diff --git a/crates/e2e/scenarios/real-web/bing.com.we b/crates/e2e/scenarios/real-web/bing.com.we
index 94521f7..0012c71 100644
--- a/crates/e2e/scenarios/real-web/bing.com.we
+++ b/crates/e2e/scenarios/real-web/bing.com.we
@@ -38,6 +38,7 @@ cache_put bing https://assets.msn.com/bundles/v1/bingHomepage/latest/widget-init
 # Preact fetches the carousel JSON after hydration and then lazily resolves
 # the PopNow thumbnail URLs relative to https://www.bing.com/.
 cache_put bing https://www.bing.com/hp/api/v1/carousel?&format=json&ecount=20&efirst=0& ../../real-web/snapshots/bing.com/www.bing.com/hp/api/v1/carousel-format-json-ecount-20-efirst-0.json application/json
+cache_put bing https://www.bing.com/hp/api/v1/carousel?&format=json&ecount=20&efirst=0&& ../../real-web/snapshots/bing.com/www.bing.com/hp/api/v1/carousel-format-json-ecount-20-efirst-0.json application/json
 cache_put bing https://www.bing.com/th?id=ONUT.154UxLdP7Uf64MeWOs1BUA&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow ../../real-web/snapshots/bing.com/www.bing.com/thumbnails/carousel-01.jpg image/jpeg
 cache_put bing https://www.bing.com/th?id=ONUT.t_uH-BTS6q1cglR3uHzk9Q&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow ../../real-web/snapshots/bing.com/www.bing.com/thumbnails/carousel-02.jpg image/jpeg
 cache_put bing https://www.bing.com/th?id=ONUT.Q4wvi6NH_-OSmq1WTCwxTQ&w=186&h=88&c=7&rs=2&qlt=80&pid=PopNow ../../real-web/snapshots/bing.com/www.bing.com/thumbnails/carousel-03.jpg image/jpeg
diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs
index 27bb901..2799f42 100644
--- a/crates/js/src/builtins.rs
+++ b/crates/js/src/builtins.rs
@@ -248,7 +248,7 @@ pub fn init_builtins(vm: &mut Vm) {
     let mut str_proto_data = ObjectData::new();
     str_proto_data.prototype = Some(obj_proto);
     let str_proto = vm.gc.alloc(HeapObject::Object(str_proto_data));
-    init_string_prototype(&mut vm.gc, &mut vm.shapes, str_proto);
+    init_string_prototype(&mut vm.gc, &mut vm.shapes, str_proto, arr_proto);
 
     // Create Number.prototype (inherits from Object.prototype).
     let mut num_proto_data = ObjectData::new();
@@ -2288,7 +2288,12 @@ fn set_iter_idx(gc: &mut Gc<HeapObject>, shapes: &mut ShapeTable, iter_ref: GcRe
 
 // ── String built-in ──────────────────────────────────────────
 
-fn init_string_prototype(gc: &mut Gc<HeapObject>, shapes: &mut ShapeTable, proto: GcRef) {
+fn init_string_prototype(
+    gc: &mut Gc<HeapObject>,
+    shapes: &mut ShapeTable,
+    proto: GcRef,
+    arr_proto: GcRef,
+) {
     let methods: &[NativeMethod] = &[
         ("charAt", string_proto_char_at),
         ("charCodeAt", string_proto_char_code_at),
@@ -2322,6 +2327,9 @@ fn init_string_prototype(gc: &mut Gc<HeapObject>, shapes: &mut ShapeTable, proto
     ];
     for &(name, callback) in methods {
         let f = make_native(gc, name, callback);
+        if name == "split" {
+            set_func_prop(gc, f, "__array_prototype__", Value::Object(arr_proto));
+        }
         set_builtin_prop(gc, shapes, proto, name, Value::Function(f));
     }
 
