diff --git a/.isu/issues.json b/.isu/issues.json
index 665d26d..656aa3e 100644
--- a/.isu/issues.json
+++ b/.isu/issues.json
@@ -1,5 +1,5 @@
 {
-  "next_id": 350,
+  "next_id": 351,
   "issues": [
     {
       "id": 1,
@@ -4269,6 +4269,19 @@
       "author": "piefev",
       "state": "closed",
       "created_at": "2026-06-04T19:59:45Z"
+    },
+    {
+      "id": 350,
+      "repo": "we",
+      "title": "Bing SpeechSDK bundle still aborts after export accessor fixes",
+      "body": "Follow-up from isu issue 280. This change gets bing.com past the earlier `PlatformEvent`/CommonJS accessor failures by adding offline `fetch()` cache handling, accessor descriptors, nested function self-reference capture, and `TypedArray.set`, but the scenario still cannot remove `# xfail`.\n\nRepro:\n`cargo run -p we-e2e -- --scenario crates/e2e/scenarios/real-web/bing.com.we --out-dir crates/e2e/artifacts`\n\nCurrent remaining runtime failures from the repro:\n- `https://r.bing.com/rp/Kztfii5jt_tZqOfH9TXTthmg_8w.js`: `TypeError: undefined is not a function` at line 1 col 10298, near the UUID/default-export helper path `(0,n.default)(\"v3\",48,i.default)`.\n- `https://r.bing.com/rp/t6Bkpkzq5ckAnvfW2PY7kNOTPJ0.js`: `TypeError: undefined is not a function` at line 1 col 287.\n- `https://r.bing.com/rp/8IAmQsuV9JqR_a0NVlBmchPNiAk.js`: `TypeError: undefined is not a function` at line 1 col 111.\n- Timer callbacks also surface `Error: [object Object]` and `TypeError: undefined is not a function`.\n\nScreenshot parity is still failing, with known snapshot/golden drift tracked in isu issue 305 and hydration snapshot work tracked in isu issue 334:\n- desktop: `2.54% match (1197303/1228500 px differ, tol=4, max_diff=0.1000%)`\n- mobile: `5.37% match (311470/329160 px differ, tol=4, max_diff=0.1000%)`\n\nArtifacts from the repro:\n- `crates/e2e/artifacts/real-web/bing.com/desktop.png`\n- `crates/e2e/artifacts/real-web/bing.com/desktop.png.diff.png`\n- `crates/e2e/artifacts/real-web/bing.com/desktop_dom.txt`\n- `crates/e2e/artifacts/real-web/bing.com/desktop_console.txt`\n- `crates/e2e/artifacts/real-web/bing.com/mobile.png`\n- `crates/e2e/artifacts/real-web/bing.com/mobile.png.diff.png`\n- `crates/e2e/artifacts/real-web/bing.com/mobile_dom.txt`\n- `crates/e2e/artifacts/real-web/bing.com/mobile_console.txt`\n\nExpected: continue reducing the Bing JS runtime gaps until the offline hydrated page can run without these bundle aborts; keep isu issue 280 open until `crates/e2e/scenarios/real-web/bing.com.we` passes and its `# xfail` marker is removed.",
+      "labels": [
+        "real-web"
+      ],
+      "assigned": [],
+      "author": "piefev",
+      "state": "open",
+      "created_at": "2026-06-04T21:22:27Z"
     }
   ]
 }
diff --git a/crates/browser/src/loader.rs b/crates/browser/src/loader.rs
index f179205..6c6e7b8 100644
--- a/crates/browser/src/loader.rs
+++ b/crates/browser/src/loader.rs
@@ -220,6 +220,166 @@ fn cached_to_http_response(cached: CachedResponse) -> HttpResponse {
     }
 }
 
+/// Satisfy a JavaScript `fetch()` request from the deterministic offline cache.
+///
+/// The JS engine owns the Fetch API, so it exposes a host hook instead of
+/// depending on this crate directly. We only intercept while offline: normal
+/// browsing should continue through the network path unless a service worker
+/// explicitly handles the request.
