or(u32::MAX);
+        self.strings.push(Str::from_units(units.to_vec()));
+        self.string_index.insert(units.to_vec(), i);
+        i
+    }
+
+    fn name_key(&mut self, key: Key) -> u32 {
+        if let Some(&i) = self.name_index.get(&key) {
+            return i;
+        }
+        let i = u32::try_from(self.names.len()).unwrap_or(u32::MAX);
+        self.names.push(key.clone());
+        self.name_index.insert(key, i);
+        i
+    }
+
+    /// The index of a variable name, noting a use of `arguments`.
+    fn var_name(&mut self, name: &str) -> u32 {
+        if name == "arguments" {
+            self.uses_arguments = true;
+        }
+        self.name_key(key_of(name))
+    }
+
+    fn push_number(&mut self, n: f64) {
+        let i = self.number(n);
+        self.emit(Op::Number(i));
+    }
+
+    fn enter(&mut self) -> CResult<()> {
+        self.recursion += 1;
+        if self.recursion > MAX_DEPTH {
+            let (line, column) = self.source.lines.line_column(self.pos);
+            return Err(CompileFail::Syntax(SyntaxError { message: TOO_DEEP.into(), line, column, offset: self.pos }));
+        }
+        Ok(())
+    }
+
+    fn leave(&mut self) {
+        self.recursion -= 1;
+    }
+
+    // ---- declarations ----
+
+    /// Collects the `var` names and function declarations of a body, outside nested functions,
+    /// in source order, and compiles the functions.
+    fn hoist(&mut self, body: &[StmtId]) -> CResult<Hoisted> {
+        let mut out = Hoisted::default();
+        let mut seen = HashSet::new();
+        let mut work: Vec<StmtId> = body.iter().rev().copied().collect();
+        let mut add_var = |out: &mut Hoisted, d: &VarDecl| {
+            let k = key_of(&d.name.name);
+            if seen.insert(k.clone()) {
+                out.vars.push(k);
+            }
+        };
+        while let Some(id) = work.pop() {
+            let Some(stmt) = self.ast.stmt(id) else { return internal("statement out of range") };
+            match stmt {
+                Stmt::Var(decls) => decls.iter().for_each(|d| add_var(&mut out, d)),
+                Stmt::FunctionDecl(fid) => {
+                    let Some(name) = self.ast.function(*fid).and_then(|f| f.name.as_ref()) else {
+                        return internal("function declaration without a name");
+                    };
+                    let k = key_of(&name.name);
+                    let i = self.function(*fid)?;
+                    out.fun_decls.push((k, i));
+                }
+                Stmt::Block(list) => work.extend(list.iter().rev()),
+                Stmt::If { consequent, alternate, .. } => {
+                    work.extend(alternate.iter());
+                    work.push(*consequent);
+                }
+                Stmt::DoWhile { body, .. } | Stmt::While { body, .. } | Stmt::With { body, .. } | Stmt::Labeled { body, .. } => work.push(*body),
+                Stmt::For { init, body, .. } => {
+                    work.push(*body);
+                    if let Some(ForInit::Var(decls)) = init {
+                        decls.iter().for_each(|d| add_var(&mut out, d));
+                    }
+                }
+                Stmt::ForIn { target, body, .. } => {
+                    work.push(*body);
+                    if let ForInTarget::Var(d) = target {
+                        add_var(&mut out, d);
+                    }
+                }
+                Stmt::Switch { cases, .. } => {
+                    for case in cases.iter().rev() {
+                        work.extend(case.body.iter().rev());
+                    }
+                }
+                Stmt::Try { block, handler, finalizer } => {
+                    if let Some(f) = finalizer {
+                        work.extend(f.iter().rev());
+                    }
+                    if let Some(h) = handler {
+                        work.extend(h.body.iter().rev());
+                    }
+                    work.extend(block.iter().rev());
+                }
+                Stmt::Expr(_) | Stmt::Empty | Stmt::Continue(_) | Stmt::Break(_) | Stmt::Return(_) | Stmt::Throw(_) | Stmt::Debugger => {}
+            }
+        }
+        Ok(out)
+    }
+
+    /// Compiles a nested function and returns its index in the function table.
+    fn function(&mut self, fid: FunctionId) -> CResult<u32> {
+        let code = compile_function(self.ast, fid, self.source, self.recursion, true)?;
+        self.functions.push(code);
+        Ok(u32::try_from(self.functions.len() - 1).unwrap_or(u32::MAX))
+    }
+
+    // ---- statements ----
+
+    fn stmts(&mut self, list: &[StmtId]) -> CResult<()> {
+        for &s in list {
+            self.stmt(s)?;
+        }
+        Ok(())
+    }
+
+    fn stmt(&mut self, id: StmtId) -> CResult<()> {
+        self.enter()?;
+        let saved = self.depth;
+        let r = self.stmt_inner(id);
+        self.depth = saved;
+        self.leave();
+        r
+    }
+
+    fn stmt_inner(&mut self, id: StmtId) -> CResult<()> {
+        let Some(stmt) = self.ast.stmt(id) else { return internal("statement out of range") };
+        self.at(self.ast.stmt_span(id).start);
+        match stmt {
+            Stmt::Var(decls) => self.var_decls(decls),
+            Stmt::FunctionDecl(_) | Stmt::Empty | Stmt::Debugger => Ok(()),
+            Stmt::Expr(e) => {
+                self.expr(*e)?;
+                self.emit(if self.kind == CodeKind::Function { Op::Pop } else { Op::SetCompletion });
+                Ok(())
+            }
+            Stmt::Block(list) => self.stmts(list),
+            Stmt::If { .. } => self.if_chain(id),
+            Stmt::DoWhile { .. } | Stmt::While { .. } | Stmt::For { .. } | Stmt::ForIn { .. } => self.loop_stmt(id, Vec::new()),
+            Stmt::Continue(label) => self.jump_stmt(label.as_ref().map(|l| l.name.as_str()), true),
+            Stmt::Break(label) => self.jump_stmt(label.as_ref().map(|l| l.name.as_str()), false),
+            Stmt::Return(value) => {
+                match value {
+                    Some(e) => self.expr(*e)?,
+                    None => self.emit(Op::Undefined),
+                }
+                self.emit_exit(Exit::Return)
+            }
+            Stmt::With { object, body } => {
+                self.expr(*object)?;
+                self.emit(Op::PushWith);
+                self.env_depth += 1;
+                self.stmt(*body)?;
+                self.emit(Op::PopEnv);
+                self.env_depth -= 1;
+                Ok(())
+            }
+            Stmt::Switch { .. } => self.switch_stmt(id, Vec::new()),
+            Stmt::Labeled { .. } => self.labeled(id),
+            Stmt::Throw(e) => {
+                self.expr(*e)?;
+                self.at(self.ast.stmt_span(id).start);
+                self.emit(Op::Throw);
+                Ok(())
+            }
+            Stmt::Try { block, handler, finalizer } => self.try_stmt(block, handler.as_ref(), finalizer.as_deref()),
+        }
+    }
+
+    fn var_decls(&mut self, decls: &[VarDecl]) -> CResult<()> {
+        for d in decls {
+            if let Some(init) = d.init {
+                self.expr(init)?;
+                self.at(d.name.span.start);
+                let n = self.var_name(&d.name.name);
+                self.emit(Op::SetVar(n));
+                self.emit(Op::Pop);
+            }
+        }
+        Ok(())
+    }
+
+    fn if_chain(&mut self, id: StmtId) -> CResult<()> {
+        let saved = self.depth;
+        let end = self.new_label();
+        let mut cur = id;
+        while let Some(Stmt::If { test, consequent, alternate }) = self.ast.stmt(cur) {
+            self.at(self.ast.stmt_span(cur).start);
+            self.expr(*test)?;
+            let otherwise = self.new_label();
+            self.jump(Op::JumpIfFalse, otherwise);
+            self.stmt(*consequent)?;
+            let Some(alt) = *alternate else {
+                self.bind(otherwise);
+                break;
+            };
+            self.jump(Op::Jump, end);
+            self.bind(otherwise);
+            self.depth = saved;
+            if matches!(self.ast.stmt(alt), Some(Stmt::If { .. })) {
+                cur = alt;
+            } else {
+                self.stmt(alt)?;
+                break;
+            }
+        }
+        self.bind(end);
+        Ok(())
+    }
+
+    fn labeled(&mut self, id: StmtId) -> CResult<()> {
+        let mut labels = Vec::new();
+        let mut cur = id;
+        while let Some(Stmt::Labeled { label, body }) = self.ast.stmt(cur) {
+            labels.push(label.name.clone());
+            cur = *body;
+        }
+        match self.ast.stmt(cur) {
+            Some(Stmt::DoWhile { .. } | Stmt::While { .. } | Stmt::For { .. } | Stmt::ForIn { .. }) => self.loop_stmt(cur, labels),
+            Some(Stmt::Switch { .. }) => self.switch_stmt(cur, labels),
+            _ => {
+                let brk = self.new_label();
+                self.push_jump_ctx(labels, false, false, brk, None);
+                self.stmt(cur)?;
+                self.contexts.pop();
+                self.bind(brk);
+                Ok(())
+            }
+        }
+    }
+
+    fn push_jump_ctx(&mut self, labels: Vec<String>, is_loop: bool, plain_break: bool, brk: Label, cont: Option<Label>) {
+        self.contexts.push(Ctx::Jump { labels, is_loop, plain_break, brk, cont, depth: self.depth, env_depth: self.env_depth });
+    }
+
+    /// Compiles a loop body inside its jump context.
+    fn loop_body(&mut self, body: StmtId, labels: Vec<String>, brk: Label, cont: Label) -> CResult<()> {
+        self.push_jump_ctx(labels, true, true, brk, Some(cont));
+        let r = self.stmt(body);
+        self.contexts.pop();
+        r
+    }
+
+    fn loop_stmt(&mut self, id: StmtId, labels: Vec<String>) -> CResult<()> {
+        let brk = self.new_label();
+        let cont = self.new_label();
+        match self.ast.stmt(id) {
+            Some(Stmt::While { test, body }) => {
+                self.bind(cont);
+                self.expr(*test)?;
+                self.jump(Op::JumpIfFalse, brk);
+                self.loop_body(*body, labels, brk, cont)?;
+                self.jump(Op::Jump, cont);
+            }
+            Some(Stmt::DoWhile { body, test }) => {
+                let top = self.new_label();
+                self.bind(top);
+                self.loop_body(*body, labels, brk, cont)?;
+                self.bind(cont);
+                self.expr(*test)?;
+                self.jump(Op::JumpIfTrue, top);
+            }
+            Some(Stmt::For { init, test, update, body }) => {
+                match init {
+                    Some(ForInit::Var(decls)) => self.var_decls(decls)?,
+                    Some(ForInit::Expr(e)) => {
+                        self.expr(*e)?;
+                        self.emit(Op::Pop);
+                    }
+                    None => {}
+                }
+                let head = self.new_label();
+                self.bind(head);
+                if let Some(t) = test {
+                    self.expr(*t)?;
+                    self.jump(Op::JumpIfFalse, brk);
+                }
+                self.loop_body(*body, labels, brk, cont)?;
+                self.bind(cont);
+                if let Some(u) = update {
+                    self.expr(*u)?;
+                    self.emit(Op::Pop);
+                }
+                self.jump(Op::Jump, head);
+            }
+            Some(Stmt::ForIn { target, object, body }) => return self.for_in(target, *object, *body, labels),
+            _ => return internal("not a loop"),
+        }
+        self.bind(brk);
+        Ok(())
+    }
+
+    fn for_in(&mut self, target: &ForInTarget, object: ExprId, body: StmtId, labels: Vec<String>) -> CResult<()> {
+        if let ForInTarget::Var(d) = target {
+            self.var_decls(std::slice::from_ref(d))?;
+        }
+        self.expr(object)?;
+        self.emit(Op::ForInStart);
+        let iter_depth = self.depth;
+        let head = self.new_label();
+        let brk = self.new_label();
+        self.bind(head);
+        self.jump(Op::ForInNext, brk);
+        match target {
+            ForInTarget::Var(d) => {
+                let n = self.var_name(&d.name.name);
+                self.emit(Op::SetVar(n));
+            }
+            ForInTarget::Expr(e) => self.store_key_to(*e)?,
+        }
+        self.emit(Op::Pop);
+        self.loop_body(body, labels, brk, head)?;
+        self.jump(Op::Jump, head);
+        self.bind(brk);
+        self.depth = iter_depth;
+        self.emit(Op::Pop);
+        Ok(())
+    }
+
+    /// Assigns the name on top of the stack to a `for-in` target expression, leaving it on top.
+    fn store_key_to(&mut self, target: ExprId) -> CResult<()> {
+        let target = self.ast.unparenthesized(target);
+        self.at(self.ast.expr_span(target).start);
+        match self.ast.expr(target) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::SetVar(n));
+            }
+            Some(Expr::Member { object, property }) => {
+                self.expr(*object)?;
+                self.emit(Op::Swap);
+                let n = self.name_key(key_of(&property.name));
+                self.emit(Op::SetMember(n));
+            }
+            Some(Expr::Index { object, index }) => {
+                self.expr(*object)?;
+                self.expr(*index)?;
+                self.emit(Op::ToKey);
+                self.emit(Op::Rot3);
+                self.emit(Op::SetIndex);
+            }
+            _ => {
+                self.expr(target)?;
+                self.emit(Op::Pop);
+                self.throw_invalid_target();
+            }
+        }
+        Ok(())
+    }
+
+    fn throw_invalid_target(&mut self) {
+        let s = self.string(&"invalid assignment target".encode_utf16().collect::<Vec<u16>>());
+        let depth = self.depth;
+        self.emit(Op::ThrowReferenceError(s));
+        self.depth = depth;
+    }
+
+    fn switch_stmt(&mut self, id: StmtId, labels: Vec<String>) -> CResult<()> {
+        let Some(Stmt::Switch { discriminant, cases }) = self.ast.stmt(id) else { return internal("not a switch") };
+        self.expr(*discriminant)?;
+        let d = self.depth;
+        let brk = self.new_label();
+        let case_labels: Vec<Label> = cases.iter().map(|_| self.new_label()).collect();
+        for (case, &label) in cases.iter().zip(&case_labels) {
+            if let Some(test) = case.test {
+                self.emit(Op::Dup);
+                self.expr(test)?;
+                self.at(case.span.start);
+                self.emit(Op::Binary(BinaryOp::StrictEq));
+                self.jump(Op::JumpIfTrue, label);
+            }
+        }
+        match cases.iter().position(|c| c.test.is_none()).and_then(|i| case_labels.get(i)) {
+            Some(&default) => self.jump(Op::Jump, default),
+            None => self.jump(Op::Jump, brk),
+        }
+        self.push_jump_ctx(labels, false, true, brk, None);
+        for (case, &label) in cases.iter().zip(&case_labels) {
+            self.bind(label);
+            self.depth = d;
+            self.stmts(&case.body)?;
+        }
+        self.contexts.pop();
+        self.bind(brk);
+        self.depth = d;
+        self.emit(Op::Pop);
+        Ok(())
+    }
+
+    fn jump_stmt(&mut self, label: Option<&str>, is_continue: bool) -> CResult<()> {
+        let target = self.contexts.iter().enumerate().rev().find_map(|(i, c)| match c {
+            Ctx::Jump { labels, is_loop, plain_break, .. } => {
+                let hit = match label {
+                    Some(l) => labels.iter().any(|x| x == l) && (!is_continue || *is_loop),
+                    None if is_continue => *is_loop,
+                    None => *plain_break,
+                };
+                hit.then_some(i)
+            }
+            Ctx::Finally { .. } => None,
+        });
+        match target {
+            Some(i) => self.emit_exit(if is_continue { Exit::Continue(i) } else { Exit::Break(i) }),
+            None => internal("break or continue without a target"),
+        }
+    }
+
+    /// Emits a jump out to `exit`, dropping the values and environments in between and going
+    /// through each `finally` block on the way.
+    fn emit_exit(&mut self, exit: Exit) -> CResult<()> {
+        let (saved, saved_env) = (self.depth, self.env_depth);
+        let mut i = self.contexts.len();
+        loop {
+            let Some(next) = i.checked_sub(1) else {
+                if exit != Exit::Return {
+                    return internal("jump target not found");
+                }
+                self.emit(Op::Return);
+                break;
+            };
+            i = next;
+            match self.contexts.get(i) {
+                Some(&Ctx::Jump { brk, cont, depth, env_depth, .. }) => {
+                    let label = match exit {
+                        Exit::Break(t) if t == i => Some(brk),
+                        Exit::Continue(t) if t == i => cont,
+                        _ => None,
+                    };
+                    if let Some(label) = label {
+                        self.unwind_to(depth, env_depth)?;
+                        self.jump(Op::Jump, label);
+                        break;
+                    }
+                }
+                Some(&Ctx::Finally { try_depth, env_depth, entry, .. }) => {
+                    self.route_through_finally(i, exit, try_depth, env_depth, entry)?;
+                    break;
+                }
+                None => return internal("context out of range"),
+            }
+        }
+        self.depth = saved;
+        self.env_depth = saved_env;
+        Ok(())
+    }
+
+    fn route_through_finally(&mut self, ctx: usize, exit: Exit, try_depth: u32, env_depth: u32, entry: Label) -> CResult<()> {
+        let Some(Ctx::Finally { exits, .. }) = self.contexts.get_mut(ctx) else { return internal("not a finally context") };
+        let k = match exits.iter().position(|e| *e == exit) {
+            Some(k) => k,
+            None => {
+                exits.push(exit);
+                exits.len() - 1
+            }
+        };
+        if exit == Exit::Return {
+            let Some(under) = self.depth.checked_sub(1 + try_depth) else { return internal("stack below a try block") };
+            if under > 0 {
+                self.emit(Op::PopUnder(under));
+            }
+            self.pop_envs(env_depth)?;
+        } else {
+            self.unwind_to(try_depth, env_depth)?;
+            self.emit(Op::Undefined);
+        }
+        self.push_number((k + 2) as f64);
+        self.jump(Op::Jump, entry);
+        Ok(())
+    }
+
+    fn unwind_to(&mut self, depth: u32, env_depth: u32) -> CResult<()> {
+        if self.depth < depth {
+            return internal("jump to a deeper stack");
+        }
+        while self.depth > depth {
+            self.emit(Op::Pop);
+        }
+        self.pop_envs(env_depth)
+    }
+
+    fn pop_envs(&mut self, env_depth: u32) -> CResult<()> {
+        if self.env_depth < env_depth {
+            return internal("jump into an environment");
+        }
+        for _ in env_depth..self.env_depth {
+            self.ops.push(Op::PopEnv);
+            self.positions.push(self.pos);
+        }
+        Ok(())
+    }
+
+    fn try_stmt(&mut self, block: &[StmtId], handler: Option<&crate::ast::CatchClause>, finalizer: Option<&[StmtId]>) -> CResult<()> {
+        let try_depth = self.depth;
+        let env_depth = self.env_depth;
+        let fin_entry = self.new_label();
+        if finalizer.is_some() {
+            self.contexts.push(Ctx::Finally { try_depth, env_depth, entry: fin_entry, exits: Vec::new() });
+        }
+        let start = self.pc();
+        self.stmts(block)?;
+        if let Some(h) = handler {
+            let after = self.new_label();
+            let catch = self.new_label();
+            self.jump(Op::Jump, after);
+            let end = self.pc();
+            self.handlers.push((start, end, catch, try_depth, env_depth));
+            self.bind(catch);
+            self.depth = try_depth + 1;
+            self.at(h.param.span.start);
+            let n = self.var_name(&h.param.name);
+            self.emit(Op::PushCatch(n));
+            self.env_depth += 1;
+            self.stmts(&h.body)?;
+            self.emit(Op::PopEnv);
+            self.env_depth -= 1;
+            self.bind(after);
+        }
+        let Some(fin) = finalizer else { return Ok(()) };
+        let protected_end = self.pc();
+        let Some(Ctx::Finally { exits, .. }) = self.contexts.pop() else { return internal("finally context missing") };
+        let after = self.new_label();
+        let stub = self.new_label();
+        self.handlers.push((start, protected_end, stub, try_depth, env_depth));
+        self.emit(Op::Undefined);
+        self.push_number(0.0);
+        self.bind(fin_entry);
+        // In script and eval code the finally block keeps the completion value of the try or
+        // catch block when it ends normally (ECMA-262 5.1 section 12.14).
+        let keeps_completion = self.kind != CodeKind::Function;
+        if keeps_completion {
+            self.emit(Op::GetCompletion);
+        }
+        self.stmts(fin)?;
+        if keeps_completion {
+            self.emit(Op::SetCompletion);
+        }
+        let dispatch: Vec<Label> = exits.iter().map(|_| self.new_label()).collect();
+        let table = u32::try_from(self.finally_tables.len()).unwrap_or(u32::MAX);
+        self.finally_tables.push(dispatch.clone());
+        self.emit(Op::EndFinally(table));
+        self.jump(Op::Jump, after);
+        self.bind(stub);
+        self.depth = try_depth + 1;
+        self.push_number(1.0);
+        self.jump(Op::Jump, fin_entry);
+        for (exit, label) in exits.into_iter().zip(dispatch) {
+            self.bind(label);
+            self.depth = try_depth + 1;
+            if exit != Exit::Return {
+                self.emit(Op::Pop);
+            }
+            self.emit_exit(exit)?;
+        }
+        self.bind(after);
+        self.depth = try_depth;
+        Ok(())
+    }
+
+    fn pc(&self) -> u32 {
+        u32::try_from(self.ops.len()).unwrap_or(u32::MAX)
+    }
+
+    // ---- expressions ----
+
+    fn expr(&mut self, id: ExprId) -> CResult<()> {
+        self.enter()?;
+        let r = self.expr_inner(self.ast.unparenthesized(id));
+        self.leave();
+        r
+    }
+
+    fn expr_inner(&mut self, id: ExprId) -> CResult<()> {
+        let Some(e) = self.ast.expr(id) else { return internal("expression out of range") };
+        self.at(self.ast.expr_span(id).start);
+        match e {
+            Expr::This => self.emit(Op::This),
+            Expr::Ident(name) => {
+                let n = self.var_name(name);
+                self.emit(Op::GetVar(n));
+            }
+            Expr::Null => self.emit(Op::Null),
+            Expr::Bool(b) => self.emit(if *b { Op::True } else { Op::False }),
+            Expr::Number(n) => self.push_number(*n),
+            Expr::String(s) => {
+                let i = self.string(s);
+                self.emit(Op::String(i));
+            }
+            Expr::RegExp { pattern, flags } => {
+                self.regexps.push((Str::from_units(pattern.clone()), Str::from(flags.as_str())));
+                let i = u32::try_from(self.regexps.len() - 1).unwrap_or(u32::MAX);
+                self.emit(Op::RegExp(i));
+            }
+            Expr::Array(elements) => {
+                self.emit(Op::NewArray);
+                for el in elements {
+                    match el {
+                        Some(e) => {
+                            self.expr(*e)?;
+                            self.emit(Op::ArrayPush);
+                        }
+                        None => self.emit(Op::ArrayHole),
+                    }
+                }
+            }
+            Expr::Object(props) => self.object_literal(props)?,
+            Expr::Function(fid) => {
+                let i = self.function(*fid)?;
+                self.emit(Op::Closure(i));
+            }
+            Expr::Member { .. } | Expr::Index { .. } | Expr::Call { .. } => self.chain(id)?,
+            Expr::New { callee, args } => {
+                self.expr(*callee)?;
+                self.args(args)?;
+                self.at(self.ast.expr_span(id).start);
+                self.emit(Op::New(len_u32(args.len())));
+            }
+            Expr::Update { op, prefix, target } => self.update(*op, *prefix, *target)?,
+            Expr::Unary { .. } => self.unary(id)?,
+            Expr::Binary { .. } | Expr::Logical { .. } => self.binary_chain(id)?,
+            Expr::Conditional { test, consequent, alternate } => {
+                self.expr(*test)?;
+                let d = self.depth;
+                let otherwise = self.new_label();
+                let end = self.new_label();
+                self.jump(Op::JumpIfFalse, otherwise);
+                self.expr(*consequent)?;
+                self.jump(Op::Jump, end);
+                self.bind(otherwise);
+                self.depth = d.saturating_sub(1);
+                self.expr(*alternate)?;
+                self.bind(end);
+            }
+            Expr::Assign { .. } => self.assign_chain(id)?,
+            Expr::Sequence(list) => {
+                for (i, e) in list.iter().enumerate() {
+                    if i > 0 {
+                        self.emit(Op::Pop);
+                    }
+                    self.expr(*e)?;
+                }
+                if list.is_empty() {
+                    self.emit(Op::Undefined);
+                }
+            }
+            Expr::Paren(inner) => self.expr(*inner)?,
+        }
+        Ok(())
+    }
+
+    fn args(&mut self, args: &[ExprId]) -> CResult<()> {
+        for a in args {
+            self.expr(*a)?;
+        }
+        Ok(())
+    }
+
+    fn object_literal(&mut self, props: &[crate::ast::Property]) -> CResult<()> {
+        self.emit(Op::NewObject);
+        for p in props {
+            let n = self.name_key(p.key.to_utf16().into());
+            match &p.value {
+                PropertyValue::Init(e) => {
+                    self.expr(*e)?;
+                    self.emit(Op::InitProp(n));
+                }
+                PropertyValue::Get(f) => {
+                    let i = self.function(*f)?;
+                    self.emit(Op::Closure(i));
+                    self.emit(Op::InitGetter(n));
+                }
+                PropertyValue::Set(f) => {
+                    let i = self.function(*f)?;
+                    self.emit(Op::Closure(i));
+                    self.emit(Op::InitSetter(n));
+                }
+            }
+        }
+        Ok(())
+    }
+
+    /// A run of member accesses and calls (`a.b[c](d).e`), compiled from the innermost object out
+    /// with a loop.
+    fn chain(&mut self, id: ExprId) -> CResult<()> {
+        let mut suffixes = Vec::new();
+        let mut cur = id;
+        loop {
+            match self.ast.expr(cur) {
+                Some(Expr::Member { object, .. } | Expr::Index { object, .. }) => {
+                    suffixes.push(cur);
+                    cur = self.ast.unparenthesized(*object);
+                }
+                Some(Expr::Call { callee, .. }) => {
+                    suffixes.push(cur);
+                    cur = self.ast.unparenthesized(*callee);
+                }
+                _ => break,
+            }
+        }
+        let is_call = |c: &Self, e: Option<&ExprId>| e.is_some_and(|&e| matches!(c.ast.expr(e), Some(Expr::Call { .. })));
+        let first_is_call = is_call(self, suffixes.last());
+        let mut base_has_this = false;
+        let mut eval_call = false;
+        match self.ast.expr(cur) {
+            Some(Expr::Ident(name)) if first_is_call => {
+                self.at(self.ast.expr_span(cur).start);
+                let n = self.var_name(name);
+                self.emit(Op::GetVarThis(n));
+                base_has_this = true;
+                eval_call = name == "eval";
+            }
+            _ => self.expr(cur)?,
+        }
+        let count = suffixes.len();
+        for j in (0..count).rev() {
+            let Some(&s) = suffixes.get(j) else { return internal("suffix out of range") };
+            let next_is_call = j > 0 && is_call(self, suffixes.get(j - 1));
+            let span = self.ast.expr_span(s);
+            match self.ast.expr(s) {
+                Some(Expr::Member { property, .. }) => {
+                    self.at(span.start);
+                    let n = self.name_key(key_of(&property.name));
+                    self.emit(if next_is_call { Op::GetMemberThis(n) } else { Op::GetMember(n) });
+                }
+                Some(Expr::Index { index, .. }) => {
+                    self.expr(*index)?;
+                    self.at(span.start);
+                    self.emit(if next_is_call { Op::GetIndexThis } else { Op::GetIndex });
+                }
+                Some(Expr::Call { args, .. }) => {
+                    let innermost = j + 1 == count;
+                    let has_this = if innermost {
+                        base_has_this
+                    } else {
+                        matches!(suffixes.get(j + 1).and_then(|&e| self.ast.expr(e)), Some(Expr::Member { .. } | Expr::Index { .. }))
+                    };
+                    if !has_this {
+                        self.emit(Op::Undefined);
+                    }
+                    self.args(args)?;
+                    self.at(span.start);
+                    let n = len_u32(args.len());
+                    if innermost && eval_call {
+                        self.uses_arguments = true;
+                        self.emit(Op::CallEval(n));
+                    } else {
+                        self.emit(Op::Call(n));
+                    }
+                }
+                _ => return internal("not a member or call"),
+            }
+        }
+        Ok(())
+    }
+
+    fn unary(&mut self, id: ExprId) -> CResult<()> {
+        let mut ops = Vec::new();
+        let mut cur = id;
+        while let Some(Expr::Unary { op, arg }) = self.ast.expr(cur) {
+            if matches!(op, UnaryOp::Delete | UnaryOp::Typeof) {
+                break;
+            }
+            ops.push(*op);
+            cur = self.ast.unparenthesized(*arg);
+        }
+        match self.ast.expr(cur) {
+            Some(Expr::Unary { op: UnaryOp::Typeof, arg }) => self.typeof_expr(*arg)?,
+            Some(Expr::Unary { op: UnaryOp::Delete, arg }) => self.delete_expr(*arg)?,
+            _ => self.expr(cur)?,
+        }
+        self.at(self.ast.expr_span(id).start);
+        for op in ops.into_iter().rev() {
+            match op {
+                UnaryOp::Plus => self.emit(Op::Plus),
+                UnaryOp::Minus => self.emit(Op::Neg),
+                UnaryOp::BitNot => self.emit(Op::BitNot),
+                UnaryOp::Not => self.emit(Op::Not),
+                UnaryOp::Void => {
+                    self.emit(Op::Pop);
+                    self.emit(Op::Undefined);
+                }
+                UnaryOp::Delete | UnaryOp::Typeof => return internal("unexpected operator"),
+            }
+        }
+        Ok(())
+    }
+
+    fn typeof_expr(&mut self, arg: ExprId) -> CResult<()> {
+        let arg = self.ast.unparenthesized(arg);
+        if let Some(Expr::Ident(name)) = self.ast.expr(arg) {
+            let n = self.var_name(name);
+            self.emit(Op::TypeofVar(n));
+        } else {
+            self.expr(arg)?;
+            self.emit(Op::Typeof);
+        }
+        Ok(())
+    }
+
+    fn delete_expr(&mut self, arg: ExprId) -> CResult<()> {
+        let arg = self.ast.unparenthesized(arg);
+        match self.ast.expr(arg) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::DeleteVar(n));
+            }
+            Some(Expr::Member { object, property }) => {
+                self.expr(*object)?;
+                let n = self.name_key(key_of(&property.name));
+                self.emit(Op::DeleteMember(n));
+            }
+            Some(Expr::Index { object, index }) => {
+                self.expr(*object)?;
+                self.expr(*index)?;
+                self.emit(Op::DeleteIndex);
+            }
+            _ => {
+                self.expr(arg)?;
+                self.emit(Op::Pop);
+                self.emit(Op::True);
+            }
+        }
+        Ok(())
+    }
+
+    /// A run of binary and logical operators nested on the left (`a + b + c`), compiled with a
+    /// loop.