@@ -2716,8 +2724,14 @@ fn string_proto_repeat(args: &[Value], ctx: &mut NativeContext) -> Result<Value,
 
 fn string_proto_split(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
     let s = this_string(ctx);
+    let prototype = array_prototype_from_context(ctx);
     if args.is_empty() || matches!(args.first(), Some(Value::Undefined)) {
-        return Ok(make_value_array(ctx.gc, ctx.shapes, &[Value::String(s)]));
+        return Ok(make_value_array_with_proto(
+            ctx.gc,
+            ctx.shapes,
+            &[Value::String(s)],
+            prototype,
+        ));
     }
     let limit = args
         .get(1)
@@ -2727,7 +2741,7 @@ fn string_proto_split(args: &[Value], ctx: &mut NativeContext) -> Result<Value,
     // Check if separator is a RegExp.
     if let Some(arg0) = args.first() {
         if is_regexp(ctx.gc, ctx.shapes, arg0) {
-            return string_split_regexp(ctx.gc, ctx.shapes, &s, arg0, limit);
+            return string_split_regexp(ctx.gc, ctx.shapes, &s, arg0, limit, prototype);
         }
     }
 
@@ -2738,7 +2752,9 @@ fn string_proto_split(args: &[Value], ctx: &mut NativeContext) -> Result<Value,
             .take(limit)
             .map(|c| Value::String(c.to_string()))
             .collect();
-        return Ok(make_value_array(ctx.gc, ctx.shapes, &items));
+        return Ok(make_value_array_with_proto(
+            ctx.gc, ctx.shapes, &items, prototype,
+        ));
     }
     let mut items = Vec::new();
     let mut start = 0;
@@ -2753,7 +2769,9 @@ fn string_proto_split(args: &[Value], ctx: &mut NativeContext) -> Result<Value,
     if items.len() < limit {
         items.push(Value::String(s[start..].to_string()));
     }
-    Ok(make_value_array(ctx.gc, ctx.shapes, &items))
+    Ok(make_value_array_with_proto(
+        ctx.gc, ctx.shapes, &items, prototype,
+    ))
 }
 
 fn string_split_regexp(
@@ -2762,6 +2780,7 @@ fn string_split_regexp(
     s: &str,
     regexp: &Value,
     limit: usize,
+    prototype: Option<GcRef>,
 ) -> Result<Value, RuntimeError> {
     use crate::regex::{exec, CompiledRegex};
 
@@ -2812,7 +2831,7 @@ fn string_split_regexp(
         let rest: String = chars[last_end..].iter().collect();
         items.push(Value::String(rest));
     }
-    Ok(make_value_array(gc, shapes, &items))
+    Ok(make_value_array_with_proto(gc, shapes, &items, prototype))
 }
 
 fn string_proto_replace(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
@@ -5743,6 +5762,53 @@ pub fn promise_state_pub(gc: &Gc<HeapObject>, shapes: &ShapeTable, promise: GcRe
     promise_state(gc, shapes, promise)
 }
 
+pub fn settle_promise_all_reaction_pub(
+    gc: &mut Gc<HeapObject>,
+    shapes: &mut ShapeTable,
+    chained: GcRef,
+    value: Value,
+    fulfilled: bool,
+) -> bool {
+    let target = match promise_get_prop(gc, shapes, chained, "__all_target__") {
+        Value::Object(r) => r,
+        _ => return false,
+    };
+    let index = match promise_get_prop(gc, shapes, chained, "__all_index__") {
+        Value::Number(n) if n >= 0.0 => n as usize,
+        _ => return false,
+    };
+    let results_ref = match promise_get_prop(gc, shapes, target, "__all_results__") {
+        Value::Object(r) => r,
+        _ => return false,
+    };
+    let all_settled = matches!(
+        promise_get_prop(gc, shapes, chained, "__all_settled__"),
+        Value::Boolean(true)
+    );
+
+    if all_settled {
+        let entry = make_settled_entry(
+            gc,
+            shapes,
+            if fulfilled { "fulfilled" } else { "rejected" },
+            &value,
+            fulfilled,
+        );
+        array_set(gc, shapes, results_ref, index, entry.clone());
+        promise_all_decrement(gc, shapes, target);
+        resolve_promise_internal(gc, shapes, chained, entry);
+    } else if fulfilled {
+        array_set(gc, shapes, results_ref, index, value.clone());
+        promise_all_decrement(gc, shapes, target);
+        resolve_promise_internal(gc, shapes, chained, value);
+    } else {
+        reject_promise_internal(gc, shapes, target, value.clone());
+        reject_promise_internal(gc, shapes, chained, value);
+    }
+
+    true
+}
+
 pub fn is_promise_pub(gc: &Gc<HeapObject>, shapes: &ShapeTable, value: &Value) -> bool {
     is_promise(gc, shapes, value)
 }
@@ -5862,13 +5928,30 @@ fn init_promise_builtins(vm: &mut Vm) {
     let static_reject = make_native(&mut vm.gc, "reject", promise_static_reject);
     vm.set_global("__Promise_static_reject", Value::Function(static_reject));
 