+pub fn fetch_api_cached_response(
+    request: &we_js::fetch::HostFetchRequest,
+) -> Option<Result<we_js::fetch::FetchResult, String>> {
+    if !network_offline() {
+        return None;
+    }
+
+    let url = match Url::parse(&request.url) {
+        Ok(url) => url,
+        Err(e) => return Some(Err(format!("Invalid URL: {e}"))),
+    };
+    let method = match fetch_api_method(&request.method) {
+        Ok(method) => method,
+        Err(err) => return Some(Err(err)),
+    };
+    if !matches!(method, Method::Get | Method::Head) {
+        return Some(Err(format!(
+            "Network error: offline and no cached response for {}",
+            request.url
+        )));
+    }
+
+    let Some(cached) = cached_response_for(&url) else {
+        return Some(Err(format!(
+            "Network error: offline and no cached response for {}",
+            request.url
+        )));
+    };
+
+    Some(fetch_result_from_cached_response(
+        request, &url, method, cached,
+    ))
+}
+
+fn fetch_api_method(method: &str) -> Result<Method, String> {
+    match method {
+        "GET" => Ok(Method::Get),
+        "POST" => Ok(Method::Post),
+        "PUT" => Ok(Method::Put),
+        "DELETE" => Ok(Method::Delete),
+        "HEAD" => Ok(Method::Head),
+        "OPTIONS" => Ok(Method::Options),
+        "PATCH" => Ok(Method::Patch),
+        other => Err(format!("Unsupported HTTP method: {other}")),
+    }
+}
+
+fn fetch_api_credentials_mode(mode: &str) -> CredentialsMode {
+    match mode {
+        "include" => CredentialsMode::Include,
+        "omit" => CredentialsMode::Omit,
+        _ => CredentialsMode::SameOrigin,
+    }
+}
+
+fn fetch_result_from_cached_response(
+    request: &we_js::fetch::HostFetchRequest,
+    url: &Url,
+    method: Method,
+    cached: CachedResponse,
+) -> Result<we_js::fetch::FetchResult, String> {
+    if fetch_api_is_cross_origin(request, url) && request.cors_mode == "no-cors" {
+        return Ok(we_js::fetch::FetchResult {
+            status: 0,
+            status_text: String::new(),
+            headers: Vec::new(),
+            body: Vec::new(),
+            body_stream_id: None,
+            url: url.serialize(),
+            redirected: false,
+        });
+    }
+
+    let mut response_headers = Headers::new();
+    for (name, value) in &cached.headers {
+        response_headers.add(name, value);
+    }
+
+    let headers = fetch_api_visible_headers(request, url, method, &response_headers)?;
+    let final_url = cached.final_url.clone().unwrap_or_else(|| url.serialize());
+    Ok(we_js::fetch::FetchResult {
+        status: cached.status,
+        status_text: cached.reason,
+        headers,
+        body: if method == Method::Head {
+            Vec::new()
+        } else {
+            cached.body
+        },
+        body_stream_id: None,
+        url: final_url,
+        redirected: cached.redirected,
+    })
+}
+
+fn fetch_api_visible_headers(
+    request: &we_js::fetch::HostFetchRequest,
+    url: &Url,
+    method: Method,
+    response_headers: &Headers,
+) -> Result<Vec<(String, String)>, String> {
+    if !fetch_api_is_cross_origin(request, url) {
+        return Ok(response_headers
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.to_string()))
+            .collect());
+    }
+
+    if request.cors_mode != "cors" {
+        return Err(format!(
+            "Cross-origin request blocked: {} (mode is '{}')",
+            request.url, request.cors_mode
+        ));
+    }
+
+    let Some(doc_origin) = &request.document_origin else {
+        return Ok(Vec::new());
+    };
+    let doc_parsed_origin = Url::parse(&format!("{doc_origin}/"))
+        .map(|u| u.origin())
+        .unwrap_or(Origin::Opaque);
+    let mut request_headers = Headers::new();
+    for (name, value) in &request.headers {
+        request_headers.add(name, value);
+    }
+    if needs_preflight(method, &request_headers) {
+        return Err(format!(
+            "CORS preflight failed: offline for {}",
+            request.url
+        ));
+    }
+
+    let credentials_mode = fetch_api_credentials_mode(&request.credentials_mode);
+    let exposed = check_cors_response(response_headers, &doc_parsed_origin, credentials_mode)
+        .map_err(|reason| format!("Cross-origin request blocked: {reason}"))?;
+    let filtered = cors::filter_response_headers(response_headers, &exposed);
+    Ok(filtered
+        .iter()
+        .map(|(k, v)| (k.to_string(), v.to_string()))
+        .collect())
+}
+