+    fn binary_chain(&mut self, id: ExprId) -> CResult<()> {
+        enum Step {
+            Binary(BinaryOp),
+            Logical(LogicalOp),
+        }
+        let mut spine = Vec::new();
+        let mut cur = id;
+        loop {
+            match self.ast.expr(cur) {
+                Some(Expr::Binary { op, left, right }) => {
+                    spine.push((Step::Binary(*op), *right, cur));
+                    cur = self.ast.unparenthesized(*left);
+                }
+                Some(Expr::Logical { op, left, right }) => {
+                    spine.push((Step::Logical(*op), *right, cur));
+                    cur = self.ast.unparenthesized(*left);
+                }
+                _ => break,
+            }
+        }
+        self.expr(cur)?;
+        for (step, right, node) in spine.into_iter().rev() {
+            match step {
+                Step::Binary(op) => {
+                    self.expr(right)?;
+                    self.at(self.ast.expr_span(node).start);
+                    self.emit(Op::Binary(op));
+                }
+                Step::Logical(op) => {
+                    let end = self.new_label();
+                    self.jump(if op == LogicalOp::And { Op::JumpIfFalseKeep } else { Op::JumpIfTrueKeep }, end);
+                    self.expr(right)?;
+                    self.bind(end);
+                }
+            }
+        }
+        Ok(())
+    }
+
+    /// A chain of assignments nested on the right (`a = b.c = d[e] = 1`), compiled with a loop:
+    /// each target's object and key first, from the left, then the value, then the stores from
+    /// the right.
+    fn assign_chain(&mut self, id: ExprId) -> CResult<()> {
+        let mut chain: Vec<(AssignOp, ExprId, ExprId)> = Vec::new();
+        let mut cur = id;
+        while let Some(Expr::Assign { op, target, value }) = self.ast.expr(cur) {
+            chain.push((*op, self.ast.unparenthesized(*target), cur));
+            cur = self.ast.unparenthesized(*value);
+        }
+        for &(op, target, node) in &chain {
+            self.at(self.ast.expr_span(node).start);
+            self.assign_target(op, target)?;
+        }
+        self.expr(cur)?;
+        for &(op, target, node) in chain.iter().rev() {
+            self.at(self.ast.expr_span(node).start);
+            if let Some(b) = op {
+                self.emit(Op::Binary(b));
+            }
+            self.store(target)?;
+        }
+        Ok(())
+    }
+
+    /// Pushes what an assignment to `target` needs before its value: the object and key, and the
+    /// current value for a compound assignment.
+    fn assign_target(&mut self, op: AssignOp, target: ExprId) -> CResult<()> {
+        match self.ast.expr(target) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::RefVar(n));
+                if op.is_some() {
+                    self.emit(Op::Dup);
+                    self.emit(Op::GetRef(n));
+                }
+            }
+            Some(Expr::Member { object, property }) => {
+                self.expr(*object)?;
+                if op.is_some() {
+                    self.emit(Op::Dup);
+                    let n = self.name_key(key_of(&property.name));
+                    self.emit(Op::GetMember(n));
+                } else {
+                    self.emit(Op::CheckObject);
+                }
+            }
+            Some(Expr::Index { object, index }) => {
+                self.expr(*object)?;
+                self.expr(*index)?;
+                self.emit(Op::ToKey);
+                if op.is_some() {
+                    self.emit(Op::Dup2);
+                    self.emit(Op::GetIndex);
+                }
+            }
+            _ => {
+                self.expr(target)?;
+                if op.is_none() {
+                    self.emit(Op::Pop);
+                }
+            }
+        }
+        Ok(())
+    }
+
+    fn store(&mut self, target: ExprId) -> CResult<()> {
+        match self.ast.expr(target) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::PutRef(n));
+            }
+            Some(Expr::Member { property, .. }) => {
+                let n = self.name_key(key_of(&property.name));
+                self.emit(Op::SetMember(n));
+            }
+            Some(Expr::Index { .. }) => self.emit(Op::SetIndex),
+            _ => self.throw_invalid_target(),
+        }
+        Ok(())
+    }
+
+    fn update(&mut self, op: UpdateOp, prefix: bool, target: ExprId) -> CResult<()> {
+        let target = self.ast.unparenthesized(target);
+        let dec = op == UpdateOp::Decrement;
+        match self.ast.expr(target) {
+            Some(Expr::Ident(name)) => {
+                let n = self.var_name(name);
+                self.emit(Op::IncVar { name: n, prefix, dec });
+            }
+            Some(Expr::Member { object, property }) => {
+                self.expr(*object)?;
+                let n = self.name_key(key_of(&property.name));
+                self.emit(Op::IncMember { name: n, prefix, dec });
+            }
+            Some(Expr::Index { object, index }) => {
+                self.expr(*object)?;
+                self.expr(*index)?;
+                self.emit(Op::IncIndex { prefix, dec });
+            }
+            _ => {
+                self.expr(target)?;
+                self.emit(Op::ToNumber);
+                self.throw_invalid_target();
+            }
+        }
+        Ok(())
+    }
+
+    // ---- finishing ----
+
+    fn finish(mut self, hoisted: Hoisted, meta: Meta) -> CResult<Rc<Code>> {
+        let resolve = |labels: &[Option<u32>], l: Label| labels.get(l.0).copied().flatten();
+        for &(i, label) in &self.patches {
+            let Some(target) = resolve(&self.labels, label) else { return internal("jump to an unplaced label") };
+            match self.ops.get_mut(i) {
+                Some(Op::Jump(t) | Op::JumpIfFalse(t) | Op::JumpIfTrue(t) | Op::JumpIfFalseKeep(t) | Op::JumpIfTrueKeep(t) | Op::ForInNext(t)) => {
+                    *t = target
+                }
+                _ => return internal("patching an instruction that is not a jump"),
+            }
+        }
+        let mut handlers = Vec::new();
+        for &(start, end, label, depth, env_depth) in &self.handlers {
+            let Some(target) = resolve(&self.labels, label) else { return internal("handler at an unplaced label") };
+            handlers.push(Handler { start, end, target, depth, env_depth });
+        }
+        let mut finally_tables = Vec::new();
+        for table in &self.finally_tables {
+            let resolved: Option<Vec<u32>> = table.iter().map(|&l| resolve(&self.labels, l)).collect();
+            let Some(resolved) = resolved else { return internal("finally exit at an unplaced label") };
+            finally_tables.push(resolved);
+        }
+        let mut code = Code {
+            ops: std::mem::take(&mut self.ops),
+            positions: std::mem::take(&mut self.positions),
+            numbers: std::mem::take(&mut self.numbers),
+            strings: std::mem::take(&mut self.strings),
+            names: std::mem::take(&mut self.names),
+            functions: std::mem::take(&mut self.functions),
+            regexps: std::mem::take(&mut self.regexps),
+            handlers,
+            finally_tables,
+            max_stack: 0,
+            strict: self.strict,
+            self_name: meta.self_name,
+            params: meta.params,
+            vars: hoisted.vars,
+            fun_decls: hoisted.fun_decls,
+            uses_arguments: self.uses_arguments,
+            source: self.source.clone(),
+            span: meta.span,
+        };
+        code.max_stack = verify(&code).map_err(CompileFail::Internal)?;
+        Ok(Rc::new(code))
+    }
+}
+
+/// What a code knows about the function it is, if it is one.
+#[derive(Default)]
+struct Meta {
+    self_name: Option<Key>,
+    params: Vec<Key>,
+    span: (u32, u32),
+}
+
+fn len_u32(n: usize) -> u32 {
+    u32::try_from(n).unwrap_or(u32::MAX)
+}
+
+/// Compiles function `fid` of `ast`. With `bind_name`, a function expression's name is bound
+/// inside it.
+pub(crate) fn compile_function(ast: &Ast, fid: FunctionId, source: &Rc<Source>, recursion: u32, bind_name: bool) -> CResult<Rc<Code>> {
+    let Some(f) = ast.function(fid) else { return internal("function out of range") };
+    let mut c = FnCompiler::new(ast, source, CodeKind::Function, f.strict, recursion);
+    c.at(f.span.start);
+    c.enter()?;
+    let hoisted = c.hoist(&f.body)?;
+    c.stmts(&f.body)?;
+    c.at(f.span.end.saturating_sub(1));
+    c.emit(Op::Undefined);
+    c.emit(Op::Return);
+    let name = f.name.as_ref().map(|n| key_of(&n.name));
+    let meta = Meta {
+        self_name: if bind_name && f.kind == FunctionKind::Expression { name } else { None },
+        params: f.params.iter().map(|p| key_of(&p.name)).collect(),
+        span: (f.span.start, f.span.end),
+    };
+    c.finish(hoisted, meta)
+}
+
+/// Compiles a script (`kind` [`CodeKind::Global`]) or eval code ([`CodeKind::Eval`]).
+pub(crate) fn compile_program(program: &crate::Program, source: &Rc<Source>, kind: CodeKind) -> CResult<Rc<Code>> {
+    let mut c = FnCompiler::new(&program.ast, source, kind, program.strict, 0);
+    let hoisted = c.hoist(&program.body)?;
+    c.stmts(&program.body)?;
+    c.emit(Op::ReturnCompletion);
+    let end = u32::try_from(source.text.len()).unwrap_or(u32::MAX);
+    c.finish(hoisted, Meta { span: (0, end), ..Meta::default() })
+}
+
+/// The function of a `Function` constructor's source, `(function anonymous(…) {…})`: the program
+/// must be that one parenthesized function expression and nothing else. The name `anonymous` is
+/// not bound inside the function (section 15.3.2.1).
+pub(crate) fn compile_constructed_function(program: &crate::Program, source: &Rc<Source>) -> CResult<Option<Rc<Code>>> {
+    let [stmt] = program.body.as_slice() else { return Ok(None) };
+    let Some(Stmt::Expr(e)) = program.ast.stmt(*stmt) else { return Ok(None) };
+    let Some(Expr::Paren(inner)) = program.ast.expr(*e) else { return Ok(None) };
+    let Some(Expr::Function(fid)) = program.ast.expr(*inner) else { return Ok(None) };
+    compile_function(&program.ast, *fid, source, 0, false).map(Some)
+}
diff --git a/crates/js/src/heap.rs b/crates/js/src/heap.rs
new file mode 100644
index 000000000..82268f489
--- /dev/null
+++ b/crates/js/src/heap.rs
@@ -0,0 +1,594 @@
+//! The heap: objects and environments in one arena, referred to by index, and a mark-sweep
+//! collector over it.
+//!
+//! A cell is either free or holds an [`Object`] or an [`Env`]. The collector marks every cell
+//! reachable from the roots the interpreter passes in, with a worklist rather than recursion, and
+//! frees the rest; freed indices are reused by later allocations. Cycles between objects are freed
+//! like anything else that is unreachable. [`Heap::bytes`] is an estimate of the memory the heap
+//! holds, strings reachable from it included; the interpreter compares it with its heap limit.
+
+use std::collections::{HashMap, HashSet};
+use std::rc::Rc;
+
+use crate::bytecode::{Code, Handler, Op};
+use crate::value::{Str, Value};
+
+/// A property name: its UTF-16 code units.
+pub(crate) type Key = Rc<[u16]>;
+
+pub(crate) fn key(s: &str) -> Key {
+    s.encode_utf16().collect::<Vec<u16>>().into()
+}
+
+/// An object's index in the heap.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub(crate) struct ObjId(pub(crate) u32);
+
+/// An environment's index in the heap.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub(crate) struct EnvId(pub(crate) u32);
+
+/// A map from property names to values that keeps insertion order (the order `for-in` lists own
+/// properties in). Small maps are searched in order; larger ones keep a hash index.
+#[derive(Clone, Debug)]
+pub(crate) struct PropMap<T> {
+    entries: Vec<Option<(Key, T)>>,
+    index: Option<HashMap<Key, usize>>,
+    live: usize,
+}
+
+/// Maps with more entries than this keep a hash index.
+const INDEX_AFTER: usize = 8;
+
+impl<T> Default for PropMap<T> {
+    fn default() -> Self {
+        Self { entries: Vec::new(), index: None, live: 0 }
+    }
+}
+
+impl<T> PropMap<T> {
+    fn position(&self, k: &[u16]) -> Option<usize> {
+        match &self.index {
+            Some(index) => index.get(k).copied(),
+            None => self.entries.iter().position(|e| e.as_ref().is_some_and(|(ek, _)| &**ek == k)),
+        }
+    }
+
+    pub(crate) fn get(&self, k: &[u16]) -> Option<&T> {
+        let i = self.position(k)?;
+        self.entries.get(i)?.as_ref().map(|(_, v)| v)
+    }
+
+    pub(crate) fn get_mut(&mut self, k: &[u16]) -> Option<&mut T> {
+        let i = self.position(k)?;
+        self.entries.get_mut(i)?.as_mut().map(|(_, v)| v)
+    }
+
+    pub(crate) fn contains(&self, k: &[u16]) -> bool {
+        self.position(k).is_some()
+    }
+
+    /// Sets the value under `k`, keeping its place when it is there already.
+    pub(crate) fn insert(&mut self, k: Key, v: T) {
+        if let Some(slot) = self.get_mut(&k) {
+            *slot = v;
+            return;
+        }
+        let i = self.entries.len();
+        if let Some(index) = &mut self.index {
+            index.insert(k.clone(), i);
+        }
+        self.entries.push(Some((k, v)));
+        self.live += 1;
+        if self.index.is_none() && self.entries.len() > INDEX_AFTER {
+            self.rebuild_index();
+        }
+    }
+
+    pub(crate) fn remove(&mut self, k: &[u16]) -> Option<T> {
+        let i = self.position(k)?;
+        let (_, v) = self.entries.get_mut(i)?.take()?;
+        if let Some(index) = &mut self.index {
+            index.remove(k);
+        }
+        self.live -= 1;
+        if self.entries.len() > 2 * INDEX_AFTER && self.live * 2 < self.entries.len() {
+            self.entries.retain(Option::is_some);
+            self.rebuild_index();
+        }
+        Some(v)
+    }
+
+    fn rebuild_index(&mut self) {
+        if self.entries.len() <= INDEX_AFTER {
+            self.index = None;
+            return;
+        }
+        let index = self.entries.iter().enumerate().filter_map(|(i, e)| e.as_ref().map(|(k, _)| (k.clone(), i))).collect();
+        self.index = Some(index);
+    }
+
+    pub(crate) fn len(&self) -> usize {
+        self.live
+    }
+
+    pub(crate) fn iter(&self) -> impl Iterator<Item = (&Key, &T)> {
+        self.entries.iter().filter_map(|e| e.as_ref().map(|(k, v)| (k, v)))
+    }
+
+    pub(crate) fn keys(&self) -> Vec<Key> {
+        self.iter().map(|(k, _)| k.clone()).collect()
+    }
+}
+
+pub(crate) const WRITABLE: u8 = 1;
+pub(crate) const ENUMERABLE: u8 = 2;
+pub(crate) const CONFIGURABLE: u8 = 4;
+/// Writable, enumerable and configurable: a property made by assignment.
+pub(crate) const OPEN: u8 = WRITABLE | ENUMERABLE | CONFIGURABLE;
+/// Writable and configurable but not enumerable: the built-in methods.
+pub(crate) const HIDDEN: u8 = WRITABLE | CONFIGURABLE;
+
+/// A property (section 8.6.1).
+#[derive(Clone, Debug)]
+pub(crate) enum Prop {
+    Data { value: Value, flags: u8 },
+    Accessor { get: Option<ObjId>, set: Option<ObjId>, flags: u8 },
+}
+
+impl Prop {
+    pub(crate) fn flags(&self) -> u8 {
+        match self {
+            Prop::Data { flags, .. } | Prop::Accessor { flags, .. } => *flags,
+        }
+    }
+
+    pub(crate) fn enumerable(&self) -> bool {
+        self.flags() & ENUMERABLE != 0
+    }
+
+    pub(crate) fn configurable(&self) -> bool {
+        self.flags() & CONFIGURABLE != 0
+    }
+}
+
+/// A built-in function implemented in Rust: `(interp, this, arguments, called with new)`.
+pub(crate) type NativeFn = fn(&mut crate::interp::Interp, Value, &[Value], bool) -> Result<Value, crate::interp::Abrupt>;
+
+/// A function the embedding defines.
+pub(crate) type HostFn = dyn Fn(&[crate::JsValue]) -> Result<crate::JsValue, String>;
+
+/// The built-ins the interpreter treats specially when it calls them.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum NativeKind {
+    Plain,
+    /// `Function.prototype.call`.
+    Call,
+    /// `Function.prototype.apply`.
+    Apply,
+    /// The global `eval`: a call to it by that name is a direct eval.
+    Eval,
+}
+
+#[derive(Clone)]
+pub(crate) enum Func {
+    Closure { code: Rc<Code>, env: EnvId },
+    Native { f: NativeFn, kind: NativeKind, constructor: bool, name: &'static str },
+    Host { f: Rc<HostFn>, name: Rc<str> },
+}
+
+/// A sloppy mode `arguments` object's link to its function's parameters (section 10.6): index
+/// `i` reads and writes the binding `names[i]` while that is `Some`.
+#[derive(Clone, Debug)]
+pub(crate) struct ArgMap {
+    pub(crate) env: EnvId,
+    pub(crate) names: Vec<Option<Key>>,
+}
+
+/// A `for-in` loop's state: the names listed when it started, and the object they came from.
+#[derive(Clone, Debug)]
+pub(crate) struct ForIn {
+    pub(crate) keys: Vec<Key>,
+    pub(crate) pos: usize,
+    pub(crate) object: Option<ObjId>,
+}
+
+/// What kind of object it is, with the internal state that kind has.
+#[derive(Clone)]
+pub(crate) enum Class {
+    Ordinary,
+    Array {
+        length: u32,
+        length_writable: bool,
+    },
+    Function(Func),
+    Error,
+    Arguments(Box<ArgMap>),
+    /// A `Boolean` object made by ToObject.
+    Boolean,
+    /// A `Number` object made by ToObject.
+    Number,
+    String(Str),
+    RegExp,
+    ForIn(Box<ForIn>),
+}
+
+impl Class {
+    /// The `[[Class]]` name `Object.prototype.toString` reports.
+    pub(crate) fn name(&self) -> &'static str {
+        match self {
+            Class::Ordinary | Class::ForIn(_) => "Object",
+            Class::Array { .. } => "Array",
+            Class::Function(_) => "Function",
+            Class::Error => "Error",
+            Class::Arguments(_) => "Arguments",
+            Class::Boolean => "Boolean",
+            Class::Number => "Number",
+            Class::String(_) => "String",
+            Class::RegExp => "RegExp",
+        }
+    }
+}
+
+pub(crate) struct Object {
+    pub(crate) class: Class,
+    pub(crate) proto: Option<ObjId>,
+    pub(crate) extensible: bool,
+    pub(crate) props: PropMap<Prop>,
+}
+
+impl Object {
+    pub(crate) fn new(class: Class, proto: Option<ObjId>) -> Self {
+        Self { class, proto, extensible: true, props: PropMap::default() }
+    }
+}
+
+/// A binding in a declarative environment.
+#[derive(Clone, Debug)]
+pub(crate) struct Binding {
+    pub(crate) value: Value,
+    pub(crate) mutable: bool,
+    pub(crate) deletable: bool,
+}
+
+/// An environment record (section 10.2.1) with its outer environment.
+pub(crate) enum Env {
+    Decl {
+        bindings: PropMap<Binding>,
+        outer: Option<EnvId>,
+    },
+    /// The global object, or a `with` statement's object (`with_this`: calls to its functions get
+    /// it as `this`).
+    Obj {
+        object: ObjId,
+        with_this: bool,
+        outer: Option<EnvId>,
+    },
+}
+
+impl Env {
+    pub(crate) fn outer(&self) -> Option<EnvId> {
+        match self {
+            Env::Decl { outer, .. } | Env::Obj { outer, .. } => *outer,
+        }
+    }
+}
+
+enum Cell {
+    Free,
+    Object(Box<Object>),
+    Env(Box<Env>),
+}
+
+/// The estimated bytes of a property or a binding entry. A collection adds its name's code units
+/// separately, counting a buffer that several names or strings share once.
+pub(crate) const PROP_BYTES: usize = 64;
+/// The estimated bytes of an object without its properties.
+pub(crate) const OBJECT_BYTES: usize = 96;
+/// The estimated bytes of an environment without its bindings.
+pub(crate) const ENV_BYTES: usize = 64;
+/// The estimated bytes of a rope node.
+pub(crate) const ROPE_BYTES: usize = 48;
+/// The estimated bytes of a piece of code without its instructions, tables and strings.
+const CODE_BYTES: usize = 384;
+
+pub(crate) fn string_bytes(len: usize) -> usize {
+    32 + 2 * len
+}
+
+#[derive(Default)]
+pub(crate) struct Heap {
+    cells: Vec<Cell>,
+    free: Vec<u32>,
+    /// An estimate of the bytes the heap holds: the live total from the last collection plus what
+    /// was allocated since.
+    pub(crate) bytes: usize,
+    /// How many collections have run.
+    pub(crate) collections: usize,
+}
+
+impl Heap {
+    fn alloc(&mut self, cell: Cell, bytes: usize) -> u32 {
+        self.bytes += bytes;
+        if let Some(i) = self.free.pop()
+            && let Some(slot) = self.cells.get_mut(i as usize)
+        {
+            *slot = cell;
+            return i;
+        }
+        self.cells.push(cell);
+        u32::try_from(self.cells.len() - 1).unwrap_or(u32::MAX)
+    }
+
+    pub(crate) fn alloc_object(&mut self, object: Object) -> ObjId {
+        let bytes = OBJECT_BYTES + PROP_BYTES * object.props.len();
+        ObjId(self.alloc(Cell::Object(Box::new(object)), bytes))
+    }
+
+    pub(crate) fn alloc_env(&mut self, env: Env) -> EnvId {
+        let bytes = ENV_BYTES + if let Env::Decl { bindings, .. } = &env { PROP_BYTES * bindings.len() } else { 0 };
+        EnvId(self.alloc(Cell::Env(Box::new(env)), bytes))
+    }
+
+    pub(crate) fn object(&self, id: ObjId) -> Option<&Object> {
+        match self.cells.get(id.0 as usize) {
+            Some(Cell::Object(o)) => Some(o),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn object_mut(&mut self, id: ObjId) -> Option<&mut Object> {
+        match self.cells.get_mut(id.0 as usize) {
+            Some(Cell::Object(o)) => Some(o),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn env(&self, id: EnvId) -> Option<&Env> {
+        match self.cells.get(id.0 as usize) {
+            Some(Cell::Env(e)) => Some(e),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn env_mut(&mut self, id: EnvId) -> Option<&mut Env> {
+        match self.cells.get_mut(id.0 as usize) {
+            Some(Cell::Env(e)) => Some(e),
+            _ => None,
+        }
+    }
+
+    /// Live cells, for tests.
+    #[cfg(test)]
+    pub(crate) fn live_cells(&self) -> usize {
+        self.cells.iter().filter(|c| !matches!(c, Cell::Free)).count()
+    }
+
+    /// Marks everything reachable from `roots` and frees the rest. Afterwards [`Heap::bytes`] is
+    /// the estimated size of what is left, strings reachable from it included.
+    pub(crate) fn collect(&mut self, roots: &Roots<'_>) {
+        let mut marks = vec![false; self.cells.len()];
+        let mut work: Vec<u32> = Vec::new();
+        let mut strings = StringSizes::default();
+        let mut live = 0usize;
+        for v in &roots.values {
+            mark_value(v, &mut work, &mut strings);
+        }
+        work.extend(roots.objects.iter().map(|o| o.0));
+        work.extend(roots.envs.iter().map(|e| e.0));
+        for code in &roots.codes {
+            mark_code(code, &mut strings);
+        }
+        while let Some(i) = work.pop() {
+            let Some(mark) = marks.get_mut(i as usize) else { continue };
+            if *mark {
+                continue;
+            }
+            *mark = true;
+            match self.cells.get(i as usize) {
+                Some(Cell::Object(o)) => live += trace_object(o, &mut work, &mut strings),
+                Some(Cell::Env(e)) => live += trace_env(e, &mut work, &mut strings),
+                _ => {}
+            }
+        }
+        for (i, (cell, marked)) in self.cells.iter_mut().zip(&marks).enumerate() {
+            if !marked && !matches!(cell, Cell::Free) {
+                *cell = Cell::Free;
+                self.free.push(u32::try_from(i).unwrap_or(u32::MAX));
+            }
+        }
+        self.bytes = live + strings.bytes;
+        self.collections += 1;
+    }
+}
+
+/// What the collector starts from.
+#[derive(Default)]
+pub(crate) struct Roots<'a> {
+    pub(crate) values: Vec<&'a Value>,
+    pub(crate) objects: Vec<ObjId>,
+    pub(crate) envs: Vec<EnvId>,
+    pub(crate) codes: Vec<&'a Code>,
+}
+
+/// Sums the sizes of the strings and property names reached, counting each node and each
+/// code-unit buffer once.
+#[derive(Default)]
+struct StringSizes {
+    seen: HashSet<usize>,
+    bytes: usize,
+}
+
+impl StringSizes {
+    fn add(&mut self, s: &Str) {
+        let mut stack = vec![s.clone()];
+        while let Some(s) = stack.pop() {
+            if !self.seen.insert(s.node_addr()) {
+                continue;
+            }
+            match s.halves() {
+                Some((l, r)) => {
+                    self.bytes += ROPE_BYTES;
+                    stack.push(l);
+                    stack.push(r);
+                }
+                None => {
+                    if s.buffer_addr().is_none_or(|a| self.seen.insert(a)) {
+                        self.bytes += string_bytes(s.len());
+                    }
+                }
+            }
+        }
+    }
+
+    /// Adds a property or binding name, unless a string or another name shares its buffer.
+    fn add_key(&mut self, k: &Key) {
+        if self.seen.insert(Rc::as_ptr(k) as *const () as usize) {
+            self.bytes += string_bytes(k.len());
+        }
+    }
+}
+
+fn mark_value(v: &Value, work: &mut Vec<u32>, strings: &mut StringSizes) {
+    match v {
+        Value::Object(o) => work.push(o.0),
+        Value::String(s) => strings.add(s),
+        _ => {}
+    }
+}
+
+/// The estimated bytes of `code` with the functions nested in it and its source text, for
+/// charging code made at run time to the heap before anything refers to it.
+pub(crate) fn code_bytes(code: &Code) -> usize {
+    let mut sizes = StringSizes::default();
+    mark_code(code, &mut sizes);
+    sizes.bytes
+}
+
+/// Adds the estimated size of `code` and the functions nested in it, counting each piece of code,
+/// each source text and each string once however many closures share them.
+fn mark_code(code: &Code, strings: &mut StringSizes) {
+    let mut stack = vec![code];
+    while let Some(code) = stack.pop() {
+        if !strings.seen.insert(code as *const Code as usize) {
+            continue;
+        }
+        if strings.seen.insert(Rc::as_ptr(&code.source) as usize) {
+            strings.bytes += code.source.lines.heap_bytes();
+            // The text can share its buffer with the string eval was given.
+            if strings.seen.insert(Rc::as_ptr(&code.source.text) as *const () as usize) {
+                strings.bytes += string_bytes(code.source.text.len());
+            }
+        }
+        let handles = code.strings.len()
+            + 2 * code.regexps.len()
+            + code.names.len()
+            + code.functions.len()
+            + code.params.len()
+            + code.vars.len()
+            + 2 * code.fun_decls.len();
+        let tables = code.finally_tables.iter().map(|t| 24 + 4 * t.len()).sum::<usize>();
+        strings.bytes += CODE_BYTES
+            + size_of::<Op>() * code.ops.len()
+            + 4 * code.positions.len()
+            + 8 * code.numbers.len()
+            + size_of::<Handler>() * code.handlers.len()
+            + 16 * handles
+            + tables;
+        for s in &code.strings {
+            strings.add(s);
+        }
+        for (pattern, flags) in &code.regexps {
+            strings.add(pattern);
+            strings.add(flags);
+        }
+        let keys = code.names.iter().chain(&code.params).chain(&code.vars).chain(code.fun_decls.iter().map(|(k, _)| k));
+        for k in keys.chain(&code.self_name) {
+            strings.add_key(k);
+        }
+        stack.extend(code.functions.iter().map(|f| &**f));
+    }
+}
+
+fn trace_object(o: &Object, work: &mut Vec<u32>, strings: &mut StringSizes) -> usize {
+    if let Some(p) = o.proto {
+        work.push(p.0);
+    }
+    for (k, prop) in o.props.iter() {
+        strings.add_key(k);
+        match prop {
+            Prop::Data { value, .. } => mark_value(value, work, strings),
+            Prop::Accessor { get, set, .. } => work.extend(get.iter().chain(set.iter()).map(|f| f.0)),
+        }
+    }
+    match &o.class {
+        Class::Function(Func::Closure { env, code }) => {
+            work.push(env.0);
+            mark_code(code, strings);
+        }
+        Class::Arguments(map) => work.push(map.env.0),
+        Class::String(s) => strings.add(s),
+        Class::ForIn(state) => {
+            work.extend(state.object.iter().map(|o| o.0));
+            strings.bytes += state.keys.iter().map(|k| string_bytes(k.len())).sum::<usize>();
+        }
+        _ => {}
+    }
+    OBJECT_BYTES + PROP_BYTES * o.props.len()
+}
+
+fn trace_env(e: &Env, work: &mut Vec<u32>, strings: &mut StringSizes) -> usize {
+    match e {
+        Env::Decl { bindings, outer } => {
+            work.extend(outer.iter().map(|o| o.0));
+            for (k, b) in bindings.iter() {
+                strings.add_key(k);
+                mark_value(&b.value, work, strings);
+            }
+            ENV_BYTES + PROP_BYTES * bindings.len()
+        }
+        Env::Obj { object, outer, .. } => {
+            work.push(object.0);
+            work.extend(outer.iter().map(|o| o.0));
+            ENV_BYTES
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Class, Heap, OBJECT_BYTES, Object, PROP_BYTES, Prop, PropMap, Roots, key, string_bytes};
+    use crate::value::{Str, Value};
+
+    #[test]
+    fn a_collection_counts_a_name_and_a_value_that_share_a_buffer_once() {
+        let mut heap = Heap::default();
+        let name = key(&"n".repeat(1000));
+        let mut object = Object::new(Class::Ordinary, None);
+        object.props.insert(name.clone(), Prop::Data { value: Value::String(Str::from_rc(name.clone())), flags: 0 });
+        object.props.insert(key("other"), Prop::Data { value: Value::Undefined, flags: 0 });
+        let id = heap.alloc_object(object);
+        heap.collect(&Roots { objects: vec![id], ..Roots::default() });
+        assert_eq!(heap.bytes, OBJECT_BYTES + 2 * PROP_BYTES + string_bytes(1000) + string_bytes(5));
+    }
+
+    #[test]
+    fn prop_maps_keep_insertion_order_through_removals_and_growth() {
+        let mut m = PropMap::default();
+        for i in 0..40 {
+            m.insert(key(&format!("k{i}")), i);
+        }
+        for i in (0..40).step_by(2) {
+            assert_eq!(m.remove(&key(&format!("k{i}"))), Some(i));
+        }
+        m.insert(key("k1"), 100);
+        m.insert(key("new"), 7);
+        let keys: Vec<String> = m.iter().map(|(k, _)| String::from_utf16_lossy(k)).collect();
+        let mut want: Vec<String> = (1..40).step_by(2).map(|i| format!("k{i}")).collect();
+        want.push("new".into());
+        assert_eq!(keys, want);
+        assert_eq!(m.get(&key("k1")), Some(&100));
+        assert_eq!(m.len(), 21);
+        assert!(!m.contains(&key("k0")));
+    }
+}
diff --git a/crates/js/src/interp.rs b/crates/js/src/interp.rs
new file mode 100644
index 000000000..9d16046d0
--- /dev/null
+++ b/crates/js/src/interp.rs
@@ -0,0 +1,2244 @@
+//! The interpreter: runs bytecode on an explicit stack of frames.