+    let arr_proto = vm.array_prototype;
     let static_all = make_native(&mut vm.gc, "all", promise_static_all);
+    if let Some(proto) = arr_proto {
+        set_func_prop(
+            &mut vm.gc,
+            static_all,
+            "__array_prototype__",
+            Value::Object(proto),
+        );
+    }
     vm.set_global("__Promise_static_all", Value::Function(static_all));
 
     let static_race = make_native(&mut vm.gc, "race", promise_static_race);
     vm.set_global("__Promise_static_race", Value::Function(static_race));
 
     let static_all_settled = make_native(&mut vm.gc, "allSettled", promise_static_all_settled);
+    if let Some(proto) = arr_proto {
+        set_func_prop(
+            &mut vm.gc,
+            static_all_settled,
+            "__array_prototype__",
+            Value::Object(proto),
+        );
+    }
     vm.set_global(
         "__Promise_static_allSettled",
         Value::Function(static_all_settled),
@@ -6365,15 +6448,17 @@ fn promise_static_all(args: &[Value], ctx: &mut NativeContext) -> Result<Value,
 
     let len = array_length(ctx.gc, ctx.shapes, arr_ref);
     let result_promise = create_promise_object(ctx.gc, ctx.shapes);
+    let prototype = array_prototype_from_context(ctx);
 
     if len == 0 {
-        let empty = make_value_array(ctx.gc, ctx.shapes, &[]);
+        let empty = make_value_array_with_proto(ctx.gc, ctx.shapes, &[], prototype);
         resolve_promise_internal(ctx.gc, ctx.shapes, result_promise, empty);
         return Ok(Value::Object(result_promise));
     }
 
     // Create a results array and a counter object.
-    let results = make_value_array(ctx.gc, ctx.shapes, &vec![Value::Undefined; len]);
+    let results =
+        make_value_array_with_proto(ctx.gc, ctx.shapes, &vec![Value::Undefined; len], prototype);
     let results_ref = results.gc_ref().unwrap();
 
     // We track remaining count and results in hidden props on result_promise.
@@ -6407,14 +6492,8 @@ fn promise_static_all(args: &[Value], ctx: &mut NativeContext) -> Result<Value,
                 return Ok(Value::Object(result_promise));
             } else {
                 // Pending: we need to register a reaction. Store index info.
-                promise_set_prop(
-                    ctx.gc,
-                    ctx.shapes,
-                    item_ref,
-                    &format!("__all_target_{i}__"),
-                    Value::Object(result_promise),
-                );
-                // Add a reaction — the microtask drain will handle all-tracking.
+                // Add a reaction; the microtask drain uses the hidden metadata
+                // below to write the value into the aggregate result array.
                 let chained = add_reaction(
                     ctx.gc,
                     ctx.shapes,
@@ -6531,14 +6610,16 @@ fn promise_static_all_settled(
 
     let len = array_length(ctx.gc, ctx.shapes, arr_ref);
     let result_promise = create_promise_object(ctx.gc, ctx.shapes);
+    let prototype = array_prototype_from_context(ctx);
 
     if len == 0 {
-        let empty = make_value_array(ctx.gc, ctx.shapes, &[]);
+        let empty = make_value_array_with_proto(ctx.gc, ctx.shapes, &[], prototype);
         resolve_promise_internal(ctx.gc, ctx.shapes, result_promise, empty);
         return Ok(Value::Object(result_promise));
     }
 