+fn fetch_api_is_cross_origin(request: &we_js::fetch::HostFetchRequest, url: &Url) -> bool {
+    if let Some(doc_origin) = &request.document_origin {
+        let resource_origin = url.origin();
+        let doc_parsed_origin = Url::parse(&format!("{doc_origin}/"))
+            .map(|u| u.origin())
+            .unwrap_or(Origin::Opaque);
+        !doc_parsed_origin.same_origin(&resource_origin)
+    } else {
+        false
+    }
+}
+
 // ---------------------------------------------------------------------------
 // ResourceLoader
 // ---------------------------------------------------------------------------
diff --git a/crates/browser/src/script_loader.rs b/crates/browser/src/script_loader.rs
index 751acd8..79c0ffe 100644
--- a/crates/browser/src/script_loader.rs
+++ b/crates/browser/src/script_loader.rs
@@ -343,6 +343,7 @@ pub fn execute_scripts_into_vm_with_console(
         we_js::fetch::set_document_origin(&origin_str);
         vm.set_document_origin(&origin_str);
         vm.set_document_url(base_url.clone());
+        we_js::fetch::set_host_fetch_handler(crate::loader::fetch_api_cached_response);
         load_service_worker_registrations(&mut vm, document_origin);
         load_cache_api_storage(document_origin, base_url);
         we_js::iframe_bridge::init_window_object(&mut vm, "main", &origin_str);
@@ -375,6 +376,7 @@ pub fn execute_scripts_into_vm_with_console(
 
     // Set the document URL so window.location properties work correctly.
     vm.set_document_url(base_url.clone());
+    we_js::fetch::set_host_fetch_handler(crate::loader::fetch_api_cached_response);
     load_service_worker_registrations(&mut vm, document_origin);
     load_cache_api_storage(document_origin, base_url);
 
@@ -936,6 +938,50 @@ mod tests {
         None
     }
 
+    #[test]
+    fn fetch_api_uses_offline_loader_cache() {
+        crate::loader::clear_service_worker_caches();
+        crate::loader::set_network_offline(true);
+
+        let api_url = Url::parse("https://example.test/data.json").unwrap();
+        crate::loader::put_service_worker_cache_response(crate::loader::CachedResponse::new(
+            "test",
+            &api_url,
+            "application/json",
+            br#"{"answer":"cached"}"#.to_vec(),
+        ));
+
+        let html = r#"<html><body>
+            <div id="target">pending</div>
+            <script>
+                fetch("/data.json").then(function(resp) {
+                    return resp.json();
+                }).then(function(data) {
+                    document.getElementById("target").textContent = data.answer;
+                }, function(err) {
+                    document.getElementById("target").textContent = "error";
+                });
+            </script>
+        </body></html>"#;
+        let doc = parse_html(html);
+        let mut loader = ResourceLoader::new();
+        let base_url = Url::parse("https://example.test/page.html").unwrap();
+        let origin = base_url.origin();
+        let mut vm = execute_scripts_into_vm(doc, &mut loader, &base_url, &origin);
+        vm.run_event_loop(25).expect("event loop failed");
+
+        let doc = vm.detach_document().unwrap_or_default();
+        we_js::fetch::clear_document_origin();
+        crate::loader::set_network_offline(false);
+        crate::loader::clear_service_worker_caches();
+
+        assert_eq!(
+            find_text_by_id(&doc, doc.root(), "target").as_deref(),
+            Some("cached"),
+            "page fetch() should resolve from cache_put-style offline entries"
+        );
+    }
+
     #[test]
     fn dynamically_inserted_inline_script_executes() {
         // A running script inserts a fresh <script> whose inline body mutates
diff --git a/crates/js/src/broadcast_channel.rs b/crates/js/src/broadcast_channel.rs
index 737c1a6..773baad 100644
--- a/crates/js/src/broadcast_channel.rs
+++ b/crates/js/src/broadcast_channel.rs
@@ -327,6 +327,8 @@ fn empty_array(shapes: &mut crate::shape::ShapeTable) -> ObjectData {
         "length".to_string(),
         Property {
             value: Value::Number(0.0),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
@@ -530,6 +532,8 @@ fn append_to_array(arr_ref: GcRef, val: Value, ctx: &mut NativeContext) {
             "length".to_string(),
             Property {
                 value: Value::Number((len + 1) as f64),
+                getter: None,
+                setter: None,
                 writable: true,
                 enumerable: false,
                 configurable: false,
