@@ -0,0 +1,29 @@
+//@ memoryHog!
+//@ skip if $addressBits <= 32
+//@ runDefault
+
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error(`bad value: expected ${expected} but got ${actual}`);
+}
+
+const gib = 1024 * 1024 * 1024;
+const size = 5 * gib;
+
+for (const ArrayBufferClass of [ArrayBuffer, SharedArrayBuffer]) {
+    const buffer = new ArrayBufferClass(size);
+    shouldBe(buffer.byteLength, size);
+
+    new Uint8Array(buffer).set([1, 2, 3, 4], size - 4);
+
+    // Slicing only a window at the end keeps the copy small while still forcing the byte length
+    // itself through the argument clamping.
+    shouldBe(buffer.slice(size - 4).byteLength, 4);
+    shouldBe([...new Uint8Array(buffer.slice(size - 4))].join(), "1,2,3,4");
+    shouldBe(buffer.slice(-4).byteLength, 4);
+    shouldBe(buffer.slice(size - 4, size).byteLength, 4);
+    shouldBe(buffer.slice(size - 4, -1).byteLength, 3);
+    shouldBe(buffer.slice(4 * gib, 4 * gib + 8).byteLength, 8);
+    shouldBe(buffer.slice(size, size).byteLength, 0);
+    shouldBe(buffer.slice(size + 1).byteLength, 0);
+}
@@ -1,4 +1,5 @@
-const MAX64 = 4294967296 + 1;
+// One byte past MAX_ARRAY_BUFFER_SIZE, so neither constructor can satisfy it.
+const MAX64 = 2 ** 34 + 1;
 // Okay to throw, but should not crash.
 try {
     new SharedArrayBuffer(4, { maxByteLength: MAX64 });
@@ -7,4 +8,4 @@ try {
 try {
     new ArrayBuffer(4, { maxByteLength: MAX64 });
 } catch (e) {
-}
+}
@@ -0,0 +1,74 @@
+// A canonical numeric index string on a typed array never reaches ordinary property lookup, whatever
+// number it denotes. https://tc39.es/ecma262/#sec-canonicalnumericindexstring
+//
+// Keys past MAX_ARRAY_INDEX are recognized as integer indices, so they must behave like any other
+// out-of-bounds index on a short array rather than becoming ordinary properties.
+
+function shouldBe(actual, expected, what) {
+    if (actual !== expected)
+        throw new Error(`bad value for ${what}: expected ${expected} but got ${actual}`);
+}
+
+function shouldThrowTypeError(f, what) {
+    try {
+        f();
+    } catch (e) {
+        if (e instanceof TypeError)
+            return;
+        throw new Error(`${what}: expected a TypeError but got ${e}`);
+    }
+    throw new Error(`${what}: expected a TypeError but nothing was thrown`);
+}
+
+const array = new Uint8Array(4);
+const prototype = Object.getPrototypeOf(array);
+
+// String(n) is by construction the canonical spelling of n, so each of these is a
+// CanonicalNumericIndexString. They span both sides of every internal cutoff: MAX_ARRAY_INDEX, 2^32,
+// 2^53, and 2^64, plus the values that are canonical but are not integer indices at all.
+const keys = [
+    2 ** 32 - 1,        // 0xFFFFFFFF, excluded by isIndex()
+    2 ** 32,
+    2 ** 53 - 1,        // the largest integer index the spec allows
+    2 ** 53,
+    2 ** 60,
+    2 ** 64,            // past uint64_t, so no index is recoverable
+    1e21,               // spelled in exponential form
+    -1,
+    1.5,
+    2 ** 32 + 0.5,      // canonical, past MAX_ARRAY_INDEX, and not an integer
+    NaN,
+    Infinity,
+    -Infinity,
+].map(String).concat(["-0"]); // String(-0) is "0", so -0 has to be spelled out.
+
+for (const key of keys) {
+    // An element that does not exist must not be found on the prototype either.
+    prototype[key] = "fromPrototype";
+
+    shouldBe(array[key], undefined, `array["${key}"]`);
+    shouldBe(key in array, false, `"${key}" in array`);
+    shouldBe(array.hasOwnProperty(key), false, `hasOwnProperty("${key}")`);
+    shouldBe(Object.getOwnPropertyDescriptor(array, key), undefined, `getOwnPropertyDescriptor("${key}")`);
+
+    // The store is ignored, but the right hand side is still coerced first.
+    let coerced = false;
+    array[key] = { valueOf() { coerced = true; return 1; } };
+    shouldBe(coerced, true, `array["${key}"] = ... coerces the right hand side`);
+    shouldBe(array.hasOwnProperty(key), false, `"${key}" was not added as a property`);
+
+    // Deleting an index that does not exist succeeds vacuously.
+    shouldBe(delete array[key], true, `delete array["${key}"]`);
+