+//!
+//! A call to a function written in JavaScript pushes a frame and goes on in the same loop, so
+//! JavaScript recursion uses the heap, not the Rust stack. The loop runs again inside a Rust call
+//! only where the language needs a function's result in the middle of an operation (a getter or
+//! setter, `valueOf` and `toString` during a conversion, indirect `eval`); those nested runs are
+//! counted against [`crate::Limits::reentry`].
+//!
+//! Before each instruction the interpreter takes one unit of fuel, checks the interrupt flag and,
+//! when the heap has grown past its threshold, collects garbage. Running out of fuel, the heap
+//! limit, the frame limit, the re-entry limit and the interrupt flag each end the run with an
+//! [`Abrupt::Limit`] that unwinds every frame without running catch or finally blocks.
+//!
+//! Collection runs only between instructions. An operation that may run JavaScript in the middle
+//! keeps its operands on the operand stack until it is done, so everything it holds is reachable
+//! from the roots when a nested run collects.
+
+use std::rc::Rc;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use crate::ast::BinaryOp;
+use crate::bytecode::{Code, CodeKind, Op, Source};
+use crate::compiler::{CompileFail, compile_program};
+use crate::heap::{
+    ArgMap, Binding, CONFIGURABLE, Class, ENUMERABLE, ENV_BYTES, Env, EnvId, ForIn, Func, HIDDEN, Heap, Key, NativeKind, OBJECT_BYTES, OPEN, ObjId,
+    Object, PROP_BYTES, Prop, PropMap, ROPE_BYTES, Roots, WRITABLE, code_bytes, key, string_bytes,
+};
+use crate::value::{Str, Value, array_index, index_key, number_to_str, string_to_number, to_int32, to_uint32};
+use crate::{LimitKind, Limits, Options};
+
+/// How an operation ended other than normally.
+#[derive(Debug)]
+pub(crate) enum Abrupt {
+    /// A JavaScript exception: `try` and `catch` can handle it.
+    Throw(Value),
+    /// A limit was reached; nothing handles it.
+    Limit(LimitKind),
+    /// The interpreter found itself in a state it never makes (a bug); nothing handles it.
+    Internal(String),
+}
+
+pub(crate) type JsResult<T> = Result<T, Abrupt>;
+
+fn internal<T>(message: &str) -> JsResult<T> {
+    Err(Abrupt::Internal(message.into()))
+}
+
+/// The kinds of error object the engine throws.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub(crate) enum ErrorType {
+    Error,
+    Eval,
+    Range,
+    Reference,
+    Syntax,
+    Type,
+    Uri,
+}
+
+/// The objects the interpreter itself refers to.
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct Intrinsics {
+    pub(crate) object_proto: ObjId,
+    pub(crate) function_proto: ObjId,
+    pub(crate) array_proto: ObjId,
+    pub(crate) string_proto: ObjId,
+    pub(crate) number_proto: ObjId,
+    pub(crate) boolean_proto: ObjId,
+    pub(crate) regexp_proto: ObjId,
+    pub(crate) error_protos: [ObjId; 7],
+    pub(crate) eval: ObjId,
+    pub(crate) throw_type_error: ObjId,
+}
+
+impl Intrinsics {
+    fn placeholder() -> Self {
+        let o = ObjId(0);
+        Self {
+            object_proto: o,
+            function_proto: o,
+            array_proto: o,
+            string_proto: o,
+            number_proto: o,
+            boolean_proto: o,
+            regexp_proto: o,
+            error_protos: [o; 7],
+            eval: o,
+            throw_type_error: o,
+        }
+    }
+
+    pub(crate) fn error_proto(&self, t: ErrorType) -> ObjId {
+        let i = match t {
+            ErrorType::Error => 0,
+            ErrorType::Eval => 1,
+            ErrorType::Range => 2,
+            ErrorType::Reference => 3,
+            ErrorType::Syntax => 4,
+            ErrorType::Type => 5,
+            ErrorType::Uri => 6,
+        };
+        self.error_protos.get(i).copied().unwrap_or(self.object_proto)
+    }
+
+    fn all(&self) -> Vec<ObjId> {
+        let mut v = vec![
+            self.object_proto,
+            self.function_proto,
+            self.array_proto,
+            self.string_proto,
+            self.number_proto,
+            self.boolean_proto,
+            self.regexp_proto,
+            self.eval,
+            self.throw_type_error,
+        ];
+        v.extend(self.error_protos);
+        v
+    }
+}
+
+pub(crate) struct Frame {
+    pub(crate) code: Rc<Code>,
+    pub(crate) pc: usize,
+    /// Where this frame's operands start on the operand stack.
+    base: usize,
+    env: EnvId,
+    var_env: EnvId,
+    /// `with` and catch environments entered and not yet left.
+    env_depth: u32,
+    this: Value,
+    callee: Option<ObjId>,
+    /// The object `new` made, returned unless the function returns an object.
+    construct: Option<ObjId>,
+    completion: Value,
+    /// Returning from this frame returns from the Rust call that pushed it.
+    boundary: bool,
+}
+
+/// Where the exception being thrown was raised: the code and the instruction.
+type ThrowSite = (Rc<Code>, usize);
+
+pub(crate) struct Interp {
+    pub(crate) heap: Heap,
+    pub(crate) stack: Vec<Value>,
+    pub(crate) frames: Vec<Frame>,
+    /// Values native code holds while it may run JavaScript.
+    pub(crate) temp_roots: Vec<Value>,
+    pub(crate) global: ObjId,
+    pub(crate) global_env: EnvId,
+    pub(crate) intrinsics: Intrinsics,
+    pub(crate) limits: Limits,
+    pub(crate) options: Options,
+    pub(crate) fuel: u64,
+    pub(crate) interrupt: Arc<AtomicBool>,
+    pub(crate) reentry: usize,
+    gc_threshold: usize,
+    /// UTF-16 code units of source parsed in this run, for [`Options::max_source_units`].
+    pub(crate) source_units: usize,
+    pub(crate) throw_site: Option<ThrowSite>,
+    /// The last exception a run did not catch.
+    pub(crate) last_thrown: Value,
+}
+
+/// The least heap size a collection waits for.
+const MIN_GC_BYTES: usize = 1 << 20;
+
+/// The most arguments `Function.prototype.apply` passes.
+pub(crate) const MAX_APPLY_ARGS: usize = 1 << 16;
+
+/// The estimated bytes of a name's entries in the list and the set `for-in` builds.
+const KEY_ENTRY_BYTES: usize = 32;
+
+/// The estimated bytes of the index names `0` to `len - 1` while `for-in` lists them.
+fn index_keys_bytes(len: usize) -> usize {
+    let mut total = 0usize;
+    let (mut lo, mut hi, mut digits) = (0usize, 10usize, 1usize);
+    while lo < len {
+        let count = hi.min(len) - lo;
+        total = total.saturating_add(count.saturating_mul(string_bytes(digits) + KEY_ENTRY_BYTES));
+        lo = hi;
+        hi = hi.saturating_mul(10);
+        digits += 1;
+    }
+    total
+}
+
+/// The estimated bytes of a binding or property named by `len` code units.
+fn binding_bytes(len: usize) -> usize {
+    PROP_BYTES + string_bytes(len)
+}
+
+/// At least the bytes that a function object made from `code` adds to the heap: the function,
+/// its prototype object, their properties and the environment holding a function expression's
+/// own name.
+fn closure_bytes(code: &Code) -> usize {
+    let props = if code.strict { 5 } else { 3 };
+    let named = code.self_name.as_ref().map_or(0, |n| ENV_BYTES + binding_bytes(n.len()));
+    2 * OBJECT_BYTES + props * binding_bytes("constructor".len()) + named
+}
+
+/// At least the bytes that declaration binding instantiation (section 10.5) adds to the heap for
+/// the function declarations and variables of `code`.
+fn declaration_bytes(code: &Code) -> usize {
+    let funs = code.fun_decls.iter().fold(0usize, |total, (name, fi)| {
+        let closure = code.functions.get(*fi as usize).map_or(0, |f| closure_bytes(f));
+        total.saturating_add(binding_bytes(name.len()) + closure)
+    });
+    code.vars.iter().fold(funs, |total, v| total.saturating_add(binding_bytes(v.len())))
+}
+
+/// A call to a function written in JavaScript, ready to enter.
+struct Entry {
+    callee: ObjId,
+    code: Rc<Code>,
+    env: EnvId,
+    this: Value,
+    args: Vec<Value>,
+}
+
+/// What a call resolved to.
+enum Prepared {
+    Closure(Entry),
+    Done(Value),
+}
+
+/// A variable found in the environment chain.
+enum Resolved {
+    Decl(EnvId),
+    Obj { object: ObjId, with_this: bool },
+    Unresolved,
+}
+
+/// A reference base as an operand: a declarative environment's index as a number, a binding
+/// object as itself, and an unresolvable reference as `undefined`. The environment stays
+/// reachable through the frame's environment chain while the operand is on the stack.
+fn resolved_to_value(r: &Resolved) -> Value {
+    match r {
+        Resolved::Decl(e) => Value::Number(f64::from(e.0)),
+        Resolved::Obj { object, .. } => Value::Object(*object),
+        Resolved::Unresolved => Value::Undefined,
+    }
+}
+
+fn value_to_resolved(v: &Value) -> JsResult<Resolved> {
+    match v {
+        #[allow(clippy::cast_possible_truncation, clippy::cast_sign_loss)]
+        Value::Number(n) if *n >= 0.0 && *n <= f64::from(u32::MAX) && n.fract() == 0.0 => Ok(Resolved::Decl(EnvId(*n as u32))),
+        Value::Object(object) => Ok(Resolved::Obj { object: *object, with_this: false }),
+        Value::Undefined => Ok(Resolved::Unresolved),
+        _ => internal("not a reference base"),
+    }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Hint {
+    Default,
+    Number,
+    String,
+}
+
+fn is(k: &[u16], s: &str) -> bool {
+    k.len() == s.len() && k.iter().zip(s.bytes()).all(|(&a, b)| a == u16::from(b))
+}
+
+impl Interp {
+    pub(crate) fn new(options: Options, limits: Limits) -> Self {
+        let mut heap = Heap::default();
+        let global = heap.alloc_object(Object::new(Class::Ordinary, None));
+        let global_env = heap.alloc_env(Env::Obj { object: global, with_this: false, outer: None });
+        let mut interp = Self {
+            heap,
+            stack: Vec::new(),
+            frames: Vec::new(),
+            temp_roots: Vec::new(),
+            global,
+            global_env,
+            intrinsics: Intrinsics::placeholder(),
+            fuel: limits.fuel,
+            limits,
+            options,
+            interrupt: Arc::new(AtomicBool::new(false)),
+            reentry: 0,
+            gc_threshold: MIN_GC_BYTES,
+            source_units: 0,
+            throw_site: None,
+            last_thrown: Value::Undefined,
+        };
+        crate::builtins::install(&mut interp);
+        interp.gc_threshold = interp.next_threshold();
+        interp
+    }
+
+    fn next_threshold(&self) -> usize {
+        (self.heap.bytes.saturating_mul(2)).max(MIN_GC_BYTES).min(self.limits.heap_bytes)
+    }
+
+    /// Recomputes when the next collection runs, after the limits change.
+    pub(crate) fn reset_gc_threshold(&mut self) {
+        self.gc_threshold = self.next_threshold();
+    }
+
+    // ---- errors ----
+
+    pub(crate) fn error_object(&mut self, t: ErrorType, message: &str) -> ObjId {
+        let proto = self.intrinsics.error_proto(t);
+        let mut o = Object::new(Class::Error, Some(proto));
+        if !message.is_empty() {
+            o.props.insert(key("message"), Prop::Data { value: Value::str(message), flags: HIDDEN });
+        }
+        self.heap.alloc_object(o)
+    }
+
+    pub(crate) fn throw(&mut self, t: ErrorType, message: &str) -> Abrupt {
+        Abrupt::Throw(Value::Object(self.error_object(t, message)))
+    }
+
+    pub(crate) fn type_error(&mut self, message: &str) -> Abrupt {
+        self.throw(ErrorType::Type, message)
+    }
+
+    // ---- the operand stack ----
+
+    fn push(&mut self, v: Value) -> JsResult<()> {
+        self.stack.push(v);
+        Ok(())
+    }
+
+    fn frame(&self) -> JsResult<&Frame> {
+        self.frames.last().ok_or_else(|| Abrupt::Internal("no frame".into()))
+    }
+
+    fn frame_mut(&mut self) -> JsResult<&mut Frame> {
+        self.frames.last_mut().ok_or_else(|| Abrupt::Internal("no frame".into()))
+    }
+
+    fn base(&self) -> usize {
+        self.frames.last().map_or(0, |f| f.base)
+    }
+
+    fn pop(&mut self) -> JsResult<Value> {
+        if self.stack.len() <= self.base() {
+            return internal("operand stack underflow");
+        }
+        self.stack.pop().ok_or_else(|| Abrupt::Internal("operand stack underflow".into()))
+    }
+
+    /// The value `n` places below the top (0 is the top).
+    fn peek(&self, n: usize) -> JsResult<Value> {
+        let len = self.stack.len();
+        match len.checked_sub(n + 1).filter(|&i| i >= self.base()) {
+            Some(i) => self.stack.get(i).cloned().ok_or_else(|| Abrupt::Internal("operand stack underflow".into())),
+            None => internal("operand stack underflow"),
+        }
+    }
+
+    fn drop_n(&mut self, n: usize) -> JsResult<()> {
+        let len = self.stack.len();
+        match len.checked_sub(n).filter(|&i| i >= self.base()) {
+            Some(i) => {
+                self.stack.truncate(i);
+                Ok(())
+            }
+            None => internal("operand stack underflow"),
+        }
+    }
+
+    /// Replaces the top `n` values with `v`.
+    fn replace(&mut self, n: usize, v: Value) -> JsResult<()> {
+        self.drop_n(n)?;
+        self.push(v)
+    }
+
+    // ---- running ----
+
+    /// Takes a unit of fuel and checks the interrupt flag.
+    pub(crate) fn use_fuel(&mut self) -> JsResult<()> {
+        if self.fuel == 0 {
+            return Err(Abrupt::Limit(LimitKind::Fuel));
+        }
+        self.fuel -= 1;
+        if self.interrupt.load(Ordering::Relaxed) {
+            return Err(Abrupt::Limit(LimitKind::Interrupted));
+        }
+        Ok(())
+    }
+
+    fn tick(&mut self) -> JsResult<()> {
+        self.use_fuel()?;
+        if self.heap.bytes > self.gc_threshold {
+            self.collect_garbage();
+            if self.heap.bytes > self.limits.heap_bytes {
+                return Err(Abrupt::Limit(LimitKind::Heap));
+            }
+            self.gc_threshold = self.next_threshold();
+        }
+        Ok(())
+    }
+
+    /// Ends the run with the heap limit when `bytes` more would not fit in it after a
+    /// collection. Everything the caller still needs must be reachable from the roots.
+    pub(crate) fn reserve_heap(&mut self, bytes: usize) -> JsResult<()> {
+        if self.heap.bytes.saturating_add(bytes) <= self.limits.heap_bytes {
+            return Ok(());
+        }
+        self.collect_garbage();
+        self.gc_threshold = self.next_threshold();
+        if self.heap.bytes.saturating_add(bytes) > self.limits.heap_bytes {
+            return Err(Abrupt::Limit(LimitKind::Heap));
+        }
+        Ok(())
+    }
+
+    /// Charges code compiled at run time to the heap, reserving its estimated size and `extra`
+    /// more first. The code is not reachable from the roots yet, so a collection here leaves it
+    /// out of the live total and the charge adds it.
+    pub(crate) fn charge_code(&mut self, code: &Code, extra: usize) -> JsResult<()> {
+        let bytes = code_bytes(code);
+        self.reserve_heap(bytes.saturating_add(extra))?;
+        self.heap.bytes = self.heap.bytes.saturating_add(bytes);
+        Ok(())
+    }
+
+    pub(crate) fn collect_garbage(&mut self) {
+        let mut roots = Roots::default();
+        roots.values.extend(self.stack.iter());
+        roots.values.extend(self.temp_roots.iter());
+        roots.values.push(&self.last_thrown);
+        for f in &self.frames {
+            roots.values.push(&f.this);
+            roots.values.push(&f.completion);
+            roots.objects.extend(f.callee.iter().chain(f.construct.iter()));
+            roots.envs.push(f.env);
+            roots.envs.push(f.var_env);
+            roots.codes.push(&f.code);
+        }
+        roots.objects.push(self.global);
+        roots.objects.extend(self.intrinsics.all());
+        roots.envs.push(self.global_env);
+        self.heap.collect(&roots);
+    }
+
+    /// Runs frames until the boundary frame on top returns, and returns its value.
+    pub(crate) fn execute(&mut self) -> JsResult<Value> {
+        loop {
+            match self.step() {
+                Ok(Some(v)) => return Ok(v),
+                Ok(None) => {}
+                Err(Abrupt::Throw(v)) => self.unwind(v)?,
+                Err(other) => {
+                    self.note_site();
+                    self.abort_to_boundary();
+                    return Err(other);
+                }
+            }
+        }
+    }
+
+    fn step(&mut self) -> JsResult<Option<Value>> {
+        self.tick()?;
+        let frame = self.frame_mut()?;
+        let Some(&op) = frame.code.ops.get(frame.pc) else { return internal("ran past the end of the code") };
+        frame.pc += 1;
+        match op {
+            Op::Return => {
+                let v = self.pop()?;
+                self.return_value(v)
+            }
+            Op::ReturnCompletion => {
+                let v = self.frame()?.completion.clone();
+                self.return_value(v)
+            }
+            _ => self.exec(op).map(|()| None),
+        }
+    }
+
+    fn note_site(&mut self) {
+        if self.throw_site.is_none()
+            && let Some(f) = self.frames.last()
+        {
+            self.throw_site = Some((f.code.clone(), f.pc.saturating_sub(1)));
+        }
+    }
+
+    /// Finds the handler for an exception: in the top frame, or in the frames below it up to the
+    /// boundary frame. Returns the exception when no handler takes it before the boundary frame.
+    fn unwind(&mut self, v: Value) -> JsResult<()> {
+        self.note_site();
+        loop {
+            let Some(frame) = self.frames.last_mut() else { return Err(Abrupt::Throw(v)) };
+            if let Some(h) = frame.code.handler(frame.pc.saturating_sub(1)) {
+                let target_len = frame.base + h.depth as usize;
+                while frame.env_depth > h.env_depth {
+                    let outer = self.heap.env(frame.env).and_then(Env::outer);
+                    let Some(outer) = outer else { return internal("environment chain ended early") };
+                    frame.env = outer;
+                    frame.env_depth -= 1;
+                }
+                frame.pc = h.target as usize;
+                if self.stack.len() < target_len {
+                    return internal("handler stack deeper than the stack");
+                }
+                self.stack.truncate(target_len);
+                self.stack.push(v);
+                self.throw_site = None;
+                return Ok(());
+            }
+            let Some(frame) = self.frames.pop() else { return Err(Abrupt::Throw(v)) };
+            self.stack.truncate(frame.base);
+            if frame.boundary {
+                return Err(Abrupt::Throw(v));
+            }
+        }
+    }
+
+    fn abort_to_boundary(&mut self) {
+        while let Some(frame) = self.frames.pop() {
+            self.stack.truncate(frame.base);
+            if frame.boundary {
+                break;
+            }
+        }
+    }
+
+    fn return_value(&mut self, v: Value) -> JsResult<Option<Value>> {
+        let Some(frame) = self.frames.pop() else { return internal("return without a frame") };
+        self.stack.truncate(frame.base);
+        let v = match frame.construct {
+            Some(o) if !matches!(v, Value::Object(_)) => Value::Object(o),
+            _ => v,
+        };
+        if frame.boundary {
+            return Ok(Some(v));
+        }
+        self.push(v)?;
+        Ok(None)
+    }
+
+    fn jump_to(&mut self, target: u32) -> JsResult<()> {
+        self.frame_mut()?.pc = target as usize;
+        Ok(())
+    }
+
+    fn name(&self, i: u32) -> JsResult<Key> {
+        self.frame()?.code.names.get(i as usize).cloned().ok_or_else(|| Abrupt::Internal("name out of range".into()))
+    }
+
+    fn strict(&self) -> bool {
+        self.frames.last().is_some_and(|f| f.code.strict)
+    }
+
+    fn exec(&mut self, op: Op) -> JsResult<()> {
+        match op {
+            Op::Undefined => self.push(Value::Undefined),
+            Op::Null => self.push(Value::Null),
+            Op::True => self.push(Value::Bool(true)),
+            Op::False => self.push(Value::Bool(false)),
+            Op::Number(i) => {
+                let n = self.frame()?.code.numbers.get(i as usize).copied();
+                self.push(Value::Number(n.unwrap_or(f64::NAN)))
+            }
+            Op::String(i) => {
+                let s = self.frame()?.code.strings.get(i as usize).cloned();
+                self.push(s.map_or(Value::Undefined, Value::String))
+            }
+            Op::This => {
+                let this = self.frame()?.this.clone();
+                self.push(this)
+            }
+            Op::Pop => self.pop().map(drop),
+            Op::PopUnder(n) => self.op_pop_under(n),
+            Op::Dup => self.op_dup(1),
+            Op::Dup2 => self.op_dup(2),
+            Op::Swap => self.op_swap(),
+            Op::Rot3 => self.op_rot3(),
+            Op::GetVar(n) => self.op_get_var(n, false),
+            Op::GetVarThis(n) => self.op_get_var(n, true),
+            Op::SetVar(n) => self.op_set_var(n),
+            Op::RefVar(n) => self.op_ref_var(n),
+            Op::GetRef(n) => self.op_get_ref(n),
+            Op::PutRef(n) => self.op_put_ref(n),
+            Op::TypeofVar(n) => self.op_typeof_var(n),
+            Op::DeleteVar(n) => self.op_delete_var(n),
+            Op::IncVar { name, prefix, dec } => self.op_inc_var(name, prefix, dec),
+            Op::GetMember(n) => self.op_get_member(n, false),
+            Op::GetMemberThis(n) => self.op_get_member(n, true),
+            Op::SetMember(n) => self.op_set_member(n),
+            Op::DeleteMember(n) => self.op_delete_member(n),
+            Op::IncMember { name, prefix, dec } => self.op_inc_member(name, prefix, dec),
+            Op::ToKey => self.op_to_key(),
+            Op::CheckObject => self.op_check_object(),
+            Op::GetIndex => self.op_get_index(false),
+            Op::GetIndexThis => self.op_get_index(true),
+            Op::SetIndex => self.op_set_index(),
+            Op::DeleteIndex => self.op_delete_index(),
+            Op::IncIndex { prefix, dec } => self.op_inc_index(prefix, dec),
+            Op::Call(n) => self.op_call(n, false),
+            Op::CallEval(n) => self.op_call(n, true),
+            Op::New(n) => self.op_new(n),
+            Op::Binary(b) => self.op_binary(b),
+            Op::Neg | Op::Plus | Op::BitNot | Op::Not | Op::Typeof | Op::ToNumber => self.op_unary(op),
+            Op::Jump(t) => self.jump_to(t),
+            Op::JumpIfFalse(t) | Op::JumpIfTrue(t) => self.op_branch(t, matches!(op, Op::JumpIfTrue(_)), false),
+            Op::JumpIfFalseKeep(t) | Op::JumpIfTrueKeep(t) => self.op_branch(t, matches!(op, Op::JumpIfTrueKeep(_)), true),
+            Op::Throw => Err(Abrupt::Throw(self.pop()?)),
+            Op::ThrowReferenceError(i) => self.op_throw_reference_error(i),
+            Op::EndFinally(t) => self.op_end_finally(t),
+            Op::NewObject => self.op_new_object(),
+            Op::NewArray => self.op_new_array(),
+            Op::ArrayPush => self.op_array_push(true),
+            Op::ArrayHole => self.op_array_push(false),
+            Op::InitProp(n) => self.op_init_prop(n),
+            Op::InitGetter(n) => self.op_init_accessor(n, true),
+            Op::InitSetter(n) => self.op_init_accessor(n, false),
+            Op::Closure(i) => self.op_closure(i),
+            Op::RegExp(i) => self.op_regexp(i),
+            Op::PushWith => self.op_push_with(),
+            Op::PushCatch(n) => self.op_push_catch(n),
+            Op::PopEnv => self.op_pop_env(),
+            Op::ForInStart => self.op_for_in_start(),
+            Op::ForInNext(t) => self.op_for_in_next(t),
+            Op::SetCompletion => {
+                let v = self.pop()?;
+                self.frame_mut()?.completion = v;
+                Ok(())
+            }
+            Op::GetCompletion => {
+                let v = self.frame()?.completion.clone();
+                self.push(v)
+            }
+            Op::Return | Op::ReturnCompletion => internal("return reached the dispatcher"),
+        }
+    }
+
+    // ---- stack operations ----
+
+    fn op_pop_under(&mut self, n: u32) -> JsResult<()> {
+        let top = self.pop()?;
+        self.drop_n(n as usize)?;
+        self.push(top)
+    }
+
+    fn op_dup(&mut self, n: usize) -> JsResult<()> {
+        for _ in 0..n {
+            let v = self.peek(n - 1)?;
+            self.push(v)?;
+        }
+        Ok(())
+    }
+
+    fn op_swap(&mut self) -> JsResult<()> {
+        let b = self.pop()?;
+        let a = self.pop()?;
+        self.push(b)?;
+        self.push(a)
+    }
+
+    fn op_rot3(&mut self) -> JsResult<()> {
+        let c = self.pop()?;
+        let b = self.pop()?;
+        let a = self.pop()?;
+        self.push(b)?;
+        self.push(c)?;
+        self.push(a)
+    }
+
+    fn op_branch(&mut self, target: u32, when: bool, keep: bool) -> JsResult<()> {
+        let v = self.peek(0)?;
+        let jump = v.truthy() == when;
+        if !(keep && jump) {
+            self.pop()?;
+        }
+        if jump { self.jump_to(target) } else { Ok(()) }
+    }
+
+    fn op_throw_reference_error(&mut self, i: u32) -> JsResult<()> {
+        let message = self.frame()?.code.strings.get(i as usize).map(Str::to_rust_string).unwrap_or_default();
+        Err(self.throw(ErrorType::Reference, &message))
+    }
+
+    fn op_end_finally(&mut self, table: u32) -> JsResult<()> {
+        let Value::Number(kind) = self.pop()? else { return internal("finally kind is not a number") };
+        if kind == 0.0 {
+            return self.pop().map(drop);
+        }
+        if kind == 1.0 {
+            return Err(Abrupt::Throw(self.pop()?));
+        }
+        let k = (kind - 2.0) as usize;
+        let target = self.frame()?.code.finally_tables.get(table as usize).and_then(|t| t.get(k)).copied();
+        match target {
+            Some(t) => self.jump_to(t),
+            None => internal("finally exit out of range"),
+        }
+    }
+
+    // ---- variables ----
+
+    fn resolve(&self, name: &[u16]) -> JsResult<Resolved> {
+        let mut cur = Some(self.frame()?.env);
+        while let Some(e) = cur {
+            match self.heap.env(e) {
+                Some(Env::Decl { bindings, outer }) => {
+                    if bindings.contains(name) {
+                        return Ok(Resolved::Decl(e));
+                    }
+                    cur = *outer;
+                }
+                Some(Env::Obj { object, with_this, outer }) => {
+                    if self.has_property(*object, name)? {
+                        return Ok(Resolved::Obj { object: *object, with_this: *with_this });
+                    }
+                    cur = *outer;
+                }
+                None => return internal("environment out of range"),
+            }
+        }
+        Ok(Resolved::Unresolved)
+    }
+
+    fn binding_value(&self, env: EnvId, name: &[u16]) -> JsResult<Value> {
+        match self.heap.env(env) {
+            Some(Env::Decl { bindings, .. }) => Ok(bindings.get(name).map_or(Value::Undefined, |b| b.value.clone())),
+            _ => internal("not a declarative environment"),
+        }
+    }
+
+    fn not_defined(&mut self, name: &[u16]) -> Abrupt {
+        let message = format!("{} is not defined", String::from_utf16_lossy(name));
+        self.throw(ErrorType::Reference, &message)
+    }
+
+    fn get_var(&mut self, name: &Key) -> JsResult<(Value, Value)> {
+        let r = self.resolve(name)?;
+        self.get_resolved(r, name)
+    }
+
+    /// GetValue of a reference whose base was resolved earlier (section 8.7.1).
+    fn get_resolved(&mut self, r: Resolved, name: &Key) -> JsResult<(Value, Value)> {
+        match r {
+            Resolved::Decl(e) => Ok((self.binding_value(e, name)?, Value::Undefined)),
+            Resolved::Obj { object, with_this } => {
+                let v = self.get_from(object, name, &Value::Object(object))?;
+                Ok((v, if with_this { Value::Object(object) } else { Value::Undefined }))
+            }
+            Resolved::Unresolved => Err(self.not_defined(name)),
+        }
+    }
+
+    fn set_var(&mut self, name: &Key, v: Value) -> JsResult<()> {
+        let r = self.resolve(name)?;
+        self.set_resolved(r, name, v)
+    }
+
+    /// PutValue of a reference whose base was resolved earlier (section 8.7.2).
+    fn set_resolved(&mut self, r: Resolved, name: &Key, v: Value) -> JsResult<()> {
+        let strict = self.strict();
+        match r {
+            Resolved::Decl(e) => {
+                let Some(Env::Decl { bindings, .. }) = self.heap.env_mut(e) else { return internal("not a declarative environment") };
+                match bindings.get_mut(name) {
+                    Some(b) if b.mutable => {
+                        b.value = v;
+                        Ok(())
+                    }
+                    _ if strict => Err(self.type_error("assignment to a constant binding")),
+                    _ => Ok(()),
+                }
+            }
+            Resolved::Obj { object, .. } => self.put(object, name.clone(), v, strict),
+            Resolved::Unresolved if strict => Err(self.not_defined(name)),
+            Resolved::Unresolved => {
+                let global = self.global;
+                self.put(global, name.clone(), v, false)
+            }
+        }
+    }
+
+    fn op_get_var(&mut self, n: u32, with_this: bool) -> JsResult<()> {
+        let name = self.name(n)?;
+        let (v, this) = self.get_var(&name)?;
+        self.push(v)?;
+        if with_this { self.push(this) } else { Ok(()) }
+    }
+
+    fn op_set_var(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = self.peek(0)?;
+        self.set_var(&name, v)
+    }
+
+    fn op_typeof_var(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = match self.resolve(&name)? {
+            Resolved::Unresolved => Value::Undefined,
+            _ => self.get_var(&name)?.0,
+        };
+        let t = self.type_of(&v);
+        self.push(Value::str(t))
+    }
+
+    fn op_delete_var(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let result = match self.resolve(&name)? {
+            Resolved::Unresolved => true,
+            Resolved::Decl(e) => match self.heap.env_mut(e) {
+                Some(Env::Decl { bindings, .. }) => {
+                    if bindings.get(&name).is_some_and(|b| b.deletable) {
+                        bindings.remove(&name);
+                        true
+                    } else {
+                        false
+                    }
+                }
+                _ => return internal("not a declarative environment"),
+            },
+            Resolved::Obj { object, .. } => self.delete(object, &name, false)?,
+        };
+        self.push(Value::Bool(result))
+    }
+
+    fn op_inc_var(&mut self, n: u32, prefix: bool, dec: bool) -> JsResult<()> {
+        let name = self.name(n)?;
+        let r = self.resolve(&name)?;
+        let base = resolved_to_value(&r);
+        let (v, _) = self.get_resolved(r, &name)?;
+        // The base stays on the stack, where the collector sees it, while ToNumber runs script.