@@ -563,6 +567,8 @@ fn remove_from_array(arr_ref: GcRef, target: GcRef, ctx: &mut NativeContext) {
             "length".to_string(),
             Property {
                 value: Value::Number(kept.len() as f64),
+                getter: None,
+                setter: None,
                 writable: true,
                 enumerable: false,
                 configurable: false,
diff --git a/crates/js/src/builtins.rs b/crates/js/src/builtins.rs
index 0d15ffb..d769f8f 100644
--- a/crates/js/src/builtins.rs
+++ b/crates/js/src/builtins.rs
@@ -173,6 +173,8 @@ fn set_array_length(gc: &mut Gc<HeapObject>, shapes: &mut ShapeTable, obj: GcRef
                 "length".to_string(),
                 Property {
                     value: Value::Number(len as f64),
+                    getter: None,
+                    setter: None,
                     writable: true,
                     enumerable: false,
                     configurable: false,
@@ -676,7 +678,7 @@ fn object_get_own_prop_desc(
     ctx: &mut NativeContext,
 ) -> Result<Value, RuntimeError> {
     let obj_ref = match args.first() {
-        Some(Value::Object(r)) => *r,
+        Some(Value::Object(r)) | Some(Value::Function(r)) => *r,
         _ => return Ok(Value::Undefined),
     };
     let key = args
@@ -685,17 +687,31 @@ fn object_get_own_prop_desc(
         .unwrap_or_default();
     let prop = match ctx.gc.get(obj_ref) {
         Some(HeapObject::Object(data)) => data.get_property(&key, ctx.shapes),
+        Some(HeapObject::Function(fdata)) => fdata.properties.get(&key).cloned(),
         _ => None,
     };
     match prop {
         Some(p) => {
             let mut desc = ObjectData::new();
-            desc.insert_property("value".to_string(), Property::data(p.value), ctx.shapes);
-            desc.insert_property(
-                "writable".to_string(),
-                Property::data(Value::Boolean(p.writable)),
-                ctx.shapes,
-            );
+            if p.is_accessor() {
+                desc.insert_property(
+                    "get".to_string(),
+                    Property::data(p.getter.map(Value::Function).unwrap_or(Value::Undefined)),
+                    ctx.shapes,
+                );
+                desc.insert_property(
+                    "set".to_string(),
+                    Property::data(p.setter.map(Value::Function).unwrap_or(Value::Undefined)),
+                    ctx.shapes,
+                );
+            } else {
+                desc.insert_property("value".to_string(), Property::data(p.value), ctx.shapes);
+                desc.insert_property(
+                    "writable".to_string(),
+                    Property::data(Value::Boolean(p.writable)),
+                    ctx.shapes,
+                );
+            }
             desc.insert_property(
                 "enumerable".to_string(),
                 Property::data(Value::Boolean(p.enumerable)),
@@ -714,7 +730,7 @@ fn object_get_own_prop_desc(
 
 fn object_define_property(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
     let obj_ref = match args.first() {
-        Some(Value::Object(r)) => *r,
+        Some(Value::Object(r)) | Some(Value::Function(r)) => *r,
         _ => {
             return Err(RuntimeError::type_error(
                 "Object.defineProperty requires an object",
@@ -735,13 +751,23 @@ fn object_define_property(args: &[Value], ctx: &mut NativeContext) -> Result<Val
     };
 
     // Read descriptor properties.
-    let (value, writable, enumerable, configurable) = {
+    let (value, getter, setter, writable, enumerable, configurable) = {
         match ctx.gc.get(desc_ref) {
             Some(HeapObject::Object(desc_data)) => {
                 let value = desc_data
                     .get_property("value", ctx.shapes)
                     .map(|p| p.value)
                     .unwrap_or(Value::Undefined);
+                let getter = match desc_data.get_property("get", ctx.shapes).map(|p| p.value) {
+                    Some(Value::Function(f)) => Some(f),
+                    Some(Value::Undefined) | None => None,
+                    _ => return Err(RuntimeError::type_error("getter must be a function")),
+                };
+                let setter = match desc_data.get_property("set", ctx.shapes).map(|p| p.value) {
+                    Some(Value::Function(f)) => Some(f),
+                    Some(Value::Undefined) | None => None,
+                    _ => return Err(RuntimeError::type_error("setter must be