-    let results = make_value_array(ctx.gc, ctx.shapes, &vec![Value::Undefined; len]);
+    let results =
+        make_value_array_with_proto(ctx.gc, ctx.shapes, &vec![Value::Undefined; len], prototype);
     let results_ref = results.gc_ref().unwrap();
 
     promise_set_prop(
@@ -6578,7 +6659,34 @@ fn promise_static_all_settled(
                 array_set(ctx.gc, ctx.shapes, results_ref, i, entry);
                 promise_all_decrement(ctx.gc, ctx.shapes, result_promise);
             } else {
-                chain_promise(ctx.gc, ctx.shapes, item_ref, result_promise);
+                let chained = add_reaction(
+                    ctx.gc,
+                    ctx.shapes,
+                    item_ref,
+                    Value::Undefined,
+                    Value::Undefined,
+                );
+                promise_set_prop(
+                    ctx.gc,
+                    ctx.shapes,
+                    chained,
+                    "__all_index__",
+                    Value::Number(i as f64),
+                );
+                promise_set_prop(
+                    ctx.gc,
+                    ctx.shapes,
+                    chained,
+                    "__all_target__",
+                    Value::Object(result_promise),
+                );
+                promise_set_prop(
+                    ctx.gc,
+                    ctx.shapes,
+                    chained,
+                    "__all_settled__",
+                    Value::Boolean(true),
+                );
             }
         } else {
             let entry = make_settled_entry(ctx.gc, ctx.shapes, "fulfilled", &item, true);
@@ -6703,6 +6811,14 @@ fn init_json_object(vm: &mut Vm) {
     let json_ref = vm.gc.alloc(HeapObject::Object(data));
 
     let parse_fn = make_native(&mut vm.gc, "parse", json_parse);
+    if let Some(proto) = vm.array_prototype {
+        set_func_prop(
+            &mut vm.gc,
+            parse_fn,
+            "__array_prototype__",
+            Value::Object(proto),
+        );
+    }
     set_builtin_prop(
         &mut vm.gc,
         &mut vm.shapes,
@@ -6915,13 +7031,18 @@ impl<'a> JsonLexer<'a> {
 struct JsonParser<'a> {
     lexer: JsonLexer<'a>,
     current: Option<JsonToken>,
+    array_prototype: Option<GcRef>,
 }
 
 impl<'a> JsonParser<'a> {
-    fn new(input: &'a str) -> Result<Self, RuntimeError> {
+    fn new(input: &'a str, array_prototype: Option<GcRef>) -> Result<Self, RuntimeError> {
         let mut lexer = JsonLexer::new(input);
         let current = lexer.next_token()?;
-        Ok(Self { lexer, current })
+        Ok(Self {
+            lexer,
+            current,
+            array_prototype,
+        })
     }
 
     fn advance(&mut self) -> Result<(), RuntimeError> {
@@ -6977,6 +7098,7 @@ impl<'a> JsonParser<'a> {
         if self.current == Some(JsonToken::RBracket) {
             self.advance()?;
             let mut obj = ObjectData::new();
+            obj.prototype = self.array_prototype;
             obj.insert_property(
                 "length".to_string(),
                 Property {
@@ -7010,6 +7132,7 @@ impl<'a> JsonParser<'a> {
             }
         }
         let mut obj = ObjectData::new();
+        obj.prototype = self.array_prototype;
         for (i, v) in items.iter().enumerate() {
             obj.insert_property(i.to_string(), Property::data(v.clone()), shapes);
         }
@@ -7086,7 +7209,8 @@ fn json_parse(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeE
         .first()
         .map(|v| v.to_js_string(ctx.gc))
         .unwrap_or_default();
-    let mut parser = JsonParser::new(&text)?;
+    let prototype = array_prototype_from_context(ctx);
+    let mut parser = JsonParser::new(&text, prototype)?;
     let value = parser.parse_value(ctx.gc, ctx.shapes)?;
     // Ensure no trailing content.
     if parser.current.is_some() {
@@ -7454,6 +7578,8 @@ fn init_global_functions(vm: &mut Vm) {
     vm.define_native("parseFloat", parse_float);
     vm.define_native("isNaN", is_nan);
     vm.define_native("isFinite", is_finite);
+    vm.define_native("atob", crate::worker_global::worker_atob);
+    vm.define_native("btoa", crate::worker_global::worker_btoa);
 