+        self.push(base)?;
+        let old = self.to_number(&v)?;
+        let base = self.pop()?;
+        let new = if dec { old - 1.0 } else { old + 1.0 };
+        self.set_resolved(value_to_resolved(&base)?, &name, Value::Number(new))?;
+        self.push(Value::Number(if prefix { new } else { old }))
+    }
+
+    /// Resolves a variable before the right-hand side of an assignment runs, and pushes the
+    /// reference's base.
+    fn op_ref_var(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let r = self.resolve(&name)?;
+        self.push(resolved_to_value(&r))
+    }
+
+    /// Replaces the reference base on top of the stack with the variable's value.
+    fn op_get_ref(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let base = self.peek(0)?;
+        let (v, _) = self.get_resolved(value_to_resolved(&base)?, &name)?;
+        self.pop()?;
+        self.push(v)
+    }
+
+    /// Stores the value on top of the stack through the reference base under it, and leaves the
+    /// value.
+    fn op_put_ref(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.set_resolved(value_to_resolved(&base)?, &name, v)?;
+        let v = self.pop()?;
+        self.pop()?;
+        self.push(v)
+    }
+
+    // ---- properties ----
+
+    fn object(&self, id: ObjId) -> JsResult<&Object> {
+        self.heap.object(id).ok_or_else(|| Abrupt::Internal("object out of range".into()))
+    }
+
+    fn object_mut(&mut self, id: ObjId) -> JsResult<&mut Object> {
+        self.heap.object_mut(id).ok_or_else(|| Abrupt::Internal("object out of range".into()))
+    }
+
+    /// [[GetOwnProperty]] (section 8.12.1, with the special cases of arrays, strings and
+    /// arguments objects).
+    pub(crate) fn get_own_property(&self, id: ObjId, k: &[u16]) -> JsResult<Option<Prop>> {
+        let o = self.object(id)?;
+        match &o.class {
+            Class::Array { length, length_writable } if is(k, "length") => {
+                return Ok(Some(Prop::Data { value: Value::Number(f64::from(*length)), flags: if *length_writable { WRITABLE } else { 0 } }));
+            }
+            Class::String(s) => {
+                if is(k, "length") {
+                    return Ok(Some(Prop::Data { value: Value::Number(s.len() as f64), flags: 0 }));
+                }
+                if let Some(i) = array_index(k)
+                    && (i as usize) < s.len()
+                {
+                    let unit = s.flat().get(i as usize).copied().unwrap_or(0);
+                    return Ok(Some(Prop::Data { value: Value::String(Str::from_units(vec![unit])), flags: ENUMERABLE }));
+                }
+            }
+            Class::Arguments(map) => {
+                if let Some(name) = array_index(k).and_then(|i| map.names.get(i as usize)).and_then(Option::as_ref)
+                    && let Some(Prop::Data { flags, .. }) = o.props.get(k)
+                {
+                    let flags = *flags;
+                    return Ok(Some(Prop::Data { value: self.binding_value(map.env, name)?, flags }));
+                }
+            }
+            _ => {}
+        }
+        Ok(o.props.get(k).cloned())
+    }
+
+    /// [[GetProperty]]: the property found on the object or its prototype chain.
+    pub(crate) fn find_property(&self, id: ObjId, k: &[u16]) -> JsResult<Option<Prop>> {
+        let mut cur = Some(id);
+        let mut steps = 0usize;
+        while let Some(o) = cur {
+            if let Some(p) = self.get_own_property(o, k)? {
+                return Ok(Some(p));
+            }
+            cur = self.object(o)?.proto;
+            steps += 1;
+            if steps > 1_000_000 {
+                return internal("prototype chain too long");
+            }
+        }
+        Ok(None)
+    }
+
+    pub(crate) fn has_property(&self, id: ObjId, k: &[u16]) -> JsResult<bool> {
+        Ok(self.find_property(id, k)?.is_some())
+    }
+
+    /// [[Get]] starting at `start`, with `receiver` as `this` for a getter.
+    pub(crate) fn get_from(&mut self, start: ObjId, k: &[u16], receiver: &Value) -> JsResult<Value> {
+        match self.find_property(start, k)? {
+            None | Some(Prop::Accessor { get: None, .. }) => Ok(Value::Undefined),
+            Some(Prop::Data { value, .. }) => Ok(value),
+            Some(Prop::Accessor { get: Some(g), .. }) => self.call(&Value::Object(g), receiver, &[]),
+        }
+    }
+
+    /// The prototype a primitive's properties are looked up on.
+    fn primitive_proto(&mut self, v: &Value, k: &[u16]) -> JsResult<ObjId> {
+        match v {
+            Value::Object(o) => Ok(*o),
+            Value::String(_) => Ok(self.intrinsics.string_proto),
+            Value::Number(_) => Ok(self.intrinsics.number_proto),
+            Value::Bool(_) => Ok(self.intrinsics.boolean_proto),
+            Value::Undefined | Value::Null => {
+                let message = format!(
+                    "cannot read property '{}' of {}",
+                    String::from_utf16_lossy(k),
+                    if matches!(v, Value::Null) { "null" } else { "undefined" }
+                );
+                Err(self.type_error(&message))
+            }
+        }
+    }
+
+    /// `base[k]` for any value (GetValue, section 8.7.1).
+    pub(crate) fn get_value(&mut self, base: &Value, k: &[u16]) -> JsResult<Value> {
+        if let Value::String(s) = base {
+            if is(k, "length") {
+                return Ok(Value::Number(s.len() as f64));
+            }
+            if let Some(i) = array_index(k)
+                && (i as usize) < s.len()
+            {
+                let unit = s.flat().get(i as usize).copied().unwrap_or(0);
+                return Ok(Value::String(Str::from_units(vec![unit])));
+            }
+        }
+        let start = self.primitive_proto(base, k)?;
+        self.get_from(start, k, base)
+    }
+
+    /// Adds or replaces an own property directly, keeping the heap estimate.
+    pub(crate) fn define(&mut self, id: ObjId, k: Key, prop: Prop) -> JsResult<()> {
+        let o = self.object_mut(id)?;
+        let new = !o.props.contains(&k);
+        if let Class::Array { length, .. } = &mut o.class
+            && let Some(i) = array_index(&k)
+            && i >= *length
+        {
+            *length = i + 1;
+        }
+        let name_len = k.len();
+        o.props.insert(k, prop);
+        if new {
+            self.heap.bytes += PROP_BYTES + string_bytes(name_len);
+        }
+        Ok(())
+    }
+
+    fn reject(&mut self, throw: bool, k: &[u16], why: &str) -> JsResult<()> {
+        if throw {
+            let message = format!("cannot assign to property '{}': {why}", String::from_utf16_lossy(k));
+            return Err(self.type_error(&message));
+        }
+        Ok(())
+    }
+
+    /// [[Put]] (section 8.12.5).
+    pub(crate) fn put(&mut self, id: ObjId, k: Key, v: Value, throw: bool) -> JsResult<()> {
+        match self.get_own_property(id, &k)? {
+            Some(Prop::Data { flags, .. }) => {
+                if flags & WRITABLE == 0 {
+                    return self.reject(throw, &k, "it is read-only");
+                }
+                return self.write_own(id, k, v, throw);
+            }
+            Some(Prop::Accessor { set: Some(s), .. }) => return self.call(&Value::Object(s), &Value::Object(id), &[v]).map(drop),
+            Some(Prop::Accessor { set: None, .. }) => return self.reject(throw, &k, "it has only a getter"),
+            None => {}
+        }
+        let proto = self.object(id)?.proto;
+        match proto.map(|p| self.find_property(p, &k)).transpose()?.flatten() {
+            Some(Prop::Accessor { set: Some(s), .. }) => return self.call(&Value::Object(s), &Value::Object(id), &[v]).map(drop),
+            Some(Prop::Accessor { set: None, .. }) => return self.reject(throw, &k, "it has only a getter"),
+            Some(Prop::Data { flags, .. }) if flags & WRITABLE == 0 => return self.reject(throw, &k, "it is read-only"),
+            _ => {}
+        }
+        let o = self.object(id)?;
+        if !o.extensible {
+            return self.reject(throw, &k, "the object is not extensible");
+        }
+        if let Class::Array { length, length_writable: false } = o.class
+            && array_index(&k).is_some_and(|i| i >= length)
+        {
+            return self.reject(throw, &k, "the array's length is read-only");
+        }
+        self.define(id, k, Prop::Data { value: v, flags: OPEN })
+    }
+
+    /// Sets the value of an existing writable own data property.
+    fn write_own(&mut self, id: ObjId, k: Key, v: Value, throw: bool) -> JsResult<()> {
+        let o = self.object(id)?;
+        match &o.class {
+            Class::Array { .. } if is(&k, "length") => return self.set_array_length(id, &v, throw),
+            Class::Arguments(map) => {
+                if let Some(name) = array_index(&k).and_then(|i| map.names.get(i as usize)).and_then(Option::as_ref) {
+                    let (env, name) = (map.env, name.clone());
+                    if let Some(Env::Decl { bindings, .. }) = self.heap.env_mut(env)
+                        && let Some(b) = bindings.get_mut(&name)
+                    {
+                        b.value = v.clone();
+                    }
+                }
+            }
+            _ => {}
+        }
+        match self.object_mut(id)?.props.get_mut(&k) {
+            Some(Prop::Data { value, .. }) => {
+                *value = v;
+                Ok(())
+            }
+            _ => internal("own data property vanished"),
+        }
+    }
+
+    /// Assigning to an array's `length` (section 15.4.5.1).
+    fn set_array_length(&mut self, id: ObjId, v: &Value, throw: bool) -> JsResult<()> {
+        let n = self.to_number(v)?;
+        let new = to_uint32(n);
+        if f64::from(new) != n {
+            return Err(self.throw(ErrorType::Range, "invalid array length"));
+        }
+        let o = self.object(id)?;
+        let Class::Array { length: old, length_writable } = o.class else { return internal("not an array") };
+        if !length_writable {
+            return self.reject(throw, &key("length"), "it is read-only");
+        }
+        if new < old {
+            // Shrinking visits every property: each takes fuel before anything is removed.
+            for _ in 0..o.props.len() {
+                self.use_fuel()?;
+            }
+        }
+        let o = self.object_mut(id)?;
+        let Class::Array { length, .. } = &mut o.class else { return internal("not an array") };
+        *length = new;
+        if new < old {
+            let doomed: Vec<Key> = o.props.keys().into_iter().filter(|k| array_index(k).is_some_and(|i| i >= new)).collect();
+            for k in doomed {
+                o.props.remove(&k);
+            }
+        }
+        Ok(())
+    }
+
+    /// [[Delete]] (section 8.12.7).
+    pub(crate) fn delete(&mut self, id: ObjId, k: &[u16], throw: bool) -> JsResult<bool> {
+        match self.get_own_property(id, k)? {
+            None => Ok(true),
+            Some(p) if p.configurable() => {
+                let o = self.object_mut(id)?;
+                o.props.remove(k);
+                if let Class::Arguments(map) = &mut o.class
+                    && let Some(slot) = array_index(k).and_then(|i| map.names.get_mut(i as usize))
+                {
+                    *slot = None;
+                }
+                Ok(true)
+            }
+            Some(_) if throw => {
+                let message = format!("cannot delete property '{}'", String::from_utf16_lossy(k));
+                Err(self.type_error(&message))
+            }
+            Some(_) => Ok(false),
+        }
+    }
+
+    /// PutValue on a property reference (section 8.7.2), whose base may be a primitive.
+    fn put_value(&mut self, base: &Value, k: Key, v: Value) -> JsResult<()> {
+        let strict = self.strict();
+        match base {
+            Value::Object(o) => self.put(*o, k, v, strict),
+            Value::Undefined | Value::Null => {
+                let message = format!(
+                    "cannot set property '{}' of {}",
+                    String::from_utf16_lossy(&k),
+                    if matches!(base, Value::Null) { "null" } else { "undefined" }
+                );
+                Err(self.type_error(&message))
+            }
+            _ => {
+                let proto = self.primitive_proto(base, &k)?;
+                let own = matches!(base, Value::String(s) if is(&k, "length") || array_index(&k).is_some_and(|i| (i as usize) < s.len()));
+                if !own && let Some(Prop::Accessor { set: Some(s), .. }) = self.find_property(proto, &k)? {
+                    return self.call(&Value::Object(s), base, &[v]).map(drop);
+                }
+                self.reject(strict, &k, "the value is a primitive")
+            }
+        }
+    }
+
+    fn op_get_member(&mut self, n: u32, with_this: bool) -> JsResult<()> {
+        let name = self.name(n)?;
+        let base = self.peek(0)?;
+        let v = self.get_value(&base, &name)?;
+        self.replace(1, v)?;
+        if with_this { self.push(base) } else { Ok(()) }
+    }
+
+    fn op_set_member(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.put_value(&base, name, v.clone())?;
+        self.replace(2, v)
+    }
+
+    fn check_coercible(&mut self, base: &Value, k: &[u16]) -> JsResult<()> {
+        if base.is_nullish() {
+            self.primitive_proto(base, k)?;
+        }
+        Ok(())
+    }
+
+    fn op_check_object(&mut self) -> JsResult<()> {
+        let base = self.peek(0)?;
+        self.check_coercible(&base, &[])
+    }
+
+    fn op_to_key(&mut self) -> JsResult<()> {
+        let k = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.check_coercible(&base, &[])?;
+        let name = self.to_key(&k)?;
+        self.replace(1, Value::String(Str::from_rc(name)))
+    }
+
+    fn op_get_index(&mut self, with_this: bool) -> JsResult<()> {
+        let k = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.check_coercible(&base, &[])?;
+        let name = self.to_key(&k)?;
+        let v = self.get_value(&base, &name)?;
+        self.replace(2, v)?;
+        if with_this { self.push(base) } else { Ok(()) }
+    }
+
+    fn op_set_index(&mut self) -> JsResult<()> {
+        let v = self.peek(0)?;
+        let k = self.peek(1)?;
+        let base = self.peek(2)?;
+        let name = self.to_key(&k)?;
+        self.put_value(&base, name, v.clone())?;
+        self.replace(3, v)
+    }
+
+    fn op_delete_member(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let base = self.peek(0)?;
+        let o = self.to_object(&base)?;
+        let strict = self.strict();
+        let r = self.delete(o, &name, strict)?;
+        self.replace(1, Value::Bool(r))
+    }
+
+    fn op_delete_index(&mut self) -> JsResult<()> {
+        let k = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.check_coercible(&base, &[])?;
+        let name = self.to_key(&k)?;
+        let o = self.to_object(&base)?;
+        let strict = self.strict();
+        let r = self.delete(o, &name, strict)?;
+        self.replace(2, Value::Bool(r))
+    }
+
+    fn inc_property(&mut self, base: &Value, name: Key, prefix: bool, dec: bool) -> JsResult<Value> {
+        let v = self.get_value(base, &name)?;
+        let old = self.to_number(&v)?;
+        let new = if dec { old - 1.0 } else { old + 1.0 };
+        self.put_value(base, name, Value::Number(new))?;
+        Ok(Value::Number(if prefix { new } else { old }))
+    }
+
+    fn op_inc_member(&mut self, n: u32, prefix: bool, dec: bool) -> JsResult<()> {
+        let name = self.name(n)?;
+        let base = self.peek(0)?;
+        let r = self.inc_property(&base, name, prefix, dec)?;
+        self.replace(1, r)
+    }
+
+    fn op_inc_index(&mut self, prefix: bool, dec: bool) -> JsResult<()> {
+        let k = self.peek(0)?;
+        let base = self.peek(1)?;
+        self.check_coercible(&base, &[])?;
+        let name = self.to_key(&k)?;
+        let r = self.inc_property(&base, name, prefix, dec)?;
+        self.replace(2, r)
+    }
+
+    // ---- object literals and functions ----
+
+    fn op_new_object(&mut self) -> JsResult<()> {
+        let o = self.new_object();
+        self.push(Value::Object(o))
+    }
+
+    pub(crate) fn new_object(&mut self) -> ObjId {
+        let proto = self.intrinsics.object_proto;
+        self.heap.alloc_object(Object::new(Class::Ordinary, Some(proto)))
+    }
+
+    fn op_new_array(&mut self) -> JsResult<()> {
+        let proto = self.intrinsics.array_proto;
+        let a = self.heap.alloc_object(Object::new(Class::Array { length: 0, length_writable: true }, Some(proto)));
+        self.push(Value::Object(a))
+    }
+
+    fn op_array_push(&mut self, with_value: bool) -> JsResult<()> {
+        let v = if with_value { Some(self.pop()?) } else { None };
+        let Value::Object(a) = self.peek(0)? else { return internal("array literal is not an object") };
+        let o = self.object_mut(a)?;
+        let Class::Array { length, .. } = &mut o.class else { return internal("array literal is not an array") };
+        let i = *length;
+        if i == u32::MAX - 1 {
+            return Err(self.throw(ErrorType::Range, "array literal too long"));
+        }
+        *length = i + 1;
+        match v {
+            Some(v) => self.define(a, index_key(i), Prop::Data { value: v, flags: OPEN }),
+            None => Ok(()),
+        }
+    }
+
+    fn op_init_prop(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = self.pop()?;
+        let Value::Object(o) = self.peek(0)? else { return internal("object literal is not an object") };
+        self.define(o, name, Prop::Data { value: v, flags: OPEN })
+    }
+
+    fn op_init_accessor(&mut self, n: u32, getter: bool) -> JsResult<()> {
+        let name = self.name(n)?;
+        let Value::Object(f) = self.pop()? else { return internal("accessor is not a function") };
+        let Value::Object(o) = self.peek(0)? else { return internal("object literal is not an object") };
+        let (mut get, mut set) = match self.object(o)?.props.get(&name) {
+            Some(Prop::Accessor { get, set, .. }) => (*get, *set),
+            _ => (None, None),
+        };
+        if getter {
+            get = Some(f);
+        } else {
+            set = Some(f);
+        }
+        self.define(o, name, Prop::Accessor { get, set, flags: ENUMERABLE | CONFIGURABLE })
+    }
+
+    fn op_closure(&mut self, i: u32) -> JsResult<()> {
+        let frame = self.frame()?;
+        let env = frame.env;
+        let Some(code) = frame.code.functions.get(i as usize).cloned() else { return internal("function out of range") };
+        let f = self.make_closure(code, env)?;
+        self.push(Value::Object(f))
+    }
+
+    /// A function object for `code` closing over `env` (section 13.2).
+    pub(crate) fn make_closure(&mut self, code: Rc<Code>, env: EnvId) -> JsResult<ObjId> {
+        let env = match &code.self_name {
+            Some(_) => self.heap.alloc_env(Env::Decl { bindings: PropMap::default(), outer: Some(env) }),
+            None => env,
+        };
+        let proto = self.intrinsics.function_proto;
+        let params = code.params.len();
+        let strict = code.strict;
+        let self_name = code.self_name.clone();
+        let f = self.heap.alloc_object(Object::new(Class::Function(Func::Closure { code, env }), Some(proto)));
+        self.define(f, key("length"), Prop::Data { value: Value::Number(params as f64), flags: 0 })?;
+        let p = self.new_object();
+        self.define(p, key("constructor"), Prop::Data { value: Value::Object(f), flags: HIDDEN })?;
+        self.define(f, key("prototype"), Prop::Data { value: Value::Object(p), flags: WRITABLE })?;
+        if strict {
+            let thrower = Some(self.intrinsics.throw_type_error);
+            for name in ["caller", "arguments"] {
+                self.define(f, key(name), Prop::Accessor { get: thrower, set: thrower, flags: 0 })?;
+            }
+        }
+        if let Some(name) = self_name {
+            self.env_insert(env, name, Binding { value: Value::Object(f), mutable: false, deletable: false })?;
+        }
+        Ok(f)
+    }
+
+    fn env_insert(&mut self, env: EnvId, name: Key, b: Binding) -> JsResult<()> {
+        let Some(Env::Decl { bindings, .. }) = self.heap.env_mut(env) else { return internal("not a declarative environment") };
+        let new = !bindings.contains(&name);
+        let name_len = name.len();
+        bindings.insert(name, b);
+        if new {
+            self.heap.bytes += PROP_BYTES + string_bytes(name_len);
+        }
+        Ok(())
+    }
+
+    fn op_regexp(&mut self, i: u32) -> JsResult<()> {
+        let Some((source, flags)) = self.frame()?.code.regexps.get(i as usize).cloned() else { return internal("regular expression out of range") };
+        let proto = self.intrinsics.regexp_proto;
+        let r = self.heap.alloc_object(Object::new(Class::RegExp, Some(proto)));
+        let flag_units = flags.flat();
+        let has = |c: u8| flag_units.contains(&u16::from(c));
+        let (g, i_, m) = (has(b'g'), has(b'i'), has(b'm'));
+        self.define(r, key("source"), Prop::Data { value: Value::String(source), flags: 0 })?;
+        self.define(r, key("global"), Prop::Data { value: Value::Bool(g), flags: 0 })?;
+        self.define(r, key("ignoreCase"), Prop::Data { value: Value::Bool(i_), flags: 0 })?;
+        self.define(r, key("multiline"), Prop::Data { value: Value::Bool(m), flags: 0 })?;
+        self.define(r, key("lastIndex"), Prop::Data { value: Value::Number(0.0), flags: WRITABLE })?;
+        self.push(Value::Object(r))
+    }
+
+    // ---- environments ----
+
+    fn op_push_with(&mut self) -> JsResult<()> {
+        let v = self.peek(0)?;
+        let object = self.to_object(&v)?;
+        self.pop()?;
+        let outer = self.frame()?.env;
+        let env = self.heap.alloc_env(Env::Obj { object, with_this: true, outer: Some(outer) });
+        let frame = self.frame_mut()?;
+        frame.env = env;
+        frame.env_depth += 1;
+        Ok(())
+    }
+
+    fn op_push_catch(&mut self, n: u32) -> JsResult<()> {
+        let name = self.name(n)?;
+        let v = self.pop()?;
+        let outer = self.frame()?.env;
+        let mut bindings = PropMap::default();
+        let name_bytes = string_bytes(name.len());
+        bindings.insert(name, Binding { value: v, mutable: true, deletable: false });
+        let env = self.heap.alloc_env(Env::Decl { bindings, outer: Some(outer) });
+        self.heap.bytes += name_bytes;
+        let frame = self.frame_mut()?;
+        frame.env = env;
+        frame.env_depth += 1;
+        Ok(())
+    }
+
+    fn op_pop_env(&mut self) -> JsResult<()> {
+        let env = self.frame()?.env;
+        let Some(outer) = self.heap.env(env).and_then(Env::outer) else { return internal("left the outermost environment") };
+        let frame = self.frame_mut()?;
+        if frame.env_depth == 0 {
+            return internal("left more environments than were entered");
+        }
+        frame.env = outer;
+        frame.env_depth -= 1;
+        Ok(())
+    }
+
+    // ---- for-in ----
+
+    /// The names `for-in` visits (section 12.6.4): the enumerable properties of the object and
+    /// its prototypes, own properties in the order they were added, each name once, and none
+    /// that an object nearer the start of the chain has (enumerable or not).
+    ///
+    /// For a String object, the heap budget for all its index names is checked before any is
+    /// built. Each index name and each property visited takes a unit of fuel.
+    fn enumerable_keys(&mut self, id: ObjId) -> JsResult<Vec<Key>> {
+        let mut seen = std::collections::HashSet::new();
+        let mut out = Vec::new();
+        let mut cur = Some(id);
+        while let Some(o) = cur {
+            let obj = self.object(o)?;
+            let string_len = if let Class::String(s) = &obj.class { Some(s.len()) } else { None };
+            let is_array = matches!(obj.class, Class::Array { .. });
+            if let Some(len) = string_len {
+                self.reserve_heap(index_keys_bytes(len))?;
+                for i in 0..len {
+                    self.use_fuel()?;
+                    let k = index_key(u32::try_from(i).unwrap_or(u32::MAX));
+                    if seen.insert(k.clone()) {
+                        out.push(k);
+                    }
+                }
+                seen.insert(key("length"));
+            }
+            if is_array {
+                seen.insert(key("length"));
+            }
+            for _ in 0..self.object(o)?.props.len() {
+                self.use_fuel()?;
+            }
+            let obj = self.object(o)?;
+            for (k, p) in obj.props.iter() {
+                if seen.insert(k.clone()) && p.enumerable() {
+                    out.push(k.clone());
+                }
+            }
+            cur = obj.proto;
+        }
+        Ok(out)
+    }
+
+    fn op_for_in_start(&mut self) -> JsResult<()> {
+        let v = self.peek(0)?;
+        let (keys, object) = if v.is_nullish() {
+            (Vec::new(), None)
+        } else {
+            let o = self.to_object(&v)?;
+            // A wrapper made by ToObject is not on the stack; a collection while the names are
+            // listed or their bytes reserved must not free it.
+            let saved = self.temp_roots.len();
+            self.temp_roots.push(Value::Object(o));
+            let keys = self.enumerable_keys(o).and_then(|keys| {
+                let bytes = keys.iter().map(|k| string_bytes(k.len())).sum::<usize>();
+                self.reserve_heap(bytes)?;
+                self.heap.bytes = self.heap.bytes.saturating_add(bytes);
+                Ok(keys)
+            });
+            self.temp_roots.truncate(saved);
+            (keys?, Some(o))
+        };
+        let iter = self.heap.alloc_object(Object::new(Class::ForIn(Box::new(ForIn { keys, pos: 0, object })), None));
+        self.replace(1, Value::Object(iter))
+    }
+
+    fn op_for_in_next(&mut self, target: u32) -> JsResult<()> {
+        let Value::Object(iter) = self.peek(0)? else { return internal("for-in iterator is not an object") };
+        loop {
+            let Class::ForIn(state) = &mut self.object_mut(iter)?.class else { return internal("not a for-in iterator") };
+            let Some(k) = state.keys.get(state.pos).cloned() else { return self.jump_to(target) };
+            state.pos += 1;
+            let object = state.object;
+            if let Some(o) = object
+                && self.has_property(o, &k)?
+            {
+                return self.push(Value::String(Str::from_rc(k)));
+            }
+        }
+    }
+
+    // ---- calls ----
+
+    pub(crate) fn is_callable(&self, v: &Value) -> bool {
+        v.as_object().and_then(|o| self.heap.object(o)).is_some_and(|o| matches!(o.class, Class::Function(_)))
+    }
+
+    fn func_of(&self, v: &Value) -> Option<Func> {
+        match &self.heap.object(v.as_object()?)?.class {
+            Class::Function(f) => Some(f.clone()),
+            _ => None,
+        }
+    }
+
+    /// Resolves `call` and `apply` and runs native and host functions; a function written in
+    /// JavaScript comes back to be entered by the caller.
+    fn prepare_call(&mut self, mut f: Value, mut this: Value, mut args: Vec<Value>) -> JsResult<Prepared> {
+        loop {
+            let Some(func) = self.func_of(&f) else { return Err(self.type_error("the value is not a function")) };
+            match func {
+                Func::Closure { code, env } => {
+                    let callee = f.as_object().ok_or_else(|| Abrupt::Internal("callee is not an object".into()))?;
+                    return Ok(Prepared::Closure(Entry { callee, code, env, this, args }));
+                }
+                Func::Native { kind: NativeKind::Call, .. } => {
+                    self.use_fuel()?;
+                    f = this;
+                    this = if args.is_empty() { Value::Undefined } else { args.remove(0) };
+                }
+                Func::Native { kind: NativeKind::Apply, .. } => {
+                    self.use_fuel()?;
+                    if !self.is_callable(&this) {
+                        return Err(self.type_error("apply was called on a value that is not a function"));
+                    }
+                    let list = args.get(1).cloned().unwrap_or(Value::Undefined);
+                    f = this;
+                    this = args.first().cloned().unwrap_or(Value::Undefined);
+                    args = self.list_from_array_like(&list)?;
+                }
+                Func::Native { f: native, .. } => {
+                    // A list from `apply` is not on the operand stack, and a native function can run
+                    // JavaScript that collects, so the arguments stay rooted for the call.
+                    let mark = self.temp_roots.len();
+                    self.temp_roots.push(this.clone());
+                    self.temp_roots.extend(args.iter().cloned());
+                    let r = native(self, this, &args, false);
+                    self.temp_roots.truncate(mark);
+                    return Ok(Prepared::Done(r?));
+                }
+                Func::Host { f: host, .. } => {
+                    let js_args: Vec<crate::JsValue> = args.iter().map(|v| self.to_js_value(v)).collect();
+                    return match host(&js_args) {
+                        Ok(v) => Ok(Prepared::Done(self.from_js_value(v)?)),
+                        Err(message) => {
+                            let bytes = string_bytes(message.encode_utf16().count());
+                            self.reserve_heap(bytes)?;
+                            self.heap.bytes += bytes;
+                            Err(self.throw(ErrorType::Error, &message))
+                        }
+                    };
+                }
+            }
+        }
+    }
+
+    /// The elements of an array-like `apply` argument (section 15.3.4.3).
+    fn list_from_array_like(&mut self, list: &Value) -> JsResult<Vec<Value>> {
+        let Value::Object(o) = list else {
+            if list.is_nullish() {
+                return Ok(Vec::new());
+            }
+            return Err(self.type_error("the argument list is not an object"));
+        };
+        let len = self.get_from(*o, &key("length"), list)?;
+        let n = to_uint32(self.to_number(&len)?) as usize;
+        if n > MAX_APPLY_ARGS {
+            return Err(self.throw(ErrorType::Range, "too many arguments"));
+        }
+        let saved = self.temp_roots.len();
+        let mut out = Vec::with_capacity(n);
+        for i in 0..n {
+            // Each element read takes fuel, so a long array-like list stays within the run's limits.