+    shouldThrowTypeError(() => Object.defineProperty(array, key, { value: 1 }), `defineProperty("${key}")`);
+
+    delete prototype[key];
+}
+
+// Numeric-looking strings that are not canonical are ordinary properties, and stay that way.
+for (const key of ["042", "1e3", " 1", "0x10", "4294967296 ", "+4294967296"]) {
+    array[key] = "ordinary";
+    shouldBe(array.hasOwnProperty(key), true, `"${key}" is an ordinary property`);
+    shouldBe(array[key], "ordinary", `array["${key}"]`);
+    shouldBe(delete array[key], true, `delete array["${key}"]`);
+}
@@ -0,0 +1,73 @@
+//@ memoryHog!
+//@ skip if $addressBits <= 32
+//@ runDefault
+
+// Indexed access on a typed array longer than MAX_ARRAY_INDEX elements.
+//
+// MAX_ARRAY_BUFFER_SIZE is 2^34, so a Uint8Array can be longer than MAX_ARRAY_INDEX (0xFFFFFFFE),
+// the ceiling on a property key expressed as an index. Every element below the view's length is a
+// valid integer index per IsValidIntegerIndex, so [] must reach it. Such a key arrives as a string,
+// where parseIndex() cannot hold it, so it is recognized by isCanonicalNumericIndexString() instead.
+
+function shouldBe(actual, expected, what) {
+    if (actual !== expected)
+        throw new Error(`bad value for ${what}: expected ${expected} but got ${actual}`);
+}
+
+// 4GiB + 2 bytes: the smallest view with indices on both sides of 0xFFFFFFFF and above 2^32, so one
+// allocation covers every case.
+let array;
+try {
+    array = new Uint8Array(4294967298);
+} catch (e) {
+    // A port that cannot spare 4GiB has nothing to test here.
+    if (!(e instanceof RangeError))
+        throw e;
+}
+
+if (array !== undefined) {
+    // fill() and subarray() take the size_t path, so they establish what a byte holds independently of [].
+    const trueValueAt = index => array.subarray(index, index + 1)[0];
+
+    for (const index of [
+        4294967294, // 0xFFFFFFFE, the last index a property key can express: the control.
+        4294967295, // 0xFFFFFFFF: fits a uint32 but is excluded by isIndex().
+        4294967296, // 2^32: does not fit a uint32 at all.
+        array.length - 1,
+    ]) {
+        array.fill(7, index, index + 1);
+        shouldBe(trueValueAt(index), 7, `fill() at ${index}`);
+
+        shouldBe(array[index], 7, `array[${index}]`);
+        shouldBe(array.at(index), 7, `array.at(${index})`);
+
+        array[index] = 99;
+        shouldBe(trueValueAt(index), 99, `array[${index}] = 99`);
+        shouldBe(array[index], 99, `array[${index}] after assignment`);
+
+        shouldBe(index in array, true, `${index} in array`);
+        shouldBe(array.hasOwnProperty(String(index)), true, `hasOwnProperty(${index})`);
+        shouldBe(Reflect.has(array, String(index)), true, `Reflect.has(array, "${index}")`);
+
+        const descriptor = Object.getOwnPropertyDescriptor(array, String(index));
+        shouldBe(descriptor !== undefined, true, `getOwnPropertyDescriptor(${index}) exists`);
+        shouldBe(descriptor.value, 99, `getOwnPropertyDescriptor(${index}).value`);
+        shouldBe(descriptor.writable, true, `getOwnPropertyDescriptor(${index}).writable`);
+        shouldBe(descriptor.enumerable, true, `getOwnPropertyDescriptor(${index}).enumerable`);
+        shouldBe(descriptor.configurable, true, `getOwnPropertyDescriptor(${index}).configurable`);
+
+        // An integer index that exists cannot be deleted.
+        shouldBe(delete array[index], false, `delete array[${index}]`);
+        shouldBe(trueValueAt(index), 99, `array[${index}] survives delete`);
+
+        Object.defineProperty(array, String(index), { value: 123 });
+        shouldBe(trueValueAt(index), 123, `defineProperty at ${index}`);
+
+        // Reading through the prototype must not shadow an element that exists.
+        Object.getPrototypeOf(array)[String(index)] = "fromProto";
+        shouldBe(array[index], 123, `array[${index}] is not shadowed by the prototype`);
+        delete Object.getPrototypeOf(array)[String(index)];
+
+        array.fill(0, index, index + 1);
+    }
+}
@@ -67,21 +67,21 @@ function assertSharedGrowableBufferOfPageSize(pageCount, buffer, maxPageCount) {
     assertTrue(memory.buffer !== buffer);
 }
 