     // URI handling (ECMA-262 §19.2).
     vm.define_native("encodeURI", encode_uri);
@@ -9054,6 +9180,28 @@ mod uri_tests {
         );
     }
 
+    #[test]
+    fn atob_btoa_are_exposed_on_main_global() {
+        assert_eq!(
+            eval("typeof btoa + ':' + typeof atob + ':' + btoa('Hello') + ':' + atob('SGV sbG8=')"),
+            "function:function:SGVsbG8=:Hello"
+        );
+    }
+
+    #[test]
+    fn string_split_result_has_array_methods() {
+        assert_eq!(
+            eval("'scope=image&x=1'.split('&').filter(function(v) { return v.indexOf('scope=') === 0; })[0]"),
+            "scope=image"
+        );
+    }
+
+    #[test]
+    fn btoa_rejects_non_latin1_input() {
+        let err = eval_err("btoa('Ā')");
+        assert_eq!(err.kind, ErrorKind::TypeError);
+    }
+
     #[test]
     fn encode_uri_component_passes_unreserved_characters_through() {
         assert_eq!(
diff --git a/crates/js/src/typed_array.rs b/crates/js/src/typed_array.rs
index c2412db..4419c93 100644
--- a/crates/js/src/typed_array.rs
+++ b/crates/js/src/typed_array.rs
@@ -202,6 +202,7 @@ fn alloc_typed_array(
 ) -> Value {
     let mut obj = ObjectData::new();
     let set_fn = make_native(ctx.gc, "set", typed_array_set_method);
+    let subarray_fn = make_native(ctx.gc, "subarray", typed_array_subarray_method);
     obj.insert_property(
         "__ta_kind__".to_string(),
         Property::builtin(Value::String(kind.name().to_string())),
@@ -232,6 +233,11 @@ fn alloc_typed_array(
         Property::builtin(Value::Function(set_fn)),
         ctx.shapes,
     );
+    obj.insert_property(
+        "subarray".to_string(),
+        Property::builtin(Value::Function(subarray_fn)),
+        ctx.shapes,
+    );
     for i in 0..length {
         let v = initial
             .as_ref()
@@ -275,6 +281,57 @@ fn typed_array_set_method(args: &[Value], ctx: &mut NativeContext) -> Result<Val
     Ok(Value::Undefined)
 }
 
+fn typed_array_subarray_method(
+    args: &[Value],
+    ctx: &mut NativeContext,
+) -> Result<Value, RuntimeError> {
+    let target_ref = match ctx.this {
+        Value::Object(r) => r,
+        _ => {
+            return Err(RuntimeError::type_error(
+                "TypedArray.subarray requires a typed array",
+            ))
+        }
+    };
+    let (kind, target_len) = typed_array_kind_and_length(ctx.gc, ctx.shapes, target_ref)
+        .ok_or_else(|| RuntimeError::type_error("TypedArray.subarray requires a typed array"))?;
+    let (start, end) = subarray_bounds(args, target_len);
+    let source_values = read_array_like_values(target_ref, ctx);
+    let values = (start..end)
+        .map(|idx| source_values.get(idx).cloned().unwrap_or(Value::Undefined))
+        .collect::<Vec<_>>();
+    Ok(alloc_typed_array(kind, values.len(), Some(values), ctx))
+}
+
+fn subarray_bounds(args: &[Value], len: usize) -> (usize, usize) {
+    let start = relative_index(args.first(), len, 0);
+    let end = match args.get(1) {
+        Some(Value::Undefined) | None => len,
+        Some(value) => relative_index(Some(value), len, len),
+    };
+    if end < start {
+        (start, start)
+    } else {
+        (start, end)
+    }
+}
+
+fn relative_index(value: Option<&Value>, len: usize, default: usize) -> usize {
+    let Some(value) = value else {
+        return default;
+    };
+    let number = value.to_number();
+    if number.is_nan() {
+        return 0;
+    }
+    let index = number.trunc() as isize;
+    if index < 0 {
+        len.saturating_sub(index.unsigned_abs())
+    } else {
+        (index as usize).min(len)
+    }
+}
+
 fn typed_array_kind_and_length(
     gc: &Gc<HeapObject>,
     shapes: &ShapeTable,
@@ -640,6 +697,28 @@ mod tests {
         assert_eq!(r, "0,0,7,8");
     }
 