+            match self.use_fuel().and_then(|()| self.get_from(*o, &index_key(u32::try_from(i).unwrap_or(u32::MAX)), list)) {
+                Ok(v) => {
+                    self.temp_roots.push(v.clone());
+                    out.push(v);
+                }
+                Err(e) => {
+                    self.temp_roots.truncate(saved);
+                    return Err(e);
+                }
+            }
+        }
+        self.temp_roots.truncate(saved);
+        Ok(out)
+    }
+
+    fn op_call(&mut self, argc: u32, eval: bool) -> JsResult<()> {
+        let n = argc as usize;
+        let start =
+            self.stack.len().checked_sub(n + 2).filter(|&s| s >= self.base()).ok_or_else(|| Abrupt::Internal("call below the stack".into()))?;
+        let f = self.stack.get(start).cloned().unwrap_or(Value::Undefined);
+        let this = self.stack.get(start + 1).cloned().unwrap_or(Value::Undefined);
+        let args: Vec<Value> = self.stack.get(start + 2..).map(<[Value]>::to_vec).unwrap_or_default();
+        if eval && f.as_object() == Some(self.intrinsics.eval) {
+            return self.direct_eval(start, args);
+        }
+        match self.prepare_call(f, this, args)? {
+            Prepared::Done(v) => {
+                self.stack.truncate(start);
+                self.push(v)
+            }
+            Prepared::Closure(entry) => {
+                self.stack.truncate(start);
+                self.enter_function(entry, None, false)
+            }
+        }
+    }
+
+    fn op_new(&mut self, argc: u32) -> JsResult<()> {
+        let n = argc as usize;
+        let start =
+            self.stack.len().checked_sub(n + 1).filter(|&s| s >= self.base()).ok_or_else(|| Abrupt::Internal("new below the stack".into()))?;
+        let f = self.stack.get(start).cloned().unwrap_or(Value::Undefined);
+        let args: Vec<Value> = self.stack.get(start + 1..).map(<[Value]>::to_vec).unwrap_or_default();
+        match self.func_of(&f) {
+            Some(Func::Closure { code, env }) => {
+                let Some(callee) = f.as_object() else { return internal("callee is not an object") };
+                let proto = match self.get_from(callee, &key("prototype"), &f)? {
+                    Value::Object(p) => p,
+                    _ => self.intrinsics.object_proto,
+                };
+                let obj = self.heap.alloc_object(Object::new(Class::Ordinary, Some(proto)));
+                self.stack.truncate(start);
+                self.enter_function(Entry { callee, code, env, this: Value::Object(obj), args }, Some(obj), false)
+            }
+            Some(Func::Native { f: native, constructor: true, .. }) => {
+                let v = native(self, Value::Undefined, &args, true)?;
+                self.stack.truncate(start);
+                self.push(v)
+            }
+            _ => Err(self.type_error("the value is not a constructor")),
+        }
+    }
+
+    /// Pushes a frame for a call to a function written in JavaScript, its operands already off
+    /// the stack.
+    fn enter_function(&mut self, entry: Entry, construct: Option<ObjId>, boundary: bool) -> JsResult<()> {
+        let Entry { callee, code, env, this, args } = entry;
+        if self.frames.len() >= self.limits.frames {
+            return Err(Abrupt::Limit(LimitKind::Frames));
+        }
+        let params = code.params.iter().fold(0usize, |total, p| total.saturating_add(binding_bytes(p.len())));
+        let arguments =
+            if code.uses_arguments { OBJECT_BYTES.saturating_add(args.len().saturating_add(4).saturating_mul(binding_bytes(10))) } else { 0 };
+        let need = declaration_bytes(&code).saturating_add(ENV_BYTES).saturating_add(params).saturating_add(arguments);
+        if self.heap.bytes.saturating_add(need) > self.limits.heap_bytes {
+            let mark = self.temp_roots.len();
+            self.temp_roots.push(Value::Object(callee));
+            self.temp_roots.push(this.clone());
+            self.temp_roots.extend(construct.map(Value::Object));
+            self.temp_roots.extend(args.iter().cloned());
+            let reserved = self.reserve_heap(need);
+            self.temp_roots.truncate(mark);
+            reserved?;
+        }
+        let this = if code.strict {
+            this
+        } else {
+            match this {
+                Value::Undefined | Value::Null => Value::Object(self.global),
+                Value::Object(_) => this,
+                prim => Value::Object(self.to_object(&prim)?),
+            }
+        };
+        let fenv = self.instantiate_function(&code, env, &args, callee)?;
+        let base = self.stack.len();
+        self.frames.push(Frame {
+            code,
+            pc: 0,
+            base,
+            env: fenv,
+            var_env: fenv,
+            env_depth: 0,
+            this,
+            callee: Some(callee),
+            construct,
+            completion: Value::Undefined,
+            boundary,
+        });
+        Ok(())
+    }
+
+    /// Declaration binding instantiation for function code (section 10.5). Each parameter and
+    /// declaration takes a unit of fuel.
+    fn instantiate_function(&mut self, code: &Rc<Code>, outer: EnvId, args: &[Value], callee: ObjId) -> JsResult<EnvId> {
+        let mut bindings = PropMap::default();
+        for (i, p) in code.params.iter().enumerate() {
+            self.use_fuel()?;
+            bindings.insert(p.clone(), Binding { value: args.get(i).cloned().unwrap_or(Value::Undefined), mutable: true, deletable: false });
+        }
+        let name_bytes = bindings.iter().map(|(k, _)| string_bytes(k.len())).sum::<usize>();
+        let env = self.heap.alloc_env(Env::Decl { bindings, outer: Some(outer) });
+        self.heap.bytes += name_bytes;
+        for (name, fi) in &code.fun_decls {
+            self.use_fuel()?;
+            let Some(fcode) = code.functions.get(*fi as usize).cloned() else { return internal("function out of range") };
+            let f = self.make_closure(fcode, env)?;
+            self.env_insert(env, name.clone(), Binding { value: Value::Object(f), mutable: true, deletable: false })?;
+        }
+        let has = |interp: &Self, name: &[u16]| matches!(interp.heap.env(env), Some(Env::Decl { bindings, .. }) if bindings.contains(name));
+        if code.uses_arguments && !has(self, &key("arguments")) {
+            let a = self.create_arguments(code, env, args, callee)?;
+            self.env_insert(env, key("arguments"), Binding { value: Value::Object(a), mutable: !code.strict, deletable: false })?;
+        }
+        for v in &code.vars {
+            self.use_fuel()?;
+            if !has(self, v) {
+                self.env_insert(env, v.clone(), Binding { value: Value::Undefined, mutable: true, deletable: false })?;
+            }
+        }
+        Ok(env)
+    }
+
+    /// The `arguments` object (section 10.6).
+    fn create_arguments(&mut self, code: &Code, env: EnvId, args: &[Value], callee: ObjId) -> JsResult<ObjId> {
+        let mut names = vec![None; args.len()];
+        if !code.strict {
+            let mut mapped = std::collections::HashSet::new();
+            for (i, p) in code.params.iter().enumerate().take(args.len()).rev() {
+                if mapped.insert(p.clone())
+                    && let Some(slot) = names.get_mut(i)
+                {
+                    *slot = Some(p.clone());
+                }
+            }
+        }
+        let proto = self.intrinsics.object_proto;
+        let a = self.heap.alloc_object(Object::new(Class::Arguments(Box::new(ArgMap { env, names })), Some(proto)));
+        for (i, v) in args.iter().enumerate() {
+            self.define(a, index_key(u32::try_from(i).unwrap_or(u32::MAX)), Prop::Data { value: v.clone(), flags: OPEN })?;
+        }
+        self.define(a, key("length"), Prop::Data { value: Value::Number(args.len() as f64), flags: HIDDEN })?;
+        if code.strict {
+            let thrower = Some(self.intrinsics.throw_type_error);
+            for name in ["callee", "caller"] {
+                self.define(a, key(name), Prop::Accessor { get: thrower, set: thrower, flags: 0 })?;
+            }
+        } else {
+            self.define(a, key("callee"), Prop::Data { value: Value::Object(callee), flags: HIDDEN })?;
+        }
+        Ok(a)
+    }
+
+    /// Calls `f` from Rust and returns its result, running the loop again for a function written
+    /// in JavaScript.
+    pub(crate) fn call(&mut self, f: &Value, this: &Value, args: &[Value]) -> JsResult<Value> {
+        if self.reentry >= self.limits.reentry {
+            return Err(Abrupt::Limit(LimitKind::Reentry));
+        }
+        let saved = self.stack.len();
+        self.stack.push(f.clone());
+        self.stack.push(this.clone());
+        self.stack.extend(args.iter().cloned());
+        self.reentry += 1;
+        let r = self.call_rooted(f.clone(), this.clone(), args.to_vec(), saved);
+        self.reentry -= 1;
+        self.stack.truncate(saved);
+        r
+    }
+
+    fn call_rooted(&mut self, f: Value, this: Value, args: Vec<Value>, saved: usize) -> JsResult<Value> {
+        match self.prepare_call(f, this, args)? {
+            Prepared::Done(v) => Ok(v),
+            Prepared::Closure(entry) => {
+                self.stack.truncate(saved);
+                self.enter_function(entry, None, true)?;
+                self.execute()
+            }
+        }
+    }
+
+    // ---- eval and scripts ----
+
+    /// The options for source parsed next in this run: [`Options::max_source_units`] is what
+    /// the run may still parse.
+    fn remaining_source_options(&self) -> Options {
+        Options { max_source_units: self.options.max_source_units.saturating_sub(self.source_units), ..self.options.clone() }
+    }
+
+    /// Checks that `units` more code units of source fit in what this run may still parse,
+    /// before the source is flattened or encoded.
+    pub(crate) fn check_source_units(&self, units: usize) -> Result<(), CompileError> {
+        crate::check_length(units, &self.remaining_source_options()).map_err(CompileError::Syntax)
+    }
+
+    /// Encodes `text` as UTF-16 for parsing, after checking that it fits in what this run may
+    /// still parse.
+    pub(crate) fn encode_source(&self, text: &str) -> Result<Vec<u16>, CompileError> {
+        crate::to_utf16(text, &self.remaining_source_options()).map_err(CompileError::Syntax)
+    }
+
+    /// Parses and compiles source for eval code or a script, counting it against the source
+    /// limit.
+    pub(crate) fn compile_source(&mut self, units: &[u16], strict: bool, kind: CodeKind) -> Result<Rc<Code>, CompileError> {
+        self.source_units = self.source_units.saturating_add(units.len());
+        let remaining = self.options.max_source_units.saturating_sub(self.source_units.saturating_sub(units.len()));
+        let options = Options { strict, max_source_units: remaining, ..self.options.clone() };
+        let program = crate::parse_utf16(units, &options).map_err(CompileError::Syntax)?;
+        let source = Rc::new(Source { lines: program.lines.clone(), text: units.into() });
+        compile_program(&program, &source, kind).map_err(|e| match e {
+            CompileFail::Syntax(s) => CompileError::Syntax(s),
+            CompileFail::Internal(m) => CompileError::Internal(m),
+        })
+    }
+
+    /// Turns a compile failure inside a running script into what it throws.
+    pub(crate) fn compile_error_to_abrupt(&mut self, e: CompileError) -> Abrupt {
+        match e {
+            CompileError::Syntax(s) => self.throw(ErrorType::Syntax, &s.message),
+            CompileError::Internal(m) => Abrupt::Internal(m),
+        }
+    }
+
+    fn direct_eval(&mut self, start: usize, args: Vec<Value>) -> JsResult<()> {
+        let x = args.into_iter().next().unwrap_or(Value::Undefined);
+        let Value::String(s) = &x else {
+            self.stack.truncate(start);
+            return self.push(x);
+        };
+        let strict = self.strict();
+        self.check_source_units(s.len()).map_err(|e| self.compile_error_to_abrupt(e))?;
+        let units = s.flat();
+        let code = self.compile_source(&units, strict, CodeKind::Eval).map_err(|e| self.compile_error_to_abrupt(e))?;
+        self.charge_code(&code, declaration_bytes(&code).saturating_add(ENV_BYTES))?;
+        let frame = self.frame()?;
+        let (caller_env, caller_var_env, this) = (frame.env, frame.var_env, frame.this.clone());
+        let (env, var_env) = if code.strict {
+            let e = self.heap.alloc_env(Env::Decl { bindings: PropMap::default(), outer: Some(caller_env) });
+            (e, e)
+        } else {
+            (caller_env, caller_var_env)
+        };
+        self.stack.truncate(start);
+        self.instantiate_global(&code, var_env, true)?;
+        self.push_code_frame(code, env, var_env, this, false)
+    }
+
+    /// Indirect eval and scripts: runs `code` in the global environment and returns its
+    /// completion value.
+    pub(crate) fn run_global(&mut self, code: Rc<Code>, is_eval: bool) -> JsResult<Value> {
+        // Indirect eval runs inside an operation and counts against the re-entry limit; the
+        // script a realm runs does not.
+        let nested = usize::from(is_eval);
+        if is_eval && self.reentry >= self.limits.reentry {
+            return Err(Abrupt::Limit(LimitKind::Reentry));
+        }
+        self.charge_code(&code, declaration_bytes(&code).saturating_add(ENV_BYTES))?;
+        let (env, global) = (self.global_env, self.global);
+        let (env, var_env) = if code.strict && is_eval {
+            let e = self.heap.alloc_env(Env::Decl { bindings: PropMap::default(), outer: Some(env) });
+            (e, e)
+        } else {
+            (env, env)
+        };
+        self.instantiate_global(&code, var_env, is_eval)?;
+        self.push_code_frame(code, env, var_env, Value::Object(global), true)?;
+        self.reentry += nested;
+        let r = self.execute();
+        self.reentry -= nested;
+        r
+    }
+
+    fn push_code_frame(&mut self, code: Rc<Code>, env: EnvId, var_env: EnvId, this: Value, boundary: bool) -> JsResult<()> {
+        if self.frames.len() >= self.limits.frames {
+            return Err(Abrupt::Limit(LimitKind::Frames));
+        }
+        let base = self.stack.len();
+        self.frames.push(Frame {
+            code,
+            pc: 0,
+            base,
+            env,
+            var_env,
+            env_depth: 0,
+            this,
+            callee: None,
+            construct: None,
+            completion: Value::Undefined,
+            boundary,
+        });
+        Ok(())
+    }
+
+    /// Declaration binding instantiation for global and eval code (section 10.5). The caller has
+    /// reserved [`declaration_bytes`] of `code`; each declaration takes a unit of fuel.
+    fn instantiate_global(&mut self, code: &Rc<Code>, var_env: EnvId, is_eval: bool) -> JsResult<()> {
+        let configurable = if is_eval { CONFIGURABLE } else { 0 };
+        for (name, fi) in &code.fun_decls {
+            self.use_fuel()?;
+            let Some(fcode) = code.functions.get(*fi as usize).cloned() else { return internal("function out of range") };
+            let f = self.make_closure(fcode, var_env)?;
+            self.declare(var_env, name, Some(Value::Object(f)), configurable)?;
+        }
+        for v in &code.vars {
+            self.use_fuel()?;
+            self.declare(var_env, v, None, configurable)?;
+        }
+        Ok(())
+    }
+
+    /// Declares `name` in a variable environment, with `value` for a function declaration.
+    fn declare(&mut self, env: EnvId, name: &Key, value: Option<Value>, configurable: u8) -> JsResult<()> {
+        match self.heap.env(env) {
+            Some(Env::Decl { bindings, .. }) => {
+                let exists = bindings.contains(name);
+                match value {
+                    Some(v) => self.env_insert(env, name.clone(), Binding { value: v, mutable: true, deletable: configurable != 0 }),
+                    None if !exists => {
+                        self.env_insert(env, name.clone(), Binding { value: Value::Undefined, mutable: true, deletable: configurable != 0 })
+                    }
+                    None => Ok(()),
+                }
+            }
+            Some(Env::Obj { object, .. }) => {
+                let object = *object;
+                let declared = self.has_property(object, name)?;
+                let flags = WRITABLE | ENUMERABLE | configurable;
+                match value {
+                    None if declared => Ok(()),
+                    None => self.define(object, name.clone(), Prop::Data { value: Value::Undefined, flags }),
+                    Some(v) => {
+                        let existing = self.find_property(object, name)?;
+                        match existing {
+                            None => self.define(object, name.clone(), Prop::Data { value: v, flags }),
+                            Some(p) if p.configurable() => self.define(object, name.clone(), Prop::Data { value: v, flags }),
+                            Some(Prop::Data { flags: f, .. }) if f & (WRITABLE | ENUMERABLE) == WRITABLE | ENUMERABLE => {
+                                self.put(object, name.clone(), v, true)
+                            }
+                            Some(_) => {
+                                let message = format!("cannot declare function {}", String::from_utf16_lossy(name));
+                                Err(self.type_error(&message))
+                            }
+                        }
+                    }
+                }
+            }
+            None => internal("environment out of range"),
+        }
+    }
+
+    // ---- conversions ----
+
+    pub(crate) fn type_of(&self, v: &Value) -> &'static str {
+        match v {
+            Value::Undefined => "undefined",
+            Value::Null => "object",
+            Value::Bool(_) => "boolean",
+            Value::Number(_) => "number",
+            Value::String(_) => "string",
+            Value::Object(_) if self.is_callable(v) => "function",
+            Value::Object(_) => "object",
+        }
+    }
+
+    /// ToPrimitive (section 9.1) through [[DefaultValue]] (section 8.12.8).
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn to_primitive(&mut self, v: &Value, hint: Hint) -> JsResult<Value> {
+        let Value::Object(o) = v else { return Ok(v.clone()) };
+        let order = if hint == Hint::String { ["toString", "valueOf"] } else { ["valueOf", "toString"] };
+        for name in order {
+            let f = self.get_from(*o, &key(name), v)?;
+            if self.is_callable(&f) {
+                let r = self.call(&f, v, &[])?;
+                if !matches!(r, Value::Object(_)) {
+                    return Ok(r);
+                }
+            }
+        }
+        Err(self.type_error("cannot convert the object to a primitive value"))
+    }
+
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn to_number(&mut self, v: &Value) -> JsResult<f64> {
+        Ok(match v {
+            Value::Undefined => f64::NAN,
+            Value::Null => 0.0,
+            Value::Bool(b) => f64::from(u8::from(*b)),
+            Value::Number(n) => *n,
+            Value::String(s) => string_to_number(&s.flat()),
+            Value::Object(_) => {
+                let p = self.to_primitive(v, Hint::Number)?;
+                return self.to_number(&p);
+            }
+        })
+    }
+
+    /// ToString applied to a primitive.
+    pub(crate) fn primitive_to_str(&mut self, v: &Value) -> Str {
+        match v {
+            Value::Undefined => Str::from("undefined"),
+            Value::Null => Str::from("null"),
+            Value::Bool(b) => Str::from(if *b { "true" } else { "false" }),
+            Value::Number(n) => {
+                let s = number_to_str(*n);
+                self.heap.bytes += string_bytes(s.len());
+                s
+            }
+            Value::String(s) => s.clone(),
+            Value::Object(_) => Str::from("[object]"),
+        }
+    }
+
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn to_str(&mut self, v: &Value) -> JsResult<Str> {
+        let p = self.to_primitive(v, Hint::String)?;
+        Ok(self.primitive_to_str(&p))
+    }
+
+    /// A property name from a value (ToString, with a short way for array indices).
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn to_key(&mut self, v: &Value) -> JsResult<Key> {
+        match v {
+            Value::String(s) => {
+                let rope = s.is_rope();
+                let flat = s.flat();
+                if rope {
+                    self.heap.bytes += string_bytes(flat.len());
+                }
+                Ok(flat)
+            }
+            Value::Number(n) if *n >= 0.0 && *n < 4_294_967_295.0 && n.fract() == 0.0 => Ok(index_key(*n as u32)),
+            _ => Ok(self.to_str(v)?.flat()),
+        }
+    }
+
+    /// ToObject (section 9.9).
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn to_object(&mut self, v: &Value) -> JsResult<ObjId> {
+        let (class, proto) = match v {
+            Value::Object(o) => return Ok(*o),
+            Value::Undefined | Value::Null => return Err(self.type_error("cannot convert undefined or null to an object")),
+            Value::Bool(_) => (Class::Boolean, self.intrinsics.boolean_proto),
+            Value::Number(_) => (Class::Number, self.intrinsics.number_proto),
+            Value::String(s) => (Class::String(s.clone()), self.intrinsics.string_proto),
+        };
+        Ok(self.heap.alloc_object(Object::new(class, Some(proto))))
+    }
+
+    /// Concatenates two strings, ending the run with the heap limit when the result could not
+    /// be flattened within it.
+    pub(crate) fn concat(&mut self, a: &Str, b: &Str) -> JsResult<Str> {
+        let len = a.len() + b.len();
+        if len > self.limits.heap_bytes / 4 {
+            return Err(Abrupt::Limit(LimitKind::Heap));
+        }
+        self.heap.bytes += ROPE_BYTES;
+        Ok(Str::concat(a, b))
+    }
+
+    // ---- operators ----
+
+    fn op_unary(&mut self, op: Op) -> JsResult<()> {
+        let v = self.peek(0)?;
+        let r = match op {
+            Op::Neg => Value::Number(-self.to_number(&v)?),
+            Op::Plus | Op::ToNumber => Value::Number(self.to_number(&v)?),
+            Op::BitNot => Value::Number(f64::from(!to_int32(self.to_number(&v)?))),
+            Op::Not => Value::Bool(!v.truthy()),
+            Op::Typeof => Value::str(self.type_of(&v)),
+            _ => return internal("not a unary operator"),
+        };
+        self.replace(1, r)
+    }
+
+    fn op_binary(&mut self, op: BinaryOp) -> JsResult<()> {
+        let b = self.peek(0)?;
+        let a = self.peek(1)?;
+        let r = self.binary(op, &a, &b)?;
+        self.replace(2, r)
+    }
+
+    pub(crate) fn binary(&mut self, op: BinaryOp, a: &Value, b: &Value) -> JsResult<Value> {
+        let num = |interp: &mut Self, f: fn(f64, f64) -> f64| -> JsResult<Value> {
+            let x = interp.to_number(a)?;
+            let y = interp.to_number(b)?;
+            Ok(Value::Number(f(x, y)))
+        };
+        let int = |interp: &mut Self, f: fn(i32, i32) -> i32| -> JsResult<Value> {
+            let x = to_int32(interp.to_number(a)?);
+            let y = to_int32(interp.to_number(b)?);
+            Ok(Value::Number(f64::from(f(x, y))))
+        };
+        match op {
+            BinaryOp::Add => self.add(a, b),
+            BinaryOp::Sub => num(self, |x, y| x - y),
+            BinaryOp::Mul => num(self, |x, y| x * y),
+            BinaryOp::Div => num(self, |x, y| x / y),
+            BinaryOp::Mod => num(self, |x, y| x % y),
+            BinaryOp::Shl => int(self, |x, y| x.wrapping_shl((y & 31) as u32)),
+            BinaryOp::Shr => int(self, |x, y| x >> (y & 31)),
+            BinaryOp::UShr => {
+                let x = to_uint32(self.to_number(a)?);
+                let y = to_uint32(self.to_number(b)?);
+                Ok(Value::Number(f64::from(x >> (y & 31))))
+            }
+            BinaryOp::BitAnd => int(self, |x, y| x & y),
+            BinaryOp::BitOr => int(self, |x, y| x | y),
+            BinaryOp::BitXor => int(self, |x, y| x ^ y),
+            BinaryOp::Lt => Ok(Value::Bool(self.less_than(a, b, true)? == Some(true))),
+            BinaryOp::Gt => Ok(Value::Bool(self.less_than(b, a, false)? == Some(true))),
+            BinaryOp::LtEq => Ok(Value::Bool(self.less_than(b, a, false)? == Some(false))),
+            BinaryOp::GtEq => Ok(Value::Bool(self.less_than(a, b, true)? == Some(false))),
+            BinaryOp::Eq => Ok(Value::Bool(self.loose_eq(a, b)?)),
+            BinaryOp::NotEq => Ok(Value::Bool(!self.loose_eq(a, b)?)),
+            BinaryOp::StrictEq => Ok(Value::Bool(strict_eq(a, b))),
+            BinaryOp::StrictNotEq => Ok(Value::Bool(!strict_eq(a, b))),
+            BinaryOp::Instanceof => self.instance_of(a, b).map(Value::Bool),
+            BinaryOp::In => {
+                let Value::Object(o) = b else { return Err(self.type_error("the right side of 'in' is not an object")) };
+                let k = self.to_key(a)?;
+                self.has_property(*o, &k).map(Value::Bool)
+            }
+        }
+    }
+
+    /// The addition operator (section 11.6.1).
+    fn add(&mut self, a: &Value, b: &Value) -> JsResult<Value> {
+        if let (Value::Number(x), Value::Number(y)) = (a, b) {
+            return Ok(Value::Number(x + y));
+        }
+        let pa = self.to_primitive(a, Hint::Default)?;
+        let pb = self.to_primitive(b, Hint::Default)?;
+        if matches!(pa, Value::String(_)) || matches!(pb, Value::String(_)) {
+            let sa = self.primitive_to_str(&pa);
+            let sb = self.primitive_to_str(&pb);
+            return self.concat(&sa, &sb).map(Value::String);
+        }
+        Ok(Value::Number(self.to_number(&pa)? + self.to_number(&pb)?))
+    }
+
+    /// The abstract relational comparison `x < y` (section 11.8.5): `None` when either side is
+    /// NaN.
+    fn less_than(&mut self, x: &Value, y: &Value, left_first: bool) -> JsResult<Option<bool>> {
+        let (px, py) = if left_first {
+            let px = self.to_primitive(x, Hint::Number)?;
+            (px, self.to_primitive(y, Hint::Number)?)
+        } else {
+            let py = self.to_primitive(y, Hint::Number)?;
+            (self.to_primitive(x, Hint::Number)?, py)
+        };
+        if let (Value::String(a), Value::String(b)) = (&px, &py) {
+            return Ok(Some(*a.flat() < *b.flat()));
+        }
+        let nx = self.to_number(&px)?;
+        let ny = self.to_number(&py)?;
+        if nx.is_nan() || ny.is_nan() {
+            return Ok(None);
+        }
+        Ok(Some(nx < ny))
+    }
+
+    /// The abstract equality comparison (section 11.9.3).
+    fn loose_eq(&mut self, a: &Value, b: &Value) -> JsResult<bool> {
+        let (mut x, mut y) = (a.clone(), b.clone());
+        loop {
+            match (&x, &y) {
+                (Value::Undefined | Value::Null, Value::Undefined | Value::Null) => return Ok(true),
+                (Value::Number(_), Value::Number(_))
+                | (Value::String(_), Value::String(_))
+                | (Value::Bool(_), Value::Bool(_))
+                | (Value::Object(_), Value::Object(_)) => return Ok(strict_eq(&x, &y)),
+                (Value::Number(n), Value::String(s)) | (Value::String(s), Value::Number(n)) => return Ok(*n == string_to_number(&s.flat())),
+                (Value::Bool(v), _) => x = Value::Number(f64::from(u8::from(*v))),
+                (_, Value::Bool(v)) => y = Value::Number(f64::from(u8::from(*v))),
+                (Value::Number(_) | Value::String(_), Value::Object(_)) => y = self.to_primitive(&y, Hint::Default)?,
+                (Value::Object(_), Value::Number(_) | Value::String(_)) => x = self.to_primitive(&x, Hint::Default)?,
+                _ => return Ok(false),
+            }
+        }
+    }
+
+    /// `instanceof` (sections 11.8.6 and 15.3.5.3).
+    fn instance_of(&mut self, v: &Value, f: &Value) -> JsResult<bool> {
+        if !self.is_callable(f) {
+            return Err(self.type_error("the right side of 'instanceof' is not a function"));
+        }
+        let Some(fid) = f.as_object() else { return Ok(false) };
+        let Value::Object(mut o) = v.clone() else { return Ok(false) };
+        let Value::Object(proto) = self.get_from(fid, &key("prototype"), f)? else {
+            return Err(self.type_error("the function's prototype is not an object"));
+        };
+        let mut steps = 0usize;
+        while let Some(p) = self.object(o)?.proto {
+            if p == proto {
+                return Ok(true);
+            }
+            o = p;
+            steps += 1;
+            if steps > 1_000_000 {
+                return internal("prototype chain too long");
+            }
+        }
+        Ok(false)
+    }
+
+    // ---- host values ----
+
+    pub(crate) fn to_js_value(&self, v: &Value) -> crate::JsValue {
+        match v {
+            Value::Undefined => crate::JsValue::Undefined,
+            Value::Null => crate::JsValue::Null,
+            Value::Bool(b) => crate::JsValue::Bool(*b),
+            Value::Number(n) => crate::JsValue::Number(*n),
+            Value::String(s) => crate::JsValue::String(s.to_rust_string()),
+            Value::Object(o) => crate::JsValue::Object(self.heap.object(*o).map_or("Object", |o| o.class.name()).to_string()),
+        }
+    }
+
+    /// A host value as a JavaScript value. A string is charged to the heap, and one that does not
+    /// fit in it ends the run with the heap limit. Everything the caller still needs must be
+    /// reachable from the roots.
+    #[allow(clippy::wrong_self_convention)]
+    pub(crate) fn from_js_value(&mut self, v: crate::JsValue) -> JsResult<Value> {
+        Ok(match v {
+            crate::JsValue::Undefined => Value::Undefined,
+            crate::JsValue::Null => Value::Null,
+            crate::JsValue::Bool(b) => Value::Bool(b),
+            crate::JsValue::Number(n) => Value::Number(n),
+            crate::JsValue::String(s) => {
+                let bytes = string_bytes(s.encode_utf16().count());
+                self.reserve_heap(bytes)?;
+                self.heap.bytes += bytes;
+                Value::str(&s)
+            }
+            crate::JsValue::Object(_) => Value::Object(self.new_object()),
+        })
+    }
+
+    /// A description of a thrown value that runs no JavaScript: `Name: message` for an error,
+    /// the text of a primitive.
+    pub(crate) fn describe(&mut self, v: &Value) -> String {
+        let Value::Object(o) = v else { return self.primitive_to_str(v).to_rust_string() };
+        let data = |interp: &Self, k: &str| match interp.find_property(*o, &key(k)) {
+            Ok(Some(Prop::Data { value: Value::String(s), .. })) => Some(s.to_rust_string()),
+            _ => None,
+        };
+        match (data(self, "name"), data(self, "message")) {
+            (Some(n), Some(m)) if !m.is_empty() => format!("{n}: {m}"),
+            (Some(n), _) => n,
+            (None, Some(m)) => m,
+            (None, None) => format!("[object {}]", self.heap.object(*o).map_or("Object", |o| o.class.name())),
+        }
+    }
+}
+
+/// A compile failure, before it becomes an exception or a run error.
+pub(crate) enum CompileError {
+    Syntax(crate::SyntaxError),
+    Internal(String),
+}
+
+/// The strict equality comparison (section 11.9.6).
+pub(crate) fn strict_eq(a: &Value, b: &Value) -> bool {
+    match (a, b) {
+        (Value::Undefined, Value::Undefined) | (Value::Null, Value::Null) => true,
+        (Value::Number(x), Value::Number(y)) => x == y,
+        (Value::String(x), Value::String(y)) => x == y,
+        (Value::Bool(x), Value::Bool(y)) => x == y,
+        (Value::Object(x), Value::Object(y)) => x == y,
+        _ => false,
+    }
+}
diff --git a/crates/js/src/interp_tests.rs b/crates/js/src/interp_tests.rs
new file mode 100644
index 000000000..03d9e6639
--- /dev/null
+++ b/crates/js/src/interp_tests.rs
@@ -0,0 +1,852 @@
+use std::rc::Rc;
+
+use proptest::prelude::*;
+
+use crate::bytecode::{Code, Handler, Op, Source, verify};
+use crate::{JsValue, LimitKind, Limits, Options, Realm, RunError, RunErrorKind};
+
+fn run(src: &str) -> JsValue {
+    match Realm::new().run(src) {
+        Ok(v) => v,
+        Err(e) => panic!("{src}\n{e:?}"),
+    }
+}
+
+fn num(src: &str) -> f64 {
+    match run(src) {
+        JsValue::Number(n) => n,
+        other => panic!("{src}: {other:?}"),
+    }
+}
+
+fn string(src: &str) -> String {
+    match run(src) {
+        JsValue::String(s) => s,
+        other => panic!("{src}: {other:?}"),
+    }
+}
+
+fn truth(src: &str) {
+    assert_eq!(run(src), JsValue::Bool(true), "{src}");
+}
+
+fn fail(src: &str) -> RunError {
+    match Realm::new().run(src) {
+        Ok(v) => panic!("{src} completed with {v:?}"),
+        Err(e) => e,
+    }
+}
+
+fn small(limits: Limits) -> Realm {
+    Realm::with_options(Options::default(), limits)
+}
+
+// ---- language ----
+
+#[test]
+fn assignments_resolve_the_variable_before_the_right_hand_side() {
+    // Section 11.13.1: the reference is resolved first, so a binding the right-hand side adds
+    // does not catch the assignment.