-// A resize whose page-aligned growth delta exceeds the maximum representable
-// PageCount must throw a catchable RangeError, not hit a release assertion.
+// A resize whose page-aligned growth delta exceeds what a memory32 may declare
+// must throw a catchable RangeError, not hit a release assertion.
 // https://bugs.webkit.org/show_bug.cgi?id=318524
 {
     let memory = new WebAssembly.Memory({ initial: 1, maximum: 65536 });
     let buffer = memory.toResizableBuffer();
     assertIsolatedResizableBufferOfPageSize(1, buffer, 65536);
 
-    // Growth delta of 65537 pages is not representable as a PageCount.
+    // 65538 pages is not a page count a memory32 may reach at all.
     assertThrows(() => buffer.resize(65538 * pageSize), RangeError, "");
     // The buffer is unchanged and remains usable after the failed resize.
     assertIsolatedResizableBufferOfPageSize(1, buffer, 65536);
 
-    // A representable delta that would still exceed the declared maximum must
-    // also throw catchably.
+    // A page count a memory32 may reach, but which still exceeds the declared
+    // maximum, must also throw catchably.
     assertThrows(() => buffer.resize(65537 * pageSize), RangeError, "");
     assertIsolatedResizableBufferOfPageSize(1, buffer, 65536);
 
 
@@ -57,12 +57,12 @@ for (const address of ["i65", "", "I64", "u64", null, 1, {}]) {
     assert.throws(() => table.grow(-1n), TypeError, "Expect an integer argument in the range: [0, 2^64 - 1]");
 }
 
-// A memory64's declared maximum may exceed the memory32 page limit.
+// A memory64's declared maximum may exceed the memory32 page limit, up to 262144 pages (16 GiB).
 {
     const mem = new WebAssembly.Memory({ initial: 1n, maximum: 131072n, address: "i64" });
     assert.eq(mem.type().maximum, 131072n);
-    assert.eq(new WebAssembly.Memory({ initial: 0n, maximum: 137438953471n, address: "i64" }).type().maximum, 137438953471n);
-    assert.throws(() => new WebAssembly.Memory({ initial: 1n, maximum: 137438953472n, address: "i64" }), RangeError,
+    assert.eq(new WebAssembly.Memory({ initial: 0n, maximum: 262144n, address: "i64" }).type().maximum, 262144n);
+    assert.throws(() => new WebAssembly.Memory({ initial: 1n, maximum: 262145n, address: "i64" }), RangeError,
         "WebAssembly.Memory 'maximum' page count is too large");
     // An i32 memory keeps the memory32 limit.
     assert.throws(() => new WebAssembly.Memory({ initial: 1, maximum: 65537 }), RangeError,
 
@@ -52,31 +52,27 @@ const pageSize = 64 * 1024;
 }
 
 // Constructor: initial page count too large throws. An initial page count is declarative in the same
-// way a maximum is, so the limit is the one a module may declare for an i64 memory; a count within
-// that limit which cannot be allocated is out of memory instead.
+// way a maximum is, so the limit is the largest count a module may declare for an i64 memory, which
+// is 262144 pages (16 GiB).
 {
     assert.throws(
-        () => new WebAssembly.Memory({ initial: 137438953472n, address: "i64" }),
+        () => new WebAssembly.Memory({ initial: 262145n, address: "i64" }),
         RangeError,
         "WebAssembly.Memory 'initial' page count is too large"
     );
-    assert.throws(
-        () => new WebAssembly.Memory({ initial: 65537n, address: "i64" }),
-        RangeError,
-        "Out of memory"
-    );
 }
 
-// Constructor: maximum page count too large throws. A maximum is declarative, so the limit is the
-// one a module may declare for an i64 memory, not the memory32 page limit.
+// Constructor: maximum page count too large throws. A maximum is bounded by that same i64 limit
+// rather than by the memory32 page limit.
 {
     assert.throws(
-        () => new WebAssembly.Memory({ initial: 1n, maximum: 137438953472n, address: "i64" }),
+        () => new WebAssembly.Memory({ initial: 1n, maximum: 262145n, address: "i64" }),
         RangeError,
         "WebAssembly.Memory 'maximum' page count is too large"
     );
     const memory = new WebAssembly.Memory({ initial: 1n, maximum: 65537n, address: "i64" });
     assert.eq(memory.type().maximum, 65537n);
+    assert.eq(new WebAssembly.Memory({ initial: 1n, maximum: 262144n, address: "i64" }).type().maximum, 262144n);
 }
 