+    #[test]
+    fn subarray_copies_requested_range() {
+        let r = eval(
+            "var a = new Uint16Array([10,20,30,40]); \
+             var b = a.subarray(1, 3); \
+             typeof a.subarray + ':' + b.length + ':' + b[0] + ',' + b[1]",
+        )
+        .unwrap();
+        assert_eq!(r, "function:2:20,30");
+    }
+
+    #[test]
+    fn subarray_clamps_negative_bounds() {
+        let r = eval(
+            "var a = new Int8Array([1,2,3,4,5]); \
+             var b = a.subarray(-4, -1); \
+             b.length + ':' + b[0] + ',' + b[1] + ',' + b[2]",
+        )
+        .unwrap();
+        assert_eq!(r, "3:2,3,4");
+    }
+
     #[test]
     fn indexed_read_write_round_trip() {
         let r = eval(
diff --git a/crates/js/src/vm.rs b/crates/js/src/vm.rs
index 1b81bba..1f4face 100644
--- a/crates/js/src/vm.rs
+++ b/crates/js/src/vm.rs
@@ -2421,6 +2421,15 @@ impl Vm {
                     None => {
                         // No handler: identity for fulfillment, thrower for rejection.
                         if let Some(chained) = task.chained_promise {
+                            if crate::builtins::settle_promise_all_reaction_pub(
+                                &mut self.gc,
+                                &mut self.shapes,
+                                chained,
+                                task.value.clone(),
+                                task.is_fulfillment,
+                            ) {
+                                continue;
+                            }
                             if task.is_fulfillment {
                                 crate::builtins::resolve_promise_internal(
                                     &mut self.gc,
@@ -10753,6 +10762,40 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_json_parse_arrays_have_array_methods() {
+        let src = r#"
+            var o = JSON.parse('{"data":[{"items":[1,2,3]}]}');
+            var total = 0;
+            o.data.map(function(group) {
+                group.items.map(function(item) { total = total + item; });
+            });
+            total
+        "#;
+        match eval(src).unwrap() {
+            Value::Number(n) => assert_eq!(n, 6.0),
+            v => panic!("expected 6, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_json_parse_arrays_work_with_apply() {
+        let src = r#"
+            var o = JSON.parse('{"data":[{"typeName":"TrendingNow","items":["a","b"]}]}');
+            var out = [];
+            o.data.map(function(group) {
+                if (group.typeName === "TrendingNow") {
+                    out.push.apply(out, group.items);
+                }
+            });
+            out.join(",")
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "a,b"),
+            v => panic!("expected joined parsed items, got {v:?}"),
+        }
+    }
+
     #[test]
     fn test_json_parse_object() {
         let src = r#"
@@ -11892,6 +11935,45 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_promise_all_result_has_array_methods() {
+        match eval_global(
+            "Promise.all([1, 2, 3]).then(function(v) { var sum = 0; v.forEach(function(n) { sum = sum + n; }); result = sum; });",