+    truth("var x = 0; var scope = {}; with (scope) { x = (scope.x = 2, 1); } scope.x === 2 && x === 1");
+    truth("var x = 0; var scope = {}; with (scope) { x += (scope.x = 2, 1); } scope.x === 2 && x === 1");
+    truth("var x = 5; function f() { var r = (x = (eval('var x;'), 1)); return [x, r]; } var a = f(); a[0] === undefined && a[1] === 1 && x === 1");
+    // Section 11.3.1: the operand's reference is resolved before ToNumber runs.
+    truth(
+        "var x = 0; var scope = {x: {valueOf: function(){ delete scope.x; return 2; }}}; \
+         with (scope) { x++; } scope.x === 3 && x === 0",
+    );
+}
+
+#[test]
+fn arithmetic_comparison_and_conversions() {
+    assert_eq!(num("1 + 2 * 3 - 4 / 2"), 5.0);
+    assert_eq!(num("7 % 3 + (-7 % 3)"), 0.0);
+    assert_eq!(string("'a' + 1 + 2"), "a12");
+    assert_eq!(num("1 + 2 + '3' - 0"), 33.0);
+    assert_eq!(num("(1 << 31) >> 31"), -1.0);
+    assert_eq!(num("-1 >>> 28"), 15.0);
+    assert_eq!(num("~5 ^ 3 | 8 & 12"), -7.0);
+    truth("'10' == 10 && null == undefined && !(null == 0) && '' == 0 && '1e1' == 10");
+    truth("NaN !== NaN && 0 === -0 && 1/-0 === -Infinity");
+    truth("'b' > 'a' && 'B' < 'a' && !(NaN < 1) && !(NaN >= 1) && 2 >= 2 && '10' < '9' && 10 > '9'");
+    truth(
+        "typeof 1 === 'number' && typeof 'x' === 'string' && typeof null === 'object' && typeof undefined_name === 'undefined' && typeof function(){} === 'function'",
+    );
+    truth("({valueOf: function(){ return 4; }}) * 2 === 8 && ({toString: function(){ return 'x'; }}) + 'y' === 'xy'");
+    truth("+'0x10' === 16 && +' 12 ' === 12 && isNaNish(+'1x'); function isNaNish(n) { return n !== n; }");
+}
+
+#[test]
+fn variables_functions_and_closures() {
+    assert_eq!(num("var x = 1; function f() { return x + 1; } f()"), 2.0);
+    assert_eq!(num("function counter() { var n = 0; return function() { return ++n; }; } var c = counter(); c(); c(); c()"), 3.0);
+    assert_eq!(num("f(); function f() { return 5; }"), 5.0);
+    assert_eq!(num("var g = function fact(n) { return n <= 1 ? 1 : n * fact(n - 1); }; g(10)"), 3_628_800.0);
+    assert_eq!(num("function f(a, b) { return arguments.length * 10 + (b === undefined ? 1 : 0); } f(1)"), 11.0);
+    assert_eq!(num("function f(a) { arguments[0] = 9; return a; } f(1)"), 9.0);
+    assert_eq!(num("function f(a) { 'use strict'; arguments[0] = 9; return a; } f(1)"), 1.0);
+    assert_eq!(num("function f(a) { a = 4; return arguments[0]; } f(1)"), 4.0);
+    truth("var o = { m: function() { return this; } }; o.m() === o");
+    truth("function f() { return this; } f() === this");
+    truth("function f() { 'use strict'; return this; } f() === undefined");
+    assert_eq!(num("function P(x) { this.x = x; } P.prototype.get = function() { return this.x; }; new P(7).get()"), 7.0);
+    truth("function P() { return {a: 1}; } new P().a === 1 && new P() instanceof Object");
+    truth("function P() {} var p = new P(); p instanceof P && p.constructor === P && P.prototype.isPrototypeOf(p)");
+    assert_eq!(num("(function(a, b, c) {}).length"), 3.0);
+}
+
+#[test]
+fn call_and_apply_set_this_and_arguments() {
+    assert_eq!(num("function f(a, b) { return this.k + a + b; } f.call({k: 1}, 2, 3)"), 6.0);
+    assert_eq!(num("function f(a, b) { return this.k + a + b; } f.apply({k: 1}, [2, 3])"), 6.0);
+    assert_eq!(num("function f() { return arguments.length; } f.apply(null, undefined)"), 0.0);
+    assert_eq!(num("Function.prototype.call.call(function(a) { return a; }, null, 8)"), 8.0);
+    let e = fail("Function.prototype.call.call(1)");
+    assert_eq!(e.kind, RunErrorKind::Thrown);
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+}
+
+#[test]
+fn objects_arrays_and_accessors() {
+    assert_eq!(num("var o = {a: 1, 'b': 2, 3: 4}; o.a + o['b'] + o[3]"), 7.0);
+    assert_eq!(num("var a = [1, , 3]; a.length"), 3.0);
+    assert_eq!(num("var a = []; a[5] = 1; a.length"), 6.0);
+    assert_eq!(num("var a = [1, 2, 3, 4]; a.length = 1; a[2] === undefined ? a.length : -1"), 1.0);
+    assert_eq!(num("var o = { get x() { return this.y * 2; }, set x(v) { this.y = v; }, y: 1 }; o.x = 5; o.x"), 10.0);
+    truth("var o = {a: 1}; delete o.a && !('a' in o) && o.a === undefined");
+    truth("'length' in [] && !delete [].length");
+    truth("'abc'.length === 3 && 'abc'[1] === 'b' && 'abc'.x === undefined");
+    truth("var o = {}; o.hasOwnProperty('x') === false && ({x: 1}).hasOwnProperty('x')");
+    truth("Object.prototype.toString.call([]) === '[object Array]' && Object.prototype.toString.call(null) === '[object Null]'");
+    // Error.prototype and each NativeError prototype are Error objects (sections 15.11.4 and 15.11.7.7).
+    truth(
+        "var s = Object.prototype.toString, all = [Error, EvalError, RangeError, ReferenceError, SyntaxError, TypeError, URIError], ok = true;\
+         for (var i = 0; i < all.length; i++) ok = ok && s.call(all[i].prototype) === '[object Error]'; ok",
+    );
+    let e = fail("var a = []; a.length = -1");
+    assert!(e.message.starts_with("RangeError"), "{}", e.message);
+    let e = fail("'use strict'; var o = { get x() { return 1; } }; o.x = 2;");
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+    let e = fail("null.x");
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+}
+
+#[test]
+fn for_in_lists_own_properties_in_insertion_order_then_inherited_ones() {
+    assert_eq!(
+        string("function P() { this.z = 1; this.a = 2; } P.prototype.m = 3; P.prototype.a = 9; var s = ''; for (var k in new P()) s += k; s"),
+        "zam"
+    );
+    assert_eq!(string("var o = {a: 1, b: 2, c: 3}, s = ''; for (var k in o) { delete o.b; s += k; } s"), "ac");
+    assert_eq!(string("var s = ''; for (var k in 'xyz') s += k; s"), "012");
+    assert_eq!(num("var n = 0; for (var k in null) n++; for (k in undefined) n++; n"), 0.0);
+    assert_eq!(string("var o = {p: 1}, t = {}, s = ''; for (t.k in o) s += t.k; s"), "p");
+    assert_eq!(string("var a = ['x', 'y'], s = ''; for (var i in a) s += i + a[i]; s"), "0x1y");
+}
+
+#[test]
+fn control_flow_with_labels_switch_and_finally() {
+    assert_eq!(
+        num(
+            "var n = 0; outer: for (var i = 0; i < 5; i++) { for (var j = 0; j < 5; j++) { if (j == 2) continue outer; if (i == 3) break outer; n++; } } n"
+        ),
+        6.0
+    );
+    assert_eq!(num("var r = 0; switch (3) { case 1: r = 1; case 3: r += 3; case 4: r += 4; break; default: r = 100; } r"), 7.0);
+    assert_eq!(num("var r = 0; switch ('z') { case 'a': r = 1; break; default: r = 2; case 'b': r += 10; } r"), 12.0);
+    assert_eq!(num("var log = 0; function f() { try { return 1; } finally { log = 5; } } f() + log"), 6.0);
+    assert_eq!(num("function f() { try { return 1; } finally { return 2; } } f()"), 2.0);
+    assert_eq!(num("var n = 0; for (var i = 0; i < 3; i++) { try { if (i == 1) continue; n += 10; } finally { n += 1; } } n"), 23.0);
+    assert_eq!(num("var n = 0; while (true) { try { try { break; } finally { n += 1; } } finally { n += 10; } } n"), 11.0);
+    assert_eq!(num("var n = 0; try { throw 3; } catch (e) { n = e; } finally { n *= 2; } n"), 6.0);
+    assert_eq!(num("var n = 0; try { try { throw 1; } finally { n = 7; } } catch (e) { n += e; } n"), 8.0);
+    assert_eq!(num("function f() { for (var k in {a: 1}) { try { return 4; } finally { } } } f()"), 4.0);
+    assert_eq!(num("var x = 0; lbl: { x = 1; break lbl; x = 2; } x"), 1.0);
+    assert_eq!(num("var i = 0; do { i++; } while (i < 10); i"), 10.0);
+    assert_eq!(num("var e = 1; try { throw 2; } catch (e) { e = 3; } e"), 1.0);
+    assert_eq!(num("function f() { var r = 0; with ({a: 1}) { try { return a; } finally { r = 1; } } } f()"), 1.0);
+}
+
+#[test]
+fn a_finally_block_keeps_the_completion_value_unless_it_ends_abruptly() {
+    // Section 12.14: a finally block that ends normally leaves the try or catch block's value.
+    let cases = [
+        ("try { 1; } finally { 2; }", 1.0),
+        ("try { throw 0; } catch (e) { 1; } finally { 2; }", 1.0),
+        ("eval('try { 1; } finally { 2; }')", 1.0),
+        ("try { try { 1; } finally { 2; } } finally { 3; }", 1.0),
+        ("do { try { 1; } finally { 2; break; } } while (false)", 2.0),
+        ("do { try { 1; } finally { 2; continue; } } while (false)", 2.0),
+    ];
+    let wrong: Vec<(&str, f64, f64)> = cases.iter().map(|&(src, want)| (src, want, num(src))).filter(|&(_, want, got)| want != got).collect();
+    assert!(wrong.is_empty(), "{wrong:?}");
+}
+
+#[test]
+fn with_eval_and_new_function() {
+    assert_eq!(num("var o = {a: 2}; with (o) { a = 3; } o.a"), 3.0);
+    truth("var o = {f: function() { return this; }}; with (o) { f() === o }");
+    assert_eq!(num("var x = 1; function f() { var x = 2; return eval('x'); } f()"), 2.0);
+    assert_eq!(num("var x = 1; function f() { var x = 2; return (0, eval)('x'); } f()"), 1.0);
+    assert_eq!(num("function f() { eval('var y = 4'); return y; } f()"), 4.0);
+    truth("function f() { 'use strict'; eval('var y = 4'); return typeof y; } f() === 'undefined'");
+    assert_eq!(num("eval('1; 2; if (false) {}')"), 2.0);
+    assert_eq!(num("new Function('a', 'b', 'return a * b;')(6, 7)"), 42.0);
+    assert_eq!(num("Function('return 3')()"), 3.0);
+    assert_eq!(num("var anonymous = 42; Function('return anonymous')()"), 42.0);
+    let e = fail("new Function('a){}; (function(', 'return 1')");
+    assert!(e.message.starts_with("SyntaxError"), "{}", e.message);
+    let e = fail("new Function('}); (function() {')");
+    assert!(e.message.starts_with("SyntaxError"), "{}", e.message);
+    let e = fail("eval('var = 1')");
+    assert!(e.message.starts_with("SyntaxError"), "{}", e.message);
+    truth("try { eval('a b') } catch (e) { e instanceof SyntaxError }");
+    assert_eq!(string("(function f(a) { return a; }).toString()"), "function f(a) { return a; }");
+}
+
+#[test]
+fn strict_mode_assignments_and_errors() {
+    let e = fail("'use strict'; undeclared = 1;");
+    assert!(e.message.starts_with("ReferenceError"), "{}", e.message);
+    assert_eq!(num("undeclared = 1; undeclared"), 1.0);
+    let e = fail("'use strict'; (function f() { f = 1; })()");
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+    assert_eq!(num("var g = function f() { f = 1; return typeof f === 'function' ? 1 : 0; }; g()"), 1.0);
+    let e = fail("'use strict'; NaN = 1;");
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+    let e = fail("'use strict'; (function() {}).caller");
+    assert!(e.message.starts_with("TypeError"), "{}", e.message);
+    truth("var o = {}; try { o.x.y; false } catch (e) { e instanceof TypeError && e.constructor === TypeError }");
+    truth(
+        "try { nope; } catch (e) { e instanceof ReferenceError && e.name === 'ReferenceError' && String_(e) === 'ReferenceError: nope is not defined' } function String_(v) { return '' + v; }",
+    );
+    truth(
+        "new Error('m').message === 'm' && Error('m') instanceof Error && new TypeError().message === '' && new RangeError('r').toString() === 'RangeError: r'",
+    );
+}
+
+#[test]
+fn errors_carry_line_and_column() {
+    let e = fail("var a = 1;\nvar b = 2;\n  nope();");
+    assert_eq!((e.kind, e.line, e.column), (RunErrorKind::Thrown, 3, 3));
+    assert_eq!(e.message, "ReferenceError: nope is not defined");
+    let e = fail("function f() {\n  throw new TypeError('bad');\n}\nf();");
+    assert_eq!((e.line, e.column), (2, 3));
+    assert_eq!(e.message, "TypeError: bad");
+    let e = fail("var x = ;");
+    assert_eq!((e.kind, e.line), (RunErrorKind::Syntax, 1));
+    let e = fail("throw 42");
+    assert_eq!(e.message, "42");
+}
+
+#[test]
+fn host_functions_receive_arguments_and_return_values() {
+    let mut realm = Realm::new();
+    realm.define_function("add", |args| match args {
+        [JsValue::Number(a), JsValue::Number(b)] => Ok(JsValue::Number(a + b)),
+        _ => Err("add takes two numbers".into()),
+    });
+    assert_eq!(realm.run("add(2, 3)"), Ok(JsValue::Number(5.0)));
+    let e = realm.run("add('x')").unwrap_err();
+    assert_eq!(e.message, "Error: add takes two numbers");
+    assert_eq!(realm.run("try { add(); } catch (e) { e.message }"), Ok(JsValue::String("add takes two numbers".into())));
+    assert_eq!(realm.run("var kept = 1; 'next'"), Ok(JsValue::String("next".into())));
+    assert_eq!(realm.run("kept"), Ok(JsValue::Number(1.0)), "a realm keeps its globals between runs");
+}
+
+// ---- limits ----
+
+fn limit(realm: &mut Realm, src: &str) -> LimitKind {
+    match realm.run(src) {
+        Err(RunError { kind: RunErrorKind::Limit(k), .. }) => k,
+        other => panic!("{src}: {other:?}"),
+    }
+}
+
+fn with_big(limits: Limits) -> Realm {
+    let mut realm = small(limits);
+    realm.define_function("big", |args| match args {
+        [JsValue::Number(n)] => Ok(JsValue::String("x".repeat(*n as usize))),
+        _ => Err("big takes a length".into()),
+    });
+    realm.define_function("fail", |args| match args {
+        [JsValue::Number(n)] => Err("x".repeat(*n as usize)),
+        _ => Err("fail takes a length".into()),
+    });
+    realm
+}
+
+#[test]
+fn error_messages_from_host_functions_count_toward_the_heap() {
+    let limits = Limits { heap_bytes: 1 << 20, fuel: 100_000, ..Limits::default() };
+    let mut realm = with_big(limits.clone());
+    assert_eq!(realm.run("try { fail(1000); } catch (e) { e.message.length }"), Ok(JsValue::Number(1000.0)));
+    assert_eq!(limit(&mut with_big(limits.clone()), "try { fail(1000000); } catch (e) {}"), LimitKind::Heap);
+    assert_eq!(limit(&mut with_big(limits), "var a = []; for (var i = 0; ; i++) try { fail(100000); } catch (e) { a[i] = e; }"), LimitKind::Heap);
+}
+
+#[test]
+fn names_from_source_count_toward_the_heap_when_they_are_bound() {
+    // Without a collection in between, the estimate grows by at least each new name's code units:
+    // a global variable (an object property), a binding made by direct eval, and a parameter of a
+    // function made by the Function constructor.
+    // Each case runs in a new realm, so the charges for the code itself do not add up to a
+    // collection.
+    let name = "n".repeat(50_000);
+    let cases = [
+        format!("var {name} = 1;"),
+        format!("(function () {{ eval('var {name}2 = 1; {name}2'); }})();"),
+        format!("Function('{name}3', 'return {name}3')(1);"),
+    ];
+    let mut short = Vec::new();
+    for (i, src) in cases.iter().enumerate() {
+        let mut realm = small(Limits::default());
+        let collections = realm.interp().heap.collections;
+        let before = realm.interp().heap.bytes;
+        realm.run(src).unwrap();
+        assert_eq!(realm.interp().heap.collections, collections, "a collection ran in case {i}");
+        let grown = realm.interp().heap.bytes - before;
+        if grown < crate::heap::string_bytes(50_000) {
+            short.push((i, grown));
+        }
+    }
+    assert!(short.is_empty(), "cases that grew by less than the name: {short:?}");
+}
+
+#[test]
+fn strings_from_host_functions_count_toward_the_heap() {
+    let limits = Limits { heap_bytes: 1 << 20, fuel: 100_000, ..Limits::default() };
+    let mut realm = with_big(limits.clone());
+    assert_eq!(realm.run("big(1000).length"), Ok(JsValue::Number(1000.0)));
+    assert_eq!(realm.run("var a = []; for (var i = 0; i < 4; i++) a[i] = big(50000); a[3].length"), Ok(JsValue::Number(50000.0)));
+    assert_eq!(limit(&mut with_big(limits.clone()), "var a = []; for (var i = 0; ; i++) a[i] = big(100000);"), LimitKind::Heap);
+    assert_eq!(limit(&mut with_big(limits), "big(1000000).length"), LimitKind::Heap);
+}
+
+#[test]
+fn functions_kept_across_runs_count_their_code_toward_the_heap() {
+    // Each run keeps a function whose source holds a 64 Ki-unit comment, and drops the string the
+    // source was made from. The kept code fills the heap after a few runs.
+    let limits = Limits { heap_bytes: 1 << 20, ..Limits::default() };
+    let mut realm = small(limits);
+    assert_eq!(realm.run("var keep = []; keep.length"), Ok(JsValue::Number(0.0)));
+    let step = "var s = 'x'; for (var i = 0; i < 16; i++) s += s; keep[keep.length] = Function('/*' + s + '*/'); s = null; keep.length";
+    let mut ended = None;
+    for run in 1..=20 {
+        match realm.run(step) {
+            Ok(v) => assert_eq!(v, JsValue::Number(f64::from(run))),
+            Err(RunError { kind: RunErrorKind::Limit(k), .. }) => {
+                ended = Some((run, k));
+                break;
+            }
+            Err(e) => panic!("run {run}: {e:?}"),
+        }
+    }
+    let Some((run, kind)) = ended else { panic!("20 kept functions fit in a 1 MiB heap") };
+    assert_eq!(kind, LimitKind::Heap);
+    assert!(run > 2, "the heap filled on run {run}");
+}
+
+#[test]
+fn function_source_text_counts_toward_the_heap() {
+    let limits = Limits { heap_bytes: 1 << 20, ..Limits::default() };
+    let comment = "x".repeat(300_000);
+    let src = format!("var f = function () {{ /*{comment}*/ }}; f.toString().length");
+    assert_eq!(limit(&mut small(limits.clone()), &src), LimitKind::Heap);
+    let mut realm = small(limits);
+    assert_eq!(realm.run("(function f(a) { return a; }).toString()"), Ok(JsValue::String("function f(a) { return a; }".into())));
+}
+
+#[test]
+fn for_in_names_take_fuel_and_heap_under_later_limits() {
+    // The first run, under the default limits, builds an object with many properties. Later runs
+    // with smaller limits list its names only within their own fuel and heap.
+    let mut realm = small(Limits::default());
+    assert_eq!(realm.run("var o = {}; for (var i = 0; i < 100000; i++) o['k' + i] = i; o.k99999"), Ok(JsValue::Number(99999.0)));
+    realm.set_limits(Limits { fuel: 1000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "for (var k in o) break;"), LimitKind::Fuel);
+    realm.set_limits(Limits::default());
+    assert_eq!(realm.run("var n = 0; for (var k in o) n++; n"), Ok(JsValue::Number(100_000.0)));
+    realm.interp().collect_garbage();
+    let live = realm.interp().heap.bytes;
+    // The list of names takes more than 3 MB (at least 32 + 2 * 2 bytes each), so 1 MiB more than
+    // the live heap holds the object but not the list.
+    let heap_bytes = live + (1 << 20);
+    realm.set_limits(Limits { heap_bytes, ..Limits::default() });
+    assert_eq!(realm.run("o.k0"), Ok(JsValue::Number(0.0)));
+    assert_eq!(limit(&mut realm, "for (var k in o) break;"), LimitKind::Heap);
+    // The run ends before the list is made, so the estimate stays within the limit.
+    assert!(realm.interp().heap.bytes <= heap_bytes, "{} > {heap_bytes}", realm.interp().heap.bytes);
+}
+
+#[test]
+fn shrinking_an_array_takes_fuel_for_each_property() {
+    let mut realm = small(Limits::default());
+    assert_eq!(realm.run("var a = []; for (var i = 0; i < 100000; i++) a[i] = i; a.length"), Ok(JsValue::Number(100_000.0)));
+    realm.set_limits(Limits { fuel: 1000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "a.length = 0;"), LimitKind::Fuel);
+    realm.set_limits(Limits::default());
+    // The run stopped before anything was removed.
+    assert_eq!(realm.run("a.length + a[99999]"), Ok(JsValue::Number(199_999.0)));
+    assert_eq!(realm.run("a.length = 1; a.length + a[0] + (99999 in a ? 1 : 0)"), Ok(JsValue::Number(1.0)));
+}
+
+#[test]
+fn apply_takes_fuel_for_each_argument_it_reads() {
+    let mut realm = small(Limits { fuel: 1000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "(function () {}).apply(null, {length: 65536});"), LimitKind::Fuel);
+    assert_eq!(realm.run("(function () { return arguments.length; }).apply(null, {length: 100})"), Ok(JsValue::Number(100.0)));
+}
+
+#[test]
+fn declarations_check_the_heap_before_they_are_bound() {
+    // Each script declares more than fits in the heap. The run ends with the heap limit before
+    // the bindings are made, so the estimate never goes past the limit.
+    // Short names keep the source strings well inside the heap while the bindings are not.
+    let limits = Limits { heap_bytes: 2 << 20, ..Limits::default() };
+    let short = |mut i: usize| {
+        let mut name = String::from("_");
+        loop {
+            name.push(char::from(b'a' + (i % 26) as u8));
+            i /= 26;
+            if i == 0 {
+                return name;
+            }
+        }
+    };
+    let vars = (0..40_000).map(short).collect::<Vec<_>>().join(",");
+    let funs = (0..20_000).map(|i| format!("function f{i}() {{}}")).collect::<String>();
+    let cases = [
+        format!("var {vars};"),
+        funs.clone(),
+        format!("(function () {{ eval('var {vars};'); }})();"),
+        format!("(function () {{ eval('{funs}'); }})();"),
+        format!("(0, eval)('\"use strict\"; var {vars};');"),
+        format!("Function('var {vars};')();"),
+        format!("Function('{funs}')();"),
+    ];
+    let mut wrong = Vec::new();
+    for (i, src) in cases.iter().enumerate() {
+        let mut realm = small(limits.clone());
+        let r = realm.run(src).map_err(|e| e.kind);
+        let bytes = realm.interp().heap.bytes;
+        if r != Err(RunErrorKind::Limit(LimitKind::Heap)) || bytes > limits.heap_bytes {
+            wrong.push((i, r, bytes));
+        }
+    }
+    assert!(wrong.is_empty(), "cases that bound past the limit: {wrong:?}");
+    let few = (0..1000).map(|i| format!("b{i}")).collect::<Vec<_>>().join(",");
+    let mut realm = small(limits);
+    assert_eq!(realm.run(&format!("var {few}; b999 = 1; Function('var {few}; return 2')() + b999")), Ok(JsValue::Number(3.0)));
+}
+
+#[test]
+fn declarations_take_fuel() {
+    let vars = (0..10_000).map(|i| format!("a{i}")).collect::<Vec<_>>().join(",");
+    let mut realm = small(Limits { fuel: 1000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, &format!("var {vars};")), LimitKind::Fuel);
+    assert_eq!(limit(&mut realm, &format!("Function('var {vars};')();")), LimitKind::Fuel);
+}
+
+#[test]
+fn a_lower_heap_limit_applies_to_what_is_already_live() {
+    // A heap already past the new limit ends the next run.
+    let mut realm = small(Limits::default());
+    realm.run("var keep = []; for (var i = 0; i < 100000; i++) keep[i] = {i: i};").unwrap();
+    realm.set_limits(Limits { heap_bytes: 1 << 20, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "for (var j = 0; j < 1000; j++) ({j: j});"), LimitKind::Heap);
+    realm.set_limits(Limits::default());
+    realm.run("keep = null;").unwrap();
+    realm.set_limits(Limits { heap_bytes: 1 << 20, ..Limits::default() });
+    assert_eq!(realm.run("for (var j = 0; j < 1000; j++) ({j: j}); j"), Ok(JsValue::Number(1000.0)));
+    // A heap below the new limit cannot grow past it: the next collection runs by the new limit,
+    // not by when it would have run under the old, higher one.
+    let mut realm = small(Limits::default());
+    realm.run("var keep = []; for (var i = 0; i < 100000; i++) keep[i] = {i: i};").unwrap();
+    let live = realm.collect_garbage();
+    realm.set_limits(Limits { heap_bytes: live + (1 << 20), ..Limits::default() });
+    assert_eq!(limit(&mut realm, "var more = []; for (var j = 0; j < 20000; j++) more[j] = {j: j};"), LimitKind::Heap);
+}
+
+#[test]
+fn apply_keeps_its_arguments_alive_while_a_native_function_runs() {
+    // The first argument's toString makes 20,000 objects, more than a 1 MiB heap holds, so a
+    // collection runs before it returns. The second argument is reachable only from the list
+    // that apply read from the array-like object.
+    let mut realm = small(Limits { heap_bytes: 1 << 20, ..Limits::default() });
+    let src = "var list = {length: 2, \
+        get 0() { return {toString: function () { for (var i = 0; i < 20000; i++) ({i: i}); return 'a'; }}; }, \
+        get 1() { return {toString: function () { return 'return a * 2'; }}; }}; \
+        Function.apply(null, list)(21)";
+    assert_eq!(realm.run(src), Ok(JsValue::Number(42.0)));
+}
+
+#[test]
+fn to_number_skips_the_white_space_the_lexer_skips() {
+    let mut realm = small(Limits::default());
+    assert_eq!(realm.run("var n = +'\\u180E'; n !== n"), Ok(JsValue::Bool(true)), "U+180E is not white space");
+    assert_eq!(realm.run("var m = +'\\u180E1'; m !== m"), Ok(JsValue::Bool(true)));
+    assert_eq!(realm.run("+' \\t\\n\\u2028\\u3000\\uFEFF 1 \\u00A0'"), Ok(JsValue::Number(1.0)));
+    assert_eq!(realm.run("+'   1 '"), Ok(JsValue::Number(1.0)));
+}
+
+#[test]
+fn an_infinite_loop_ends_with_the_fuel_limit() {
+    let mut realm = small(Limits { fuel: 100_000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "for (;;) {}"), LimitKind::Fuel);
+    assert_eq!(limit(&mut realm, "while (true) { try { for (;;) {} } catch (e) {} }"), LimitKind::Fuel);
+    assert_eq!(limit(&mut realm, "var n = 0; try { for (;;) {} } finally { n = 1; } "), LimitKind::Fuel);
+    assert_eq!(
+        limit(&mut realm, "function f() { try { for (;;) {} } finally { for (;;) {} } } while (true) { try { f(); } catch (e) {} }"),
+        LimitKind::Fuel
+    );
+    assert_eq!(realm.run("n"), Ok(JsValue::Number(0.0)), "the finally block did not run");
+    assert_eq!(realm.run("1 + 1"), Ok(JsValue::Number(2.0)), "each run gets fresh fuel");
+}
+
+#[test]
+fn deep_recursion_ends_with_the_frame_limit_on_a_small_stack() {
+    let handle = std::thread::Builder::new()
+        .stack_size(256 << 10)
+        .spawn(|| {
+            let mut realm = Realm::new();
+            let r = realm.run("function f(n) { return n === 0 ? 0 : 1 + f(n - 1); } f(1000000)");
+            let ok = realm.run("function g(n) { return n === 0 ? 0 : 1 + g(n - 1); } g(5000)");
+            let caught = realm.run("function h(n) { try { return h(n + 1); } catch (e) { return -1; } } h(0)");
+            (r, ok, caught)
+        })
+        .unwrap();
+    let (r, ok, caught) = handle.join().unwrap();
+    assert_eq!(r.map_err(|e| e.kind), Err(RunErrorKind::Limit(LimitKind::Frames)));
+    assert_eq!(ok, Ok(JsValue::Number(5000.0)));
+    assert_eq!(caught.map_err(|e| e.kind), Err(RunErrorKind::Limit(LimitKind::Frames)), "catch cannot swallow the frame limit");
+}
+
+#[test]
+fn reentry_through_getters_ends_with_the_reentry_limit() {
+    let handle = std::thread::Builder::new()
+        .stack_size(8 << 20)
+        .spawn(|| {
+            let mut realm = Realm::new();
+            let getter = realm.run("var o = { get x() { return this.x; } }; o.x");
+            let conversion = realm.run("var v = { valueOf: function() { return v * 1; } }; v * 1");
+            let eval = realm.run("function e() { return (0, eval)('e()'); } e()");
+            (getter, conversion, eval)
+        })
+        .unwrap();
+    let (getter, conversion, eval) = handle.join().unwrap();
+    for r in [getter, conversion, eval] {
+        assert_eq!(r.map_err(|e| e.kind), Err(RunErrorKind::Limit(LimitKind::Reentry)));
+    }
+}
+
+#[test]
+fn the_script_itself_does_not_count_against_the_reentry_limit() {
+    let mut realm = small(Limits { reentry: 0, ..Limits::default() });
+    assert_eq!(realm.run("1 + 1"), Ok(JsValue::Number(2.0)));
+    assert_eq!(limit(&mut realm, "var o = { get x() { return 1; } }; o.x"), LimitKind::Reentry);
+    realm.set_limits(Limits { reentry: 1, ..Limits::default() });
+    assert_eq!(realm.run("o.x"), Ok(JsValue::Number(1.0)));
+    assert_eq!(realm.run("(0, eval)('2 + 2')"), Ok(JsValue::Number(4.0)));
+    assert_eq!(limit(&mut realm, "var p = { get x() { return o.x; } }; p.x"), LimitKind::Reentry);
+}
+
+#[test]
+fn memory_bombs_end_with_the_heap_limit() {
+    let limits = Limits { heap_bytes: 4 << 20, ..Limits::default() };
+    for src in [
+        "var a = null; for (;;) a = {next: a, v: [a, a]};",
+        "var s = 'x'; for (;;) s = s + s;",
+        "var a = []; for (var i = 0; ; i++) a[i] = 'item' + i;",
+        "var s = 'x'; for (;;) { s = s + s; var o = {}; o[s] = 1; }",
+    ] {
+        let mut realm = small(limits.clone());
+        assert_eq!(limit(&mut realm, src), LimitKind::Heap, "{src}");
+        // What the bomb built is still reachable from the globals; raising the limit lets the
+        // realm drop it.