 // Constructor: passing invalid address
 
@@ -0,0 +1,88 @@
+//@ memoryHog!
+//@ skip if $addressBits <= 32
+import { instantiate } from "../wabt-wrapper.js";
+import * as assert from "../assert.js";
+
+// A memory64 exists to address more than the 4GiB a memory32 can, so both the wasm-level grow and
+// the resizable-buffer path must cross that boundary.
+
+const options = { memory64: true, threads: true };
+const pageSize = 65536;
+const maxMemory64Pages = 262144;
+const fourGiB = 4 * 1024 * 1024 * 1024;
+const pastFourGiB = fourGiB + pageSize;
+
+// A memory with no declared maximum reports the most this platform could grow it to, which is what
+// bounds every maxByteLength below.
+const ceilingBytes = new WebAssembly.Memory({ initial: 1n, address: "i64" }).toResizableBuffer().maxByteLength;
+
+// A memory whose initial size is already past 4GiB proves this port can host one at all. Where it
+// can, growing past 4GiB below must succeed; where it cannot, refusing cleanly is the only option.
+// Only the constructor belongs in the try: an assertion inside it would be swallowed by the catch.
+let probe;
+try {
+    probe = new WebAssembly.Memory({ initial: BigInt(pastFourGiB / pageSize), address: "i64" });
+} catch (e) {
+    assert.truthy(e instanceof RangeError && e.message === "Out of memory", `expected an out of memory RangeError, got ${e}`);
+}
+const canHostPastFourGiB = probe !== undefined;
+if (canHostPastFourGiB)
+    assert.eq(probe.buffer.byteLength, pastFourGiB);
+// Nothing below needs the probe, and holding 4GiB across the rest of the file would starve it.
+probe = undefined;
+
+for (const shared of [false, true]) {
+    let mem;
+    try {
+        mem = (await instantiate(`
+        (module
+            (memory (export "mem") i64 1 ${pastFourGiB / pageSize} ${shared ? "shared" : ""}))
+        `, {}, options)).exports.mem;
+    } catch (e) {
+        // A shared memory reserves its whole maximum up front, which this port may not be able to spare.
+        assert.truthy(e instanceof RangeError && e.message === "Out of memory", `expected an out of memory RangeError, got ${e}`);
+        continue;
+    }
+
+    const buffer = mem.toResizableBuffer();
+    assert.eq(buffer.maxByteLength, Math.min(pastFourGiB, ceilingBytes));
+
+    const grow = shared ? size => buffer.grow(size) : size => buffer.resize(size);
+    if (canHostPastFourGiB) {
+        // The non-shared path grows by copying, so it holds the old and new regions at once. Hosting one
+        // 4GiB memory does not imply room for both.
+        let grown = true;
+        try {
+            grow(pastFourGiB);
+        } catch (e) {
+            assert.truthy(e instanceof RangeError, `expected a RangeError, got ${e}`);
+            grown = false;
+        }
+        if (grown)
+            assert.eq(buffer.byteLength, pastFourGiB);
+    } else {
+        assert.throws(() => grow(pastFourGiB), RangeError, "failed with new byte length");
+        assert.eq(buffer.byteLength, pageSize);
+    }
+
+    // Past the declared maximum is a clean RangeError either way. The shared and non-shared paths
+    // word it differently ("grow failed ...", "ArrayBuffer resize failed ...") around a common core.
+    assert.throws(() => grow(pastFourGiB + pageSize), RangeError, "failed with new byte length");
+}
+
+// A shared memory's buffer reports the maximum it can actually reach, and growth within the mapping
+// succeeds.
+{
+    let memory;
+    try {
+        memory = new WebAssembly.Memory({ initial: 1n, maximum: BigInt(maxMemory64Pages), address: "i64", shared: true });
+    } catch (e) {
+        assert.truthy(e instanceof RangeError && e.message === "Out of memory", `expected an out of memory RangeError, got ${e}`);
+    }
+    if (memory !== undefined) {
+        const buffer = memory.toResizableBuffer();
+        assert.eq(buffer.maxByteLength, Math.min(maxMemory64Pages * pageSize, ceilingBytes));
+        buffer.grow(2 * pageSize);
+        assert.eq(buffer.byteLength, 2 * pageSize);
+    }
+}