+            "result",
+        )
+        .unwrap()
+        {
+            Value::Number(n) => assert_eq!(n, 6.0),
+            v => panic!("expected 6, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_promise_all_pending_result_array() {
+        match eval_global(
+            "var resolve; var p = new Promise(function(r) { resolve = r; }); Promise.all([p]).then(function(v) { result = v.length + ':' + v[0] + ':' + typeof v.forEach; }); resolve(7);",
+            "result",
+        )
+        .unwrap()
+        {
+            Value::String(s) => assert_eq!(s, "1:7:function"),
+            v => panic!("expected pending Promise.all array result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_promise_all_rejects_pending_input() {
+        match eval_global(
+            "var reject; var p = new Promise(function(_, r) { reject = r; }); Promise.all([p]).then(function() { result = 'bad'; }, function(e) { result = e; }); reject('nope');",
+            "result",
+        )
+        .unwrap()
+        {
+            Value::String(s) => assert_eq!(s, "nope"),
+            v => panic!("expected pending Promise.all rejection, got {v:?}"),
+        }
+    }
+
     #[test]
     fn test_promise_race_with_non_promise() {
         match eval_global(
@@ -11918,6 +12000,32 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_pending_then_flattens_fulfilled_returned_promise() {
+        match eval_global(
+            "var resolve; var p = new Promise(function(r) { resolve = r; }); p.then(function() { return Promise.resolve(42); }).then(function(v) { result = v; }); resolve(1);",
+            "result",
+        )
+        .unwrap()
+        {
+            Value::Number(n) => assert_eq!(n, 42.0),
+            v => panic!("expected flattened promise value, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_bound_promise_then_schedules_callback() {
+        match eval_global(
+            "var schedule = Promise.prototype.then.bind(Promise.resolve()); schedule(function() { result = 13; });",
+            "result",
+        )
+        .unwrap()
+        {
+            Value::Number(n) => assert_eq!(n, 13.0),
+            v => panic!("expected bound Promise.then callback to run, got {v:?}"),
+        }
+    }
+
     #[test]
     fn test_promise_catch_passthrough() {
         match eval_global(
@@ -11944,6 +12052,19 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_promise_all_settled_pending_inputs() {
+        match eval_global(
+            "var resolve; var reject; var p1 = new Promise(function(r) { resolve = r; }); var p2 = new Promise(function(_, r) { reject = r; }); Promise.allSettled([p1, p2]).then(function(v) { result = v[0].status + ':' + v[0].value + ':' + v[1].status + ':' + v[1].reason + ':' + typeof v.forEach; }); resolve(1); reject('err');",
+            "result",
+        )
+        .unwrap()
+        {
+            Value::String(s) => assert_eq!(s, "fulfilled:1:rejected:err:function"),
+            v => panic!("expected pending Promise.allSettled result array, got {v:?}"),
+        }
+    }
+
     // ── Iterator and for...of tests ────────────────────────
 