+        realm.set_limits(Limits::default());
+        assert_eq!(realm.run("a = s = null; 1"), Ok(JsValue::Number(1.0)));
+        realm.set_limits(limits.clone());
+        assert_eq!(realm.run("2"), Ok(JsValue::Number(2.0)));
+    }
+}
+
+#[test]
+fn garbage_is_collected_cycles_included() {
+    let mut realm = small(Limits { heap_bytes: 2 << 20, ..Limits::default() });
+    let src = "for (var i = 0; i < 200000; i++) { var a = {}, b = {a: a, s: 'x' + i}; a.b = b; } i";
+    assert_eq!(realm.run(src), Ok(JsValue::Number(200_000.0)));
+    assert!(realm.interp().heap.collections > 0);
+    let before = realm.collect_garbage();
+    realm.run("var keep = []; for (var j = 0; j < 1000; j++) keep[j] = {j: j};").unwrap();
+    let live = realm.collect_garbage();
+    realm.run("keep = null;").unwrap();
+    let after = realm.collect_garbage();
+    assert!(live > before && after < live, "{before} {live} {after}");
+    let cells = realm.interp().heap.live_cells();
+    assert!(cells < 200, "{cells} cells are still live");
+}
+
+#[test]
+fn a_million_appends_flatten_without_recursion() {
+    let handle = std::thread::Builder::new()
+        .stack_size(1 << 20)
+        .spawn(|| {
+            let mut realm = Realm::new();
+            realm.run("var s = '', t = ''; for (var i = 0; i < 1000000; i++) { s += 'ab'; t = t + 'ab'; } s.length === 2000000 && s === t && s[1999999] === 'b'")
+        })
+        .unwrap();
+    assert_eq!(handle.join().unwrap(), Ok(JsValue::Bool(true)));
+}
+
+#[test]
+fn the_interrupt_flag_stops_a_run() {
+    let mut realm = Realm::new();
+    let flag = realm.interrupt();
+    flag.set();
+    assert_eq!(limit(&mut realm, "1 + 1"), LimitKind::Interrupted);
+    flag.clear();
+    assert_eq!(realm.run("1 + 1"), Ok(JsValue::Number(2.0)));
+    let from_host = realm.interrupt();
+    realm.define_function("stop", move |_| {
+        from_host.set();
+        Ok(JsValue::Undefined)
+    });
+    assert_eq!(limit(&mut realm, "for (var i = 0; ; i++) { if (i === 1000) stop(); }"), LimitKind::Interrupted);
+    assert!(flag.is_set());
+    assert_eq!(limit(&mut realm, "i"), LimitKind::Interrupted, "the flag stays set");
+    flag.clear();
+    assert_eq!(realm.run("i"), Ok(JsValue::Number(1000.0)));
+}
+
+#[test]
+fn eval_and_function_source_counts_against_the_source_limit() {
+    let mut realm = Realm::with_options(Options { max_source_units: 200, ..Options::default() }, Limits::default());
+    assert_eq!(realm.run("eval('1 + 1')"), Ok(JsValue::Number(2.0)));
+    let e = realm.run("var s = 'x'; for (var i = 0; i < 8; i++) s += s; eval(s)").unwrap_err();
+    assert!(e.message.contains(crate::TOO_LONG), "{e:?}");
+    let e = realm.run("for (var i = 0; i < 20; i++) eval('1 + 1 + 1 + 1 + 1 + 1 + 1 + 1');").unwrap_err();
+    assert!(e.message.contains(crate::TOO_LONG), "the sources of one run count together: {e:?}");
+    let e = realm.run("Function('return 1;' + '                                                                                                                                                                                                       ')").unwrap_err();
+    assert!(e.message.contains(crate::TOO_LONG), "{e:?}");
+}
+
+#[test]
+fn the_function_constructor_checks_the_source_limit_before_reading_its_arguments() {
+    // A rope argument that is too long is refused before it is flattened.
+    let mut realm = Realm::with_options(Options { max_source_units: 1000, ..Options::default() }, Limits::default());
+    let e = realm.run("var s = 'return 1;'; for (var i = 0; i < 12; i++) s += s; Function('a', s)").unwrap_err();
+    assert!(e.message.contains(crate::TOO_LONG), "{e:?}");
+    let interp = realm.interp();
+    match interp.find_property(interp.global, &crate::heap::key("s")) {
+        Ok(Some(crate::heap::Prop::Data { value: crate::value::Value::String(s), .. })) => assert!(s.is_rope(), "the argument was flattened"),
+        other => panic!("{other:?}"),
+    }
+    // The source is read as code units, so a lone surrogate in an argument is kept.
+    let mut realm = Realm::new();
+    assert_eq!(realm.run("Function('return \"\\ud800\"')() === '\\ud800'"), Ok(JsValue::Bool(true)));
+}
+
+#[test]
+fn a_script_longer_than_the_source_limit_is_a_syntax_error() {
+    let mut realm = Realm::with_options(Options { max_source_units: 10, ..Options::default() }, Limits::default());
+    let e = realm.run("1 + 2 + 3 + 4").unwrap_err();
+    assert_eq!((&e.kind, e.message.contains(crate::TOO_LONG)), (&RunErrorKind::Syntax, true), "{e:?}");
+    // Ten UTF-16 code units in 18 bytes of UTF-8 fit.
+    assert_eq!(realm.run("'\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}\u{e9}'"), Ok(JsValue::String("\u{e9}".repeat(8))));
+    let mut realm = Realm::with_options(Options { max_source_units: 40, ..Options::default() }, Limits::default());
+    let e = realm.run("Function('return 1;')").unwrap_err();
+    assert_eq!((&e.kind, e.message.contains(crate::TOO_LONG)), (&RunErrorKind::Thrown, true), "{e:?}");
+}
+
+#[test]
+fn bind_last_thrown_binds_undefined_after_a_run_that_did_not_throw() {
+    let mut realm = Realm::new();
+    assert_eq!(realm.run("throw 'first'").map_err(|e| e.kind), Err(RunErrorKind::Thrown));
+    realm.bind_last_thrown("caught");
+    assert_eq!(realm.run("caught"), Ok(JsValue::String("first".into())));
+    assert_eq!(realm.run("1 + 1"), Ok(JsValue::Number(2.0)));
+    realm.bind_last_thrown("caught");
+    assert_eq!(realm.run("caught"), Ok(JsValue::Undefined));
+    let _ = realm.run("throw 'second'");
+    assert_eq!(realm.run("var").map_err(|e| e.kind), Err(RunErrorKind::Syntax));
+    realm.bind_last_thrown("caught");
+    assert_eq!(realm.run("caught"), Ok(JsValue::Undefined), "a run that does not parse throws nothing");
+    realm.set_limits(Limits { fuel: 100, ..Limits::default() });
+    let _ = realm.run("throw 'third'");
+    assert_eq!(limit(&mut realm, "for (;;) {}"), LimitKind::Fuel);
+    realm.bind_last_thrown("caught");
+    realm.set_limits(Limits::default());
+    assert_eq!(realm.run("caught"), Ok(JsValue::Undefined), "a run that reached a limit threw nothing");
+}
+
+#[test]
+fn a_strict_realm_runs_scripts_as_strict_mode_code() {
+    let mut realm = Realm::with_options(Options { strict: true, ..Options::default() }, Limits::default());
+    assert_eq!(realm.run("with ({}) {}").map_err(|e| e.kind), Err(RunErrorKind::Syntax));
+    assert_eq!(realm.run("(function () { return this; })()"), Ok(JsValue::Undefined));
+    assert_eq!(realm.run("(function () { return typeof this; })()"), Ok(JsValue::String("undefined".into())));
+    let mut realm = Realm::new();
+    assert_eq!(realm.run("with ({}) {} 1"), Ok(JsValue::Number(1.0)));
+    assert_eq!(realm.run("(function () { return typeof this; })()"), Ok(JsValue::String("object".into())));
+}
+
+#[test]
+fn an_apply_that_throws_while_reading_its_arguments_keeps_nothing_alive() {
+    // Each call reads a fresh array at index 0 before index 1 throws; the arrays must not stay
+    // reachable after the call ends.
+    let mut realm = small(Limits { heap_bytes: 2 << 20, ..Limits::default() });
+    let src = "function f() {} var caught = 0; \
+        var list = {length: 2, get 0() { var a = []; for (var k = 0; k < 100; k++) a[k] = k; return a; }, get 1() { throw 'stop'; }}; \
+        for (var i = 0; i < 5000; i++) { try { f.apply(null, list); } catch (e) { caught++; } } caught";
+    assert_eq!(realm.run(src), Ok(JsValue::Number(5000.0)));
+}
+
+#[test]
+fn for_in_over_a_long_string_checks_the_heap_before_listing_its_indices() {
+    // The string fits in the heap and its 131,072 index names do not. The fuel runs out partway
+    // through listing them, so only the check before the listing ends the run with the heap limit.
+    let mut realm = small(Limits { heap_bytes: 1 << 20, fuel: 50_000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "var s = 'x'; while (s.length < 100000) s += s; for (var k in s) {}"), LimitKind::Heap);
+    assert_eq!(realm.run("var n = ''; for (var k in 'abc') n += k; n"), Ok(JsValue::String("012".into())));
+}
+
+#[test]
+fn long_property_names_count_toward_the_heap_after_their_strings_are_collected() {
+    // Each name is a 16,385-unit buffer that only the object's key or the function's binding
+    // holds once the string that made it is garbage, so about 32 of them fill the heap well before
+    // the fuel runs out. In the second script the property lookup flattens a long string each
+    // time, so collections run.
+    let mut realm = small(Limits { heap_bytes: 1 << 20, fuel: 20_000, ..Limits::default() });
+    let src = "var s = 'x'; while (s.length < 10000) s += s; var o = {}; for (var i = 0; ; i++) o[s + i] = 1;";
+    assert_eq!(limit(&mut realm, src), LimitKind::Heap);
+    let src = "var s = 'x'; while (s.length < 10000) s += s; \
+        (function () { for (var i = 0; ; i++) { eval('var ' + s + i + ' = 1'); ({})[s + i]; } })();";
+    let mut realm = small(Limits { heap_bytes: 1 << 20, fuel: 20_000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, src), LimitKind::Heap);
+}
+
+#[test]
+fn for_in_over_a_long_string_takes_fuel_for_each_index() {
+    let mut realm = small(Limits { fuel: 10_000, ..Limits::default() });
+    assert_eq!(limit(&mut realm, "var s = 'x'; while (s.length < 100000) s += s; for (var k in s) break;"), LimitKind::Fuel);
+}
+
+#[test]
+fn wasm_builds_have_smaller_default_limits() {
+    let limits = Limits::default();
+    #[cfg(target_arch = "wasm32")]
+    assert_eq!(limits, Limits { fuel: 250_000_000, heap_bytes: 128 << 20, frames: 2_000, reentry: 16 });
+    #[cfg(not(target_arch = "wasm32"))]
+    assert_eq!(limits, Limits { fuel: 1_000_000_000, heap_bytes: 512 << 20, frames: 10_000, reentry: 32 });
+}
+
+#[test]
+fn deep_nesting_compiles_on_a_small_stack() {
+    let n = crate::DEFAULT_MAX_DEPTH - 5;
+    let cases = [
+        format!("x = {}1{};", "[".repeat(n), "]".repeat(n)),
+        format!("x = {}1{};", "{a:".repeat(n), "}".repeat(n)),
+        format!("{}{}", "function f(){".repeat(n), "}".repeat(n)),
+        format!("{}x = 1;", "if (1) ".repeat(n)),
+        format!("x = {}1;", "1 ? 1 : ".repeat(n)),
+        format!("x = 0; {}x++;{}", "while (x < 1) { try { ".repeat(n / 2), " } finally { } }".repeat(n / 2)),
+    ];
+    let handle = std::thread::Builder::new()
+        .stack_size(1 << 20)
+        .spawn(move || cases.iter().map(|src| Realm::new().run(src).map(|_| ()).map_err(|e| e.kind)).collect::<Vec<_>>())
+        .unwrap();
+    for r in handle.join().unwrap() {
+        assert!(r.is_ok() || r == Err(RunErrorKind::Syntax), "{r:?}");
+    }
+    let long = [
+        format!("x = 1{};", " + 1".repeat(100_000)),
+        format!("{}x = 1;", "a = ".repeat(100_000)),
+        format!("x = {{}}; x.y = x; x{};", ".y".repeat(100_000)),
+    ];
+    for src in &long {
+        Realm::new().run(src).unwrap();
+    }
+    assert_eq!(num(&format!("var a; {}1; a", "a = ".repeat(100_000))), 1.0);
+    assert_eq!(num(&format!("x = 1{}", " + 1".repeat(100_000))), 100_001.0);
+}
+
+// ---- the verifier ----
+
+fn code(ops: Vec<Op>) -> Code {
+    let source = Rc::new(Source { lines: crate::LineTable::new(&[]), text: Rc::from(Vec::<u16>::new()) });
+    Code {
+        positions: vec![0; ops.len()],
+        ops,
+        numbers: vec![1.0],
+        strings: Vec::new(),
+        names: Vec::new(),
+        functions: Vec::new(),
+        regexps: Vec::new(),
+        handlers: Vec::new(),
+        finally_tables: Vec::new(),
+        max_stack: 0,
+        strict: false,
+        self_name: None,
+        params: Vec::new(),
+        vars: Vec::new(),
+        fun_decls: Vec::new(),
+        uses_arguments: false,
+        source,
+        span: (0, 0),
+    }
+}
+
+#[test]
+fn the_verifier_rejects_bad_bytecode() {
+    assert_eq!(verify(&code(vec![Op::Number(0), Op::Return])), Ok(1));
+    let bad: Vec<(Vec<Op>, &str)> = vec![
+        (vec![Op::Jump(9)], "past the end"),
+        (vec![Op::Pop, Op::Undefined, Op::Return], "pops below"),
+        (vec![Op::Number(5), Op::Return], "number 5 out of range"),
+        (vec![Op::GetVar(0), Op::Return], "name 0 out of range"),
+        (vec![Op::Closure(0), Op::Return], "function 0 out of range"),
+        (vec![Op::Undefined], "past its last instruction"),
+        (vec![Op::True, Op::JumpIfFalse(3), Op::Undefined, Op::Undefined, Op::Return], "depths"),
+        (vec![Op::Undefined, Op::Undefined, Op::EndFinally(0)], "finally table 0"),
+        (vec![], "no instructions"),
+    ];
+    for (ops, want) in bad {
+        let e = verify(&code(ops.clone())).unwrap_err();
+        assert!(e.contains(want), "{ops:?}: {e}");
+    }
+    let mut c = code(vec![Op::Undefined, Op::Return]);
+    c.handlers.push(Handler { start: 0, end: 5, target: 0, depth: 0, env_depth: 0 });
+    assert!(verify(&c).unwrap_err().contains("handler range"));
+}
+
+#[test]
+fn every_compiled_function_passes_the_verifier() {
+    // Each code is verified as it is compiled; a failure would surface as an internal error.
+    let src = "function f(a) { try { for (var k in a) { switch (k) { case 'x': continue; default: break; } } } catch (e) { return e; } finally { a = 0; } \
+               with (a) { lbl: do { if (b) break lbl; } while (0); } return function() { return arguments; }; } 1";
+    assert_eq!(run(src), JsValue::Number(1.0));
+}
+
+// ---- robustness ----
+
+proptest! {
+    #![proptest_config(ProptestConfig::with_cases(256))]
+
+    #[test]
+    fn arbitrary_fragment_programs_never_panic(parts in proptest::collection::vec(0..crate::tests::FRAGMENTS.len(), 0..60)) {
+        let src: String = parts.iter().map(|&i| crate::tests::FRAGMENTS[i]).collect();
+        let mut realm = small(Limits { fuel: 20_000, heap_bytes: 1 << 20, frames: 200, reentry: 8 });
+        if let Err(e) = realm.run(&src) {
+            prop_assert!(e.kind != RunErrorKind::Internal, "{src:?}: {e:?}");
+        }
+    }
+
+    #[test]
+    fn arbitrary_text_never_panics(src in ".{0,120}") {
+        let mut realm = small(Limits { fuel: 20_000, heap_bytes: 1 << 20, frames: 200, reentry: 8 });
+        if let Err(e) = realm.run(&src) {
+            prop_assert!(e.kind != RunErrorKind::Internal, "{src:?}: {e:?}");
+        }
+    }
+}
diff --git a/crates/js/src/lexer.rs b/crates/js/src/lexer.rs
index 9b16b16c7..8b82570a7 100644
--- a/crates/js/src/lexer.rs
+++ b/crates/js/src/lexer.rs
@@ -13,7 +13,7 @@
 //!
 //! The lexer moves forward through the source one character at a time and never recurses.
 
-use crate::chars::{hex_value, is_decimal_digit, is_id_part, is_id_start, is_line_terminator, is_octal_digit, is_whitespace};
+use crate::chars::{hex_value, is_decimal_digit, is_id_part, is_id_start, is_line_terminator, is_octal_digit, is_whitespace, radix_value};
 use crate::error::SyntaxError;
 use crate::regexp;
 use crate::token::{Directive, DirectiveName, Keyword, Punct, Span, Token, TokenKind};
@@ -352,26 +352,10 @@ impl<'s> Lexer<'s> {
     /// Reads digits in `radix` (8 or 16) and returns their value, or `None` when there are none.
     fn radix_digits(&mut self, radix: u32) -> Option<f64> {
         let begin = self.pos;
-        let mut exact: u128 = 0;
-        let mut value = 0.0_f64;
-        let mut overflow = false;
-        while let Some(d) = self.peek().and_then(hex_value).filter(|&d| d < radix) {
-            match exact.checked_mul(u128::from(radix)).and_then(|v| v.checked_add(u128::from(d))) {
-                Some(v) if !overflow => exact = v,
-                _ => {
-                    if !overflow {
-                        value = exact as f64;
-                        overflow = true;
-                    }
-                    value = value * f64::from(radix) + f64::from(d);
-                }
-            }
+        while self.peek().and_then(hex_value).is_some_and(|d| d < radix) {
             self.pos += 1;
         }
-        if self.pos == begin {
-            return None;
-        }
-        Some(if overflow { value } else { exact as f64 })
+        radix_value(self.src[begin..self.pos].iter().filter_map(|&u| hex_value(u32::from(u))), radix)
     }
 
     /// After `0` and a digit: an octal literal when every digit is octal, else a decimal literal
diff --git a/crates/js/src/lib.rs b/crates/js/src/lib.rs
index 4d8d32271..9c0c192aa 100644
--- a/crates/js/src/lib.rs
+++ b/crates/js/src/lib.rs
@@ -18,16 +18,34 @@
 //! `SyntaxError` ("nesting too deep") instead of exhausting the stack, binary operators, `if` …
 //! `else if` chains, labels and prefix operators are read with loops, and the syntax tree is
 //! dropped without recursion.
+//!
+//! A [`Realm`] runs scripts. It compiles the syntax tree to bytecode, checks the bytecode with a
+//! verifier, and runs it on an interpreter that keeps JavaScript calls on its own frame stack, so
+//! deep recursion in a script does not use the native stack. Objects and environments live in an
+//! arena with a mark-and-sweep collector; strings built by repeated `+` are flattened and dropped
+//! with loops. The realm provides the language (sections 10 to 14 of ECMA-262 5.1) and a minimal
+//! set of built-ins: `Object` and `Object.prototype`'s basic methods, `Function` with
+//! `Function.prototype.call` and `apply`, `eval`, and the error constructors. Every run is bounded
+//! by [`Limits`]: instructions run (fuel), heap bytes, frames, nested host calls, and an
+//! [`Interrupt`] flag another thread can set. A run that reaches a limit ends with
+//! [`RunErrorKind::Limit`], which a script's `try` cannot catch.
 #![forbid(unsafe_code)]
 
 pub mod ast;
+mod builtins;
+mod bytecode;
 mod chars;
+mod compiler;
 mod error;
+mod heap;
+mod interp;
 mod lexer;
 mod number;
 mod parser;
+mod realm;
 mod regexp;
 mod token;
+mod value;
 
 pub use ast::{
     AssignOp, Ast, BinaryOp, CatchClause, Expr, ExprId, ForInTarget, ForInit, Function, FunctionId, FunctionKind, LogicalOp, Name, Program, Property,
@@ -36,6 +54,7 @@ pub use ast::{
 pub use error::{SyntaxError, TOO_DEEP, TOO_LONG};
 pub use lexer::{Goal, Lexer};
 pub use number::to_string as number_to_string;
+pub use realm::{Interrupt, JsValue, LimitKind, Limits, Realm, RunError, RunErrorKind};
 pub use token::{Directive, DirectiveName, Keyword, Punct, Span, Token, TokenKind};
 
 /// How a script is read.
@@ -136,6 +155,11 @@ impl LineTable {
         (u32::try_from(line).unwrap_or(u32::MAX), offset.saturating_sub(start) + 1)
     }
 
+    /// The estimated bytes the table holds.
+    pub(crate) fn heap_bytes(&self) -> usize {
+        32 + 4 * self.starts.len()
+    }
+
     pub(crate) fn line_count(&self) -> u32 {
         if self.empty {
             return 0;
@@ -145,5 +169,7 @@ impl LineTable {
     }
 }
 
+#[cfg(test)]
+mod interp_tests;
 #[cfg(test)]
 mod tests;
diff --git a/crates/js/src/realm.rs b/crates/js/src/realm.rs
new file mode 100644
index 000000000..29d3aacb2
--- /dev/null
+++ b/crates/js/src/realm.rs
@@ -0,0 +1,222 @@
+//! The embedding API: a [`Realm`] holds a global object and its built-ins, runs scripts in them,
+//! and enforces [`Limits`].
+
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use crate::bytecode::CodeKind;
+use crate::heap::{Func, HIDDEN, Object, Prop, key};
+use crate::interp::{Abrupt, CompileError, Interp};
+use crate::value::Value;
+use crate::{Options, SyntaxError};
+
+/// The limits a run is held to. Reaching one ends the run with [`RunErrorKind::Limit`]; scripts
+/// cannot catch it, and their `finally` blocks do not run.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Limits {
+    /// Instructions a run may execute.
+    pub fuel: u64,
+    /// Estimated bytes the heap (objects, environments and the strings they hold) may reach
+    /// after a collection. A string longer than a quarter of this many code units cannot be
+    /// made.
+    pub heap_bytes: usize,
+    /// Call frames that may be active at once.
+    pub frames: usize,
+    /// How deeply the interpreter may run again inside an operation (getters and setters,
+    /// conversions that call `valueOf` or `toString`, indirect `eval`).
+    pub reentry: usize,
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+impl Default for Limits {
+    fn default() -> Self {
+        Self { fuel: 1_000_000_000, heap_bytes: 512 << 20, frames: 10_000, reentry: 32 }
+    }
+}
+
+/// A wasm build has less memory and a smaller stack.
+#[cfg(target_arch = "wasm32")]
+impl Default for Limits {
+    fn default() -> Self {
+        Self { fuel: 250_000_000, heap_bytes: 128 << 20, frames: 2_000, reentry: 16 }
+    }
+}
+
+/// Which limit a run reached.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LimitKind {
+    Fuel,
+    Heap,
+    Frames,
+    Reentry,
+    /// The host set the interrupt flag.
+    Interrupted,
+}
+
+/// A flag the host sets, from any thread, to stop the running script at its next instruction.
+/// It stays set until [`Interrupt::clear`].
+#[derive(Clone, Debug)]
+pub struct Interrupt(Arc<AtomicBool>);
+
+impl Interrupt {
+    pub fn set(&self) {
+        self.0.store(true, Ordering::Relaxed);
+    }
+
+    pub fn clear(&self) {
+        self.0.store(false, Ordering::Relaxed);
+    }
+
+    pub fn is_set(&self) -> bool {
+        self.0.load(Ordering::Relaxed)
+    }
+}
+
+/// A value passed between a script and the host. An object is given by its class name.
+#[derive(Clone, Debug, PartialEq)]
+pub enum JsValue {
+    Undefined,
+    Null,
+    Bool(bool),
+    Number(f64),
+    String(String),
+    Object(String),
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum RunErrorKind {
+    /// The source does not parse.
+    Syntax,
+    /// The script threw an exception it did not catch.
+    Thrown,
+    Limit(LimitKind),
+    /// The interpreter reached a state it never makes.
+    Internal,
+}
+
+/// Why a run did not complete. `line` and `column` count from 1 (the column in UTF-16 code units)
+/// and give where the error was raised; they are 0 when that is not known.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RunError {
+    pub kind: RunErrorKind,
+    pub message: String,
+    pub line: u32,
+    pub column: u32,
+}
+
+impl std::fmt::Display for RunError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{} (line {}, column {})", self.message, self.line, self.column)
+    }
+}
+
+impl std::error::Error for RunError {}
+
+impl From<SyntaxError> for RunError {
+    fn from(e: SyntaxError) -> Self {
+        RunError { kind: RunErrorKind::Syntax, message: e.to_string(), line: e.line, column: e.column }
+    }
+}
+
+/// A global environment with the built-ins, in which scripts run one after another.
+pub struct Realm {
+    interp: Interp,
+}
+
+impl Default for Realm {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Realm {
+    pub fn new() -> Self {
+        Self::with_options(Options::default(), Limits::default())
+    }
+
+    /// A realm whose scripts (and the source given to `eval` and `Function`) are read with
+    /// `options`; [`Options::max_source_units`] caps the source parsed in one run, all of it
+    /// counted together.
+    pub fn with_options(options: Options, limits: Limits) -> Self {
+        Self { interp: Interp::new(options, limits) }
+    }
+
+    pub fn limits(&self) -> &Limits {
+        &self.interp.limits
+    }
+
+    /// Sets the limits for the next run. A heap that is already larger than the new
+    /// [`Limits::heap_bytes`] ends the next run with the heap limit unless a collection frees
+    /// enough of it.
+    pub fn set_limits(&mut self, limits: Limits) {
+        self.interp.limits = limits;
+        self.interp.reset_gc_threshold();
+    }
+
+    /// The realm's interrupt flag. Setting it stops a running script, or the next one to start.
+    pub fn interrupt(&self) -> Interrupt {
+        Interrupt(self.interp.interrupt.clone())
+    }
+
+    /// Defines a global function that calls `f` with its arguments. An `Err` from `f` is thrown
+    /// to the script as an `Error` with that message.
+    pub fn define_function(&mut self, name: &str, f: impl Fn(&[JsValue]) -> Result<JsValue, String> + 'static) {
+        let interp = &mut self.interp;
+        let proto = interp.intrinsics.function_proto;
+        let func = Func::Host { f: std::rc::Rc::new(f), name: name.into() };
+        let o = interp.heap.alloc_object(Object::new(crate::heap::Class::Function(func), Some(proto)));
+        let global = interp.global;
+        let _ = interp.define(global, key(name), Prop::Data { value: Value::Object(o), flags: HIDDEN });
+    }
+
+    /// Runs `source` as a script in the global environment and returns its completion value (the
+    /// value of the last expression statement that ran).
+    pub fn run(&mut self, source: &str) -> Result<JsValue, RunError> {
+        let interp = &mut self.interp;
+        interp.fuel = interp.limits.fuel;
+        interp.source_units = 0;
+        interp.throw_site = None;
+        interp.last_thrown = Value::Undefined;
+        let strict = interp.options.strict;
+        let code = match interp.encode_source(source).and_then(|units| interp.compile_source(&units, strict, CodeKind::Global)) {
+            Ok(code) => code,
+            Err(CompileError::Syntax(e)) => return Err(e.into()),
+            Err(CompileError::Internal(m)) => return Err(RunError { kind: RunErrorKind::Internal, message: m, line: 0, column: 0 }),
+        };
+        let result = interp.run_global(code, false);
+        let (line, column) = interp.throw_site.take().map_or((0, 0), |(code, pc)| code.line_column(pc));
+        interp.stack.clear();
+        interp.frames.clear();
+        interp.temp_roots.clear();
+        match result {
+            Ok(v) => Ok(interp.to_js_value(&v)),
+            Err(Abrupt::Throw(v)) => {
+                let message = interp.describe(&v);
+                interp.last_thrown = v;
+                Err(RunError { kind: RunErrorKind::Thrown, message, line, column })
+            }
+            Err(Abrupt::Limit(kind)) => Err(RunError { kind: RunErrorKind::Limit(kind), message: format!("limit reached: {kind:?}"), line, column }),
+            Err(Abrupt::Internal(message)) => Err(RunError { kind: RunErrorKind::Internal, message, line, column }),
+        }
+    }
+
+    /// Defines the global variable `name` holding the exception the last run did not catch
+    /// (`undefined` if there was none).
+    pub fn bind_last_thrown(&mut self, name: &str) {
+        let interp = &mut self.interp;
+        let v = interp.last_thrown.clone();
+        let global = interp.global;
+        let _ = interp.define(global, key(name), Prop::Data { value: v, flags: HIDDEN });
+    }
+
+    /// Collects garbage now and returns the heap's estimated size in bytes afterwards.
+    pub fn collect_garbage(&mut self) -> usize {
+        self.interp.collect_garbage();
+        self.interp.heap.bytes
+    }
+
+    #[cfg(test)]
+    pub(crate) fn interp(&mut self) -> &mut Interp {
+        &mut self.interp
+    }
+}
diff --git a/crates/js/src/tests.rs b/crates/js/src/tests.rs
index fb357e1bf..c1cd09547 100644
--- a/crates/js/src/tests.rs
+++ b/crates/js/src/tests.rs
@@ -321,6 +321,9 @@ fn numeric_literals() {
     assert_eq!(number("0x1F;"), 31.0);
     assert_eq!(number("0XfF;"), 255.0);
     assert_eq!(number("0x20000000000001;"), 9007199254740992.0);
+    // 2^136 + 2^83 + 1 and 2^150 + 2^97 + 1: a set bit past 128 bits rounds the half-way case up.
+    assert_eq!(number(&format!("0x1{}8{}1;", "0".repeat(13), "0".repeat(19))), 2f64.powi(136) + 2f64.powi(84));
+    assert_eq!(number(&format!("01{}2{}1;", "0".repeat(17), "0".repeat(31))), 2f64.powi(150) + 2f64.powi(98));
     assert_eq!(number("017;"), 15.0);
     assert_eq!(number("08;"), 8.0);
     assert_eq!(number("09.5;"), 9.5);
@@ -703,7 +706,7 @@ fn sources_over_the_length_limit_are_refused() {
 // ---- robustness ----
 
 /// Fragments of the language, put together at random so the parser reaches its deeper states.
-const FRAGMENTS: &[&str] = &[
+pub(crate) const FRAGMENTS: &[&str] = &[
     "var ",
     "function ",
     "f",
diff --git a/crates/js/src/value.rs b/crates/js/src/value.rs
new file mode 100644
index 000000000..e164001ad
--- /dev/null
+++ b/crates/js/src/value.rs
@@ -0,0 +1,397 @@
+//! Values (ECMA-262 5.1 section 8) and the conversions between primitives (section 9).