     #[test]
diff --git a/crates/js/src/wasm.rs b/crates/js/src/wasm.rs
index 24bd44c..9030121 100644
--- a/crates/js/src/wasm.rs
+++ b/crates/js/src/wasm.rs
@@ -467,6 +467,62 @@ fn uint8_array_constructor(args: &[Value], ctx: &mut NativeContext) -> Result<Va
     }
 }
 
+fn uint8_array_subarray(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
+    let target_ref = match ctx.this {
+        Value::Object(r) => r,
+        _ => {
+            return Err(RuntimeError::type_error(
+                "Uint8Array.subarray requires a Uint8Array",
+            ))
+        }
+    };
+    if hidden_string(ctx.gc, ctx.shapes, target_ref, PROP_TYPED_ARRAY_KIND).as_deref()
+        != Some("Uint8Array")
+    {
+        return Err(RuntimeError::type_error(
+            "Uint8Array.subarray requires a Uint8Array",
+        ));
+    }
+    let bytes = collect_memory_backed_view_bytes(ctx.wasm, ctx.gc, ctx.shapes, target_ref)
+        .unwrap_or_else(|| collect_array_like_bytes(ctx.gc, ctx.shapes, target_ref));
+    let (start, end) = subarray_bounds(args, bytes.len());
+    Ok(make_uint8_array_from_bytes(
+        ctx.wasm,
+        ctx.gc,
+        ctx.shapes,
+        bytes[start..end].to_vec(),
+    ))
+}
+
+fn subarray_bounds(args: &[Value], len: usize) -> (usize, usize) {
+    let start = relative_index(args.first(), len, 0);
+    let end = match args.get(1) {
+        Some(Value::Undefined) | None => len,
+        Some(value) => relative_index(Some(value), len, len),
+    };
+    if end < start {
+        (start, start)
+    } else {
+        (start, end)
+    }
+}
+
+fn relative_index(value: Option<&Value>, len: usize, default: usize) -> usize {
+    let Some(value) = value else {
+        return default;
+    };
+    let number = value.to_number();
+    if number.is_nan() {
+        return 0;
+    }
+    let index = number.trunc() as isize;
+    if index < 0 {
+        len.saturating_sub(index.unsigned_abs())
+    } else {
+        (index as usize).min(len)
+    }
+}
+
 fn memory_addr_for_buffer_like(ctx: &NativeContext, obj: GcRef) -> Option<u32> {
     hidden_u32(ctx.gc, ctx.shapes, obj, PROP_WASM_MEMORY_ADDR)
         .or_else(|| current_memory_addr_for_buffer_like(ctx, obj))
@@ -1356,6 +1412,7 @@ fn make_uint8_array_view(
     buffer_ref: Option<GcRef>,
 ) -> Value {
     let mut obj = ObjectData::new();
+    let subarray = make_native(gc, "subarray", uint8_array_subarray);
     obj.insert_property(
         PROP_TYPED_ARRAY_KIND.to_string(),
         Property::builtin(Value::String("Uint8Array".to_string())),
@@ -1415,6 +1472,11 @@ fn make_uint8_array_view(
         Property::data(Value::Number(bytes.len() as f64)),
         shapes,
     );
+    obj.insert_property(
+        "subarray".to_string(),
+        Property::builtin(Value::Function(subarray)),
+        shapes,
+    );
     if memory_addr.is_none() {
         for (i, byte) in bytes.iter().enumerate() {
             obj.insert_property(
@@ -2126,6 +2188,26 @@ mod tests {
         }
     }
 
+    #[test]
+    fn uint8_array_subarray_copies_requested_range() {
+        let (vm, result) = eval_with_vm(
+            "var a = new Uint8Array([4,5,6,7]); \
+             var b = a.subarray(1, 3); \
+             typeof a.subarray + ':' + b.length + ':' + b[0] + ',' + b[1]",
+        );
+        assert_eq!(result.unwrap().to_js_string(&vm.gc), "function:2:5,6");
+    }
+
+    #[test]
+    fn uint8_array_subarray_clamps_negative_bounds() {
+        let (vm, result) = eval_with_vm(
+            "var a = new Uint8Array([1,2,3,4,5]); \
+             var b = a.subarray(-4, -1); \
+             b.length + ':' + b[0] + ',' + b[1] + ',' + b[2]",
+        );
+        assert_eq!(result.unwrap().to_js_string(&vm.gc), "3:2,3,4");
+    }
+
     /// `Object.{keys,values,entries}` on a TypedArray must enumerate the
     /// integer element indices and their byte values, not the internal slots
     /// (`buffer`, `byteLength`, `__ta_kind__`, …). Regression test for the
diff --git a/crates/js/src/worker_global.rs b/crates/js/src/worker_global.rs
index cda98c2..7d83f55 100644
--- a/crates/js/src/worker_global.rs
+++ b/crates/js/src/worker_global.rs
@@ -116,7 +116,7 @@ fn worker_close(_args: &[Value], _ctx: &mut NativeContext) -> Result<Value, Runt
     Ok(Value::Undefined)
 }
 
-fn worker_btoa(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
+pub(crate) fn worker_btoa(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
     let s = args
         .first()
         .map(|v| v.to_js_string(ctx.gc))
@@ -133,7 +133,7 @@ fn worker_btoa(args: &[Value], ctx: &mut NativeContext) -> Result<Value, Runtime
     Ok(Value::String(btoa_encode(&bytes)))
 }
 
-fn worker_atob(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
+pub(crate) fn worker_atob(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
     let s = args
         .first()
         .map(|v| v.to_js_string(ctx.gc))