+//!
+//! A string is a rope: concatenation makes a node that points at its two halves, and the first
+//! read of its characters flattens it, with a loop and an explicit stack, into one buffer that
+//! replaces the node. Strings hold no objects, so the reference counts that share them cannot form
+//! a cycle; dropping a long rope also uses a loop, not recursion.
+
+use std::cell::RefCell;
+use std::rc::Rc;
+
+use crate::heap::ObjId;
+
+/// A JavaScript value. Objects are handles into the interpreter's heap.
+#[derive(Clone, Debug)]
+pub(crate) enum Value {
+    Undefined,
+    Null,
+    Bool(bool),
+    Number(f64),
+    String(Str),
+    Object(ObjId),
+}
+
+impl Value {
+    pub(crate) fn str(s: &str) -> Value {
+        Value::String(Str::from(s))
+    }
+
+    pub(crate) fn as_object(&self) -> Option<ObjId> {
+        match self {
+            Value::Object(id) => Some(*id),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn is_nullish(&self) -> bool {
+        matches!(self, Value::Undefined | Value::Null)
+    }
+
+    /// ToBoolean (section 9.2).
+    pub(crate) fn truthy(&self) -> bool {
+        match self {
+            Value::Undefined | Value::Null => false,
+            Value::Bool(b) => *b,
+            Value::Number(n) => !(n.is_nan() || *n == 0.0),
+            Value::String(s) => s.len() > 0,
+            Value::Object(_) => true,
+        }
+    }
+}
+
+/// The text of a string value, in UTF-16 code units: a flat buffer or a concatenation.
+#[derive(Clone)]
+pub(crate) struct Str(Rc<RefCell<Node>>);
+
+enum Node {
+    Flat(Rc<[u16]>),
+    Concat {
+        left: Str,
+        right: Str,
+        len: usize,
+    },
+    /// A node whose halves were moved out while it was dropped.
+    Taken,
+}
+
+impl std::fmt::Debug for Str {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{:?}", self.to_rust_string())
+    }
+}
+
+impl From<&str> for Str {
+    fn from(s: &str) -> Self {
+        Str::from_units(s.encode_utf16().collect())
+    }
+}
+
+/// Strings at most this long are copied when concatenated instead of becoming a rope node.
+const FLAT_CONCAT: usize = 32;
+
+impl Str {
+    pub(crate) fn from_units(units: Vec<u16>) -> Self {
+        Str::from_rc(units.into())
+    }
+
+    pub(crate) fn from_rc(units: Rc<[u16]>) -> Self {
+        Str(Rc::new(RefCell::new(Node::Flat(units))))
+    }
+
+    pub(crate) fn len(&self) -> usize {
+        match &*self.0.borrow() {
+            Node::Flat(f) => f.len(),
+            Node::Concat { len, .. } => *len,
+            Node::Taken => 0,
+        }
+    }
+
+    /// The node is not yet flattened.
+    pub(crate) fn is_rope(&self) -> bool {
+        matches!(&*self.0.borrow(), Node::Concat { .. })
+    }
+
+    /// An address that identifies the node, for counting shared nodes once.
+    pub(crate) fn node_addr(&self) -> usize {
+        Rc::as_ptr(&self.0) as *const () as usize
+    }
+
+    /// The address of the code-unit buffer of a flat node, which a property name can share.
+    pub(crate) fn buffer_addr(&self) -> Option<usize> {
+        match &*self.0.borrow() {
+            Node::Flat(f) => Some(Rc::as_ptr(f) as *const () as usize),
+            _ => None,
+        }
+    }
+
+    /// The two halves of a concatenation node.
+    pub(crate) fn halves(&self) -> Option<(Str, Str)> {
+        match &*self.0.borrow() {
+            Node::Concat { left, right, .. } => Some((left.clone(), right.clone())),
+            _ => None,
+        }
+    }
+
+    /// `a + b`. The caller checks the length limit first.
+    pub(crate) fn concat(a: &Str, b: &Str) -> Str {
+        let (la, lb) = (a.len(), b.len());
+        if la == 0 {
+            return b.clone();
+        }
+        if lb == 0 {
+            return a.clone();
+        }
+        if la + lb <= FLAT_CONCAT {
+            let mut units = Vec::with_capacity(la + lb);
+            units.extend_from_slice(&a.flat());
+            units.extend_from_slice(&b.flat());
+            return Str::from_units(units);
+        }
+        Str(Rc::new(RefCell::new(Node::Concat { left: a.clone(), right: b.clone(), len: la + lb })))
+    }
+
+    /// The code units, flattening the rope first if it is one.
+    pub(crate) fn flat(&self) -> Rc<[u16]> {
+        if let Node::Flat(f) = &*self.0.borrow() {
+            return f.clone();
+        }
+        let mut units = Vec::with_capacity(self.len());
+        let mut stack = vec![self.clone()];
+        while let Some(s) = stack.pop() {
+            match &*s.0.borrow() {
+                Node::Flat(f) => units.extend_from_slice(f),
+                Node::Concat { left, right, .. } => {
+                    stack.push(right.clone());
+                    stack.push(left.clone());
+                }
+                Node::Taken => {}
+            }
+        }
+        let flat: Rc<[u16]> = units.into();
+        let old = std::mem::replace(&mut *self.0.borrow_mut(), Node::Flat(flat.clone()));
+        drop_node(old);
+        flat
+    }
+
+    pub(crate) fn to_rust_string(&self) -> String {
+        String::from_utf16_lossy(&self.flat())
+    }
+}
+
+impl PartialEq for Str {
+    fn eq(&self, other: &Self) -> bool {
+        Rc::ptr_eq(&self.0, &other.0) || (self.len() == other.len() && self.flat() == other.flat())
+    }
+}
+
+/// Drops a node's halves with a loop, so a rope of a million appends does not recurse a million
+/// levels deep.
+fn drop_node(node: Node) {
+    let mut stack = Vec::new();
+    if let Node::Concat { left, right, .. } = node {
+        stack.push(left);
+        stack.push(right);
+    }
+    while let Some(s) = stack.pop() {
+        if Rc::strong_count(&s.0) == 1 {
+            let taken = std::mem::replace(&mut *s.0.borrow_mut(), Node::Taken);
+            if let Node::Concat { left, right, .. } = taken {
+                stack.push(left);
+                stack.push(right);
+            }
+        }
+    }
+}
+
+impl Drop for Str {
+    fn drop(&mut self) {
+        if Rc::strong_count(&self.0) == 1 && self.is_rope() {
+            let node = std::mem::replace(&mut *self.0.borrow_mut(), Node::Taken);
+            drop_node(node);
+        }
+    }
+}
+
+/// White space and line terminators as StrWhiteSpaceChar (section 9.3.1) counts them: the same
+/// classes the lexer uses between tokens.
+pub(crate) fn is_str_space(u: u16) -> bool {
+    crate::chars::is_whitespace(u32::from(u)) || crate::chars::is_line_terminator(u32::from(u))
+}
+
+/// ToNumber applied to a string (section 9.3.1): the StringNumericLiteral grammar, NaN for
+/// anything else.
+pub(crate) fn string_to_number(units: &[u16]) -> f64 {
+    let start = units.iter().position(|&u| !is_str_space(u)).unwrap_or(units.len());
+    let end = units.iter().rposition(|&u| !is_str_space(u)).map_or(start, |i| i + 1);
+    let Some(text) = units.get(start..end) else { return f64::NAN };
+    if text.is_empty() {
+        return 0.0;
+    }
+    let Ok(s) = String::from_utf16(text) else { return f64::NAN };
+    if let Some(hex) = s.strip_prefix("0x").or_else(|| s.strip_prefix("0X")) {
+        if hex.is_empty() || !hex.bytes().all(|b| b.is_ascii_hexdigit()) {
+            return f64::NAN;
+        }
+        return crate::chars::radix_value(hex.bytes().filter_map(|b| crate::chars::hex_value(u32::from(b))), 16).unwrap_or(f64::NAN);
+    }
+    let (sign, body) = match s.as_bytes().first() {
+        Some(b'+') => (1.0, &s[1..]),
+        Some(b'-') => (-1.0, &s[1..]),
+        _ => (1.0, s.as_str()),
+    };
+    if body == "Infinity" {
+        return sign * f64::INFINITY;
+    }
+    if !is_decimal_literal(body) {
+        return f64::NAN;
+    }
+    body.parse::<f64>().map_or(f64::NAN, |n| sign * n)
+}
+
+/// `body` is a StrUnsignedDecimalLiteral without `Infinity`: digits with an optional fraction and
+/// exponent, at least one digit in the mantissa.
+fn is_decimal_literal(body: &str) -> bool {
+    let b = body.as_bytes();
+    let mut i = 0;
+    let digits = |i: &mut usize| {
+        let s = *i;
+        while b.get(*i).is_some_and(u8::is_ascii_digit) {
+            *i += 1;
+        }
+        *i - s
+    };
+    let mut mantissa = digits(&mut i);
+    if b.get(i) == Some(&b'.') {
+        i += 1;
+        mantissa += digits(&mut i);
+    }
+    if mantissa == 0 {
+        return false;
+    }
+    if matches!(b.get(i), Some(b'e' | b'E')) {
+        i += 1;
+        if matches!(b.get(i), Some(b'+' | b'-')) {
+            i += 1;
+        }
+        if digits(&mut i) == 0 {
+            return false;
+        }
+    }
+    i == b.len()
+}
+
+/// ToString applied to a number (section 9.8.1).
+pub(crate) fn number_to_str(n: f64) -> Str {
+    Str::from(crate::number::to_string(n).as_str())
+}
+
+/// ToInt32 (section 9.5).
+pub(crate) fn to_int32(n: f64) -> i32 {
+    to_uint32(n) as i32
+}
+
+/// ToUint32 (section 9.6).
+pub(crate) fn to_uint32(n: f64) -> u32 {
+    if !n.is_finite() || n == 0.0 {
+        return 0;
+    }
+    let int = n.trunc();
+    let m = int.rem_euclid(4_294_967_296.0);
+    m as u32
+}
+
+/// The array index a property name stands for (section 15.4: a canonical numeric string below
+/// 2^32 − 1).
+pub(crate) fn array_index(key: &[u16]) -> Option<u32> {
+    if key.is_empty() || key.len() > 10 || (key.len() > 1 && key.first() == Some(&u16::from(b'0'))) {
+        return None;
+    }
+    let mut n: u64 = 0;
+    for &u in key {
+        let d = u.checked_sub(u16::from(b'0')).filter(|d| *d <= 9)?;
+        n = n * 10 + u64::from(d);
+    }
+    u32::try_from(n).ok().filter(|&n| n != u32::MAX)
+}
+
+/// The decimal digits of an array index.
+pub(crate) fn index_key(i: u32) -> Rc<[u16]> {
+    i.to_string().encode_utf16().collect::<Vec<u16>>().into()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Str, array_index, string_to_number, to_int32, to_uint32};
+
+    fn u(s: &str) -> Vec<u16> {
+        s.encode_utf16().collect()
+    }
+
+    #[test]
+    fn strings_convert_to_numbers_by_the_string_numeric_literal_grammar() {
+        let cases: &[(&str, f64)] = &[
+            ("", 0.0),
+            ("  \n ", 0.0),
+            ("12", 12.0),
+            (" -1.5e2 ", -150.0),
+            ("0x1F", 31.0),
+            (".5", 0.5),
+            ("5.", 5.0),
+            ("+Infinity", f64::INFINITY),
+            ("-Infinity", f64::NEG_INFINITY),
+        ];
+        for (s, want) in cases {
+            assert_eq!(string_to_number(&u(s)), *want, "{s:?}");
+        }
+        for s in ["inf", "nan", "1_0", "0x", "1e", ".", "--1", "0x-1", "infinity", "1 2"] {
+            assert!(string_to_number(&u(s)).is_nan(), "{s:?}");
+        }
+    }
+
+    #[test]
+    fn hex_strings_round_once_to_the_nearest_number() {
+        assert_eq!(string_to_number(&u("0xc83ce80553ee648")), 0xc83_ce80_553e_e648_u64 as f64);
+        // 2^136 + 2^83 + 1: a set bit past 128 bits rounds the half-way case up.
+        let digits = format!("0x1{}8{}1", "0".repeat(13), "0".repeat(19));
+        assert_eq!(string_to_number(&u(&digits)), 2f64.powi(136) + 2f64.powi(84));
+    }
+
+    #[test]
+    fn int32_and_uint32_wrap() {
+        assert_eq!(to_int32(4_294_967_296.0 + 5.0), 5);
+        assert_eq!(to_int32(2_147_483_648.0), i32::MIN);
+        assert_eq!(to_uint32(-1.0), u32::MAX);
+        assert_eq!(to_int32(f64::NAN), 0);
+        assert_eq!(to_int32(-1.9), -1);
+    }
+
+    #[test]
+    fn array_indices_are_canonical_and_below_the_largest_u32() {
+        assert_eq!(array_index(&u("0")), Some(0));
+        assert_eq!(array_index(&u("4294967294")), Some(4_294_967_294));
+        assert_eq!(array_index(&u("4294967295")), None);
+        assert_eq!(array_index(&u("01")), None);
+        assert_eq!(array_index(&u("1.0")), None);
+        assert_eq!(array_index(&u("")), None);
+    }
+
+    #[test]
+    fn a_million_appends_flatten_and_drop_without_recursion() {
+        let handle = std::thread::Builder::new()
+            .stack_size(256 << 10)
+            .spawn(|| {
+                let x = Str::from("abcdefghijklmnopqrstuvwxyz0123456789");
+                let mut s = Str::from("");
+                for _ in 0..1_000_000 {
+                    s = Str::concat(&s, &x);
+                }
+                let len = s.len();
+                let flat = s.flat();
+                (len, flat.len())
+            })
+            .unwrap();
+        assert_eq!(handle.join().unwrap(), (36_000_000, 36_000_000));
+        let handle = std::thread::Builder::new()
+            .stack_size(256 << 10)
+            .spawn(|| {
+                let x = Str::from("abcdefghijklmnopqrstuvwxyz0123456789");
+                let mut s = Str::from("");
+                for _ in 0..1_000_000 {
+                    s = Str::concat(&x, &s);
+                }
+                s.len()
+            })
+            .unwrap();
+        assert_eq!(handle.join().unwrap(), 36_000_000);
+    }
+}
diff --git a/crates/js/tests/test262.rs b/crates/js/tests/test262.rs
index c32045507..8c87bb19d 100644
--- a/crates/js/tests/test262.rs
+++ b/crates/js/tests/test262.rs
@@ -11,17 +11,29 @@
 //! `INTERPRETING.md` says), unless its `onlyStrict`, `noStrict` or `raw` flag says otherwise. The
 //! test prints the counts and writes each failure to `failures.txt` beside the suite; it fails only
 //! when the suite cannot be read.
+//!
+//! A second test runs the same ES5 tests through the interpreter, each in a new realm after the
+//! suite's `assert.js`, `sta.js` and the files its `includes:` names: every test that must parse
+//! and uses only the built-ins the interpreter has (those that name a missing global or method,
+//! in their own source or an included file, are counted as skipped, as are `async` tests). A test
+//! passes when it completes, or, for `negative: phase: runtime`, when it throws an object whose
+//! `constructor` is the global its `type:` names. Its counts are printed apart from the parse
+//! counts, and its failures go to `run-failures.txt`.
 
+use std::collections::HashSet;
 use std::path::{Path, PathBuf};
 
-use vectorcraft_js::{Options, parse};
+use vectorcraft_js::{JsValue, Limits, Options, Realm, RunErrorKind, TokenKind, parse, tokenize};
 
 /// A test file's metadata, from its `/*--- … ---*/` block.
 #[derive(Default)]
 struct Meta {
     features: Vec<String>,
     flags: Vec<String>,
+    includes: Vec<String>,
     negative_phase: Option<String>,
+    /// The error constructor a negative test expects (`negative: type:`).
+    negative_type: Option<String>,
     /// The test names the ES5 section it was written for (`es5id:`).
     es5: bool,
 }
@@ -86,6 +98,10 @@ fn meta(source: &str) -> Meta {
             meta.features = list(v, &mut lines);
         } else if let Some(v) = trimmed.strip_prefix("flags:").filter(|_| !indented) {
             meta.flags = list(v, &mut lines);
+        } else if let Some(v) = trimmed.strip_prefix("includes:").filter(|_| !indented) {
+            meta.includes = list(v, &mut lines);
+        } else if let Some(v) = trimmed.strip_prefix("type:").filter(|_| in_negative) {
+            meta.negative_type = Some(v.trim().to_string());
         } else if trimmed.starts_with("es5id:") && !indented {
             meta.es5 = true;
         } else if trimmed == "negative:" && !indented {
@@ -176,3 +192,129 @@ fn es5_parse_subset() {
         report.display()
     );
 }
+
+/// Globals and method names the interpreter does not provide yet: a test that names one is
+/// skipped.
+const MISSING_BUILTINS: &str = "Array String Number Boolean Math JSON Date RegExp parseInt parseFloat isNaN isFinite encodeURI \
+    decodeURI encodeURIComponent decodeURIComponent escape unescape print $262 $DONE Symbol Proxy Reflect Promise Map Set WeakMap \
+    WeakSet ArrayBuffer DataView Int8Array Uint8Array Float64Array defineProperty defineProperties getOwnPropertyDescriptor \
+    getOwnPropertyNames getPrototypeOf create keys freeze isFrozen seal isSealed preventExtensions isExtensible push pop shift unshift \
+    slice splice concat join reverse sort indexOf lastIndexOf every some forEach map filter reduce reduceRight charAt charCodeAt \
+    fromCharCode substring substr split replace match search exec test toUpperCase toLowerCase trim toFixed toPrecision toExponential \
+    bind now isArray compareArray verifyProperty fnGlobalObject";
+
+/// The stand-in for `String` that the harness's failure messages call.
+const HARNESS_STRING: &str = "function String(value) { return '' + value; }";
+
+/// The source names a missing built-in, as an identifier, a property name or a word inside a
+/// string literal (code passed to `eval` or `Function`), or does not parse as ES5 (the tests that
+/// use `let` and `const`).
+fn needs_missing_builtin(source: &str, missing: &HashSet<&str>) -> bool {
+    let Ok(tokens) = tokenize(source, &Options::default()) else { return true };
+    tokens.iter().any(|t| match &t.kind {
+        TokenKind::Ident(name) => missing.contains(name.as_str()),
+        TokenKind::String(units) => {
+            String::from_utf16_lossy(units).split(|c: char| !(c.is_ascii_alphanumeric() || c == '_' || c == '$')).any(|word| missing.contains(word))
+        }
+        _ => false,
+    })
+}
+
+/// Runs one test in a new realm; `Err` describes a failure.
+fn run_one(script: &str, negative_type: Option<&str>) -> Result<(), String> {
+    let mut realm = Realm::with_options(Options::default(), Limits { fuel: 20_000_000, heap_bytes: 256 << 20, ..Limits::default() });
+    match (realm.run(script), negative_type) {
+        (Ok(_), None) => Ok(()),
+        (Ok(_), Some(t)) => Err(format!("completed; a {t} was expected")),
+        (Err(e), Some(t)) if e.kind == RunErrorKind::Thrown => {
+            realm.bind_last_thrown("__thrown");
+            match realm.run(&format!("typeof __thrown === 'object' && __thrown !== null && __thrown.constructor === {t}")) {
+                Ok(JsValue::Bool(true)) => Ok(()),
+                _ => Err(format!("threw {} (line {}); a {t} was expected", e.message, e.line)),
+            }
+        }
+        (Err(e), _) => Err(format!("{:?}: {} (line {}, column {})", e.kind, e.message, e.line, e.column)),
+    }
+}
+
+#[test]
+fn es5_language_subset_runs() {
+    let Some(dir) = suite_dir() else {
+        println!("test262 interpreter: SKIPPED (no suite; run cargo xtask test262)");
+        return;
+    };
+    // Each test runs on a thread with a stack large enough for the nested runs the re-entry limit
+    // allows in an unoptimized build.
+    let handle = std::thread::Builder::new().stack_size(64 << 20).spawn(move || run_language_subset(&dir)).unwrap();
+    handle.join().unwrap();
+}
+
+fn run_language_subset(dir: &Path) {
+    let language = dir.join("test").join("language");
+    let harness_dir = dir.join("harness");
+    // A file that cannot be read gives an empty source.
+    let read = |p: &Path| String::from_utf8_lossy(&std::fs::read(p).unwrap_or_default()).into_owned();
+    // `assert.js` formats a failed assertion's message with the global `String`, which the
+    // interpreter does not provide yet; the stand-in converts with `+` so a failure reports the
+    // assertion's message instead of a ReferenceError.
+    let prelude = format!("{HARNESS_STRING}\n{}\n{}\n", read(&harness_dir.join("assert.js")), read(&harness_dir.join("sta.js")));
+    let missing: HashSet<&str> = MISSING_BUILTINS.split_whitespace().collect();
+    let verbose = std::env::var_os("VECTORCRAFT_TEST262_VERBOSE").is_some();
+    let (mut tests, mut skipped, mut passed, mut failed, mut panicked) = (0usize, 0usize, 0usize, 0usize, 0usize);
+    let mut failures = String::new();
+    for path in test_files(&language) {
+        let source = read(&path);
+        let meta = meta(&source);
+        let negative_parse = matches!(meta.negative_phase.as_deref(), Some("parse" | "resolution"));
+        if !meta.es5 || !meta.features.is_empty() || negative_parse || meta.flags.iter().any(|f| f == "module") {
+            continue;
+        }
+        let includes: String = meta.includes.iter().map(|i| read(&harness_dir.join(i)) + "\n").collect();
+        if meta.flags.iter().any(|f| f == "async") || needs_missing_builtin(&source, &missing) || needs_missing_builtin(&includes, &missing) {
+            skipped += 1;
+            continue;
+        }
+        tests += 1;
+        let has = |flag: &str| meta.flags.iter().any(|f| f == flag);
+        let modes: &[bool] = if has("raw") || has("noStrict") {
+            &[false]
+        } else if has("onlyStrict") {
+            &[true]
+        } else {
+            &[false, true]
+        };
+        let rel = path.strip_prefix(dir).unwrap_or(&path).display().to_string().replace('\\', "/");
+        for &strict in modes {
+            let mode = if strict { "strict" } else { "sloppy" };
+            if verbose {
+                eprintln!("{rel} ({mode})");
+            }
+            let body = if has("raw") { source.clone() } else { format!("{prelude}{includes}{source}") };
+            let script = if strict { format!("\"use strict\";\n{body}") } else { body };
+            let negative_type = meta.negative_type.clone().filter(|_| meta.negative_phase.as_deref() == Some("runtime"));
+            let outcome = std::panic::catch_unwind(|| run_one(&script, negative_type.as_deref()));
+            match outcome {
+                Ok(Ok(())) => passed += 1,
+                Ok(Err(why)) => {
+                    failed += 1;
+                    failures.push_str(&format!("{rel} ({mode}): {why}\n"));
+                }
+                Err(_) => {
+                    failed += 1;
+                    panicked += 1;
+                    failures.push_str(&format!("{rel} ({mode}): PANIC\n"));
+                }
+            }
+        }
+    }
+    let report = dir.join("run-failures.txt");
+    if let Err(e) = std::fs::write(&report, &failures) {
+        println!("could not write {}: {e}", report.display());
+    }
+    println!(
+        "test262 ES5 language subset through the interpreter: {tests} tests that need only the built-ins present, {passed} runs passed, \
+         {failed} failed ({panicked} panicked). Skipped {skipped} tests that need other built-ins, use syntax after ES5 or are asynchronous. Failures: {}",
+        report.display()
+    );
+    assert_eq!(panicked, 0, "the interpreter panicked; see {}", report.display());
+}
diff --git a/docs/target-app-parity.md b/docs/target-app-parity.md
index 79ba65a05..1eeead3bf 100644
--- a/docs/target-app-parity.md
+++ b/docs/target-app-parity.md
@@ -669,7 +669,8 @@ Moved from the ROADMAP's "Shipped so far" on 2026-10-10. Update it when a featur
   - MCP protocol: five prompts (`prompts/list` / `prompts/get`: poster, icon set, recolour, trace-and-style, export set), `completion/complete` for prompt arguments and template variables read from the live catalogues (formats, effect ids, command ids, trace presets, swatch and object ids), four resource templates (`vectorcraft://object/{id}`, `//command/{id}`, `//effect/{id}`, `//swatch/{name}`) so an agent reads one thing instead of the whole document, and `logging/setLevel` with `notifications/message`. `window.panel` ids are case-insensitive (display labels work too), `vectorcraft://object/{id}` reads through `document.node {summary: true}` (the same reply bytes from one lookup instead of summarizing the whole document: a leaf read on a 2,000-object document drops from ~20 ms to ~0.06 ms), large containers slice with `document.node {depth?, childLimit?}` (truncated levels report `childCount`), `document.inspect` and the `inspect_document` tool slice the same way so a depth-0 read is the layer skeleton (~9.7 KB instead of ~2 MB on a 2,000-object document), `document.find` locates nodes by name/kind/text with ancestor paths, and the CLI sweeps the protocol surface over stdio against the compiled binary. `docs/mcp.md` has a Protocol section covering the capability table and what is deliberately absent (subscriptions, progress, cancellation, sampling, elicitation, Streamable HTTP — all of which need the transport to interleave reads).
   - Headless CLI (`vectorcraft-cli run`, `convert`, `info`, `bench`, `perf`, `mcp`). A `run` step, like a `command_batch` step over MCP, can use an earlier step's result (`"$1.id"`, #785); `run --commands FILE` (or `-` for standard input) reads the steps from a JSON array or JSON Lines, past the Windows command-line limit (#3147, `apps/vectorcraft-cli/tests/it/cli.rs` `run_reads_*`, `run_refuses_malformed_commands_naming_the_step`).
   - File › Scripts › Check Script… reads a script written for Illustrator (`.jsx`, `.jsxinc` or a compiled `.jsxbin`) without running any of it and reports what it needs (the document model, files, dialogs, menu commands, features only Illustrator has), what it would do outside the document, the menu commands and document-model members it uses, its directives and included files, and the problems that would stop it loading (`script.check`, which also reads `.js` files); File › Open and drag-and-drop show the report for `.jsx`, `.jsxinc` and `.jsxbin` files.
-  - `vectorcraft-js` parses JavaScript as ECMAScript 5.1 defines it, with the legacy octal forms, block functions and lenient regular expressions of Annex B, into a syntax tree with source spans; it reads the `#target`, `#include` and other preprocessor lines as directives without running them, and a script that breaks the grammar or an early-error rule gives a `SyntaxError` with its line and column. Nesting past the parser's depth limit (`Options::max_depth`, 200 by default) gives a `SyntaxError` instead of exhausting the stack. `cargo xtask test262` fetches the conformance suite at a pinned commit and parses its ES5 tests: 5,411 of 5,418 runs pass (the 7 others use `let` and `const`). Nothing runs scripts yet. Tests: `crates/js/src/tests.rs`, `crates/engine/tests/it/js_lexer_vs_scriptcheck.rs`.
+  - `vectorcraft-js` parses JavaScript as ECMAScript 5.1 defines it, with the legacy octal forms, block functions and lenient regular expressions of Annex B, into a syntax tree with source spans; it reads the `#target`, `#include` and other preprocessor lines as directives without running them, and a script that breaks the grammar or an early-error rule gives a `SyntaxError` with its line and column. Nesting past the parser's depth limit (`Options::max_depth`, 200 by default) gives a `SyntaxError` instead of exhausting the stack. `cargo xtask test262` fetches the conformance suite at a pinned commit and parses its ES5 tests: 5,411 of 5,418 runs pass (the 7 others use `let` and `const`). This entry covers parsing; the next entry covers running scripts. Tests: `crates/js/src/tests.rs`, `crates/engine/tests/it/js_lexer_vs_scriptcheck.rs`.
+  - `vectorcraft-js`'s `Realm` runs ECMAScript 5.1 scripts: the parsed script compiles to verified bytecode that a non-recursive interpreter runs, with closures, `this`, `arguments`, `with`, direct and indirect `eval`, `new Function`, `try`/`catch`/`finally`, labeled `break` and `continue`, and `for`-`in` in insertion order, over a mark-and-sweep heap. Built-ins are limited to `Object`, `Function` with `call` and `apply`, `eval` and the error types. Every run is bounded by fuel, heap bytes, frames, nested host calls and an interrupt flag (smaller defaults in the wasm build), and a run that reaches a limit stops with a limit error that `try` cannot catch. `cargo xtask test262` also runs the suite's ES5 language tests that need only these built-ins: 3,074 of 3,078 runs pass (the 4 others expect the completion values of later editions). The app does not call it yet. Tests: `crates/js/src/interp_tests.rs`, `crates/js/tests/test262.rs`.
 - **UI:** Illustrator 2026 layout restyled to measured values:
   - Medium Dark theme, categorized and Advanced toolbars (a tool group's flyout opens on a right press, a long press or a press on its corner triangle), 35 pt document tabs, 33 pt panel tabs.
   - Hint bar, contextual task bar, 19 dock panels with ≡ menus.
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
index 334910732..bfd6172ac 100644
--- a/xtask/src/main.rs
+++ b/xtask/src/main.rs
@@ -43,7 +43,8 @@ commands:
                   pack PNGs into a Windows .ico (used by packaging/icons.sh)
   stats [--exact] count tests and lines per crate (--exact: ask the test harness via `-- --list`)
   test262         fetch the pinned ECMAScript conformance suite into corpus/test262 (sha256
-                  verified) and parse its ES5 subset with vectorcraft-js, printing the counts
+                  verified), parse its ES5 subset with vectorcraft-js and run the ES5 language
+                  tests its interpreter supports, printing the counts
   web-fonts       copy the craft-fonts faces in crates/text/web-fonts.txt into the web site (the Trunk
                   post_build hook; a no-op without CRAFT_FONTS_DIR)
 ";
@@ -338,7 +339,8 @@ Tests that use a corpus skip cleanly when it is absent.
   corpus/affinity/   public Affinity documents (CC0/MIT/Apache-2.0) at pinned commits, sha256
                      verified: oracles for the Affinity reader. Fetch: cargo xtask corpus --affinity
   corpus/test262/    the ECMAScript conformance suite (BSD-3-Clause) at a pinned commit, sha256
-                     verified: the JavaScript parser's ES5 subset. Fetch and run: cargo xtask test262
+                     verified: the JavaScript parser's and interpreter's ES5 subsets. Fetch and run:
+                     cargo xtask test262
 ",
         corpus.display()
     );
diff --git a/xtask/src/test262.rs b/xtask/src/test262.rs
index ab390538b..30f6f2472 100644
--- a/xtask/src/test262.rs
+++ b/xtask/src/test262.rs
@@ -1,7 +1,8 @@
 //! `cargo xtask test262`: the official ECMAScript conformance suite (https://github.com/tc39/test262,
 //! BSD-3-Clause) at a pinned commit, fetched as GitHub's archive of that commit, checked against
 //! its SHA-256 and size, and unpacked into `corpus/test262/` (gitignored, never committed). It then
-//! runs `vectorcraft-js`'s `test262` test, which parses the ES5 parse subset and prints its counts.
+//! runs `vectorcraft-js`'s `test262` tests, which parse the ES5 parse subset, run the ES5
+//! `test/language` tests that need only the interpreter's built-ins, and print each one's counts.
 //!
 //! Moving the pin: change [`COMMIT`], run the command once with the new commit to see the
 //! archive's SHA-256 in the error, check the archive, and update [`SHA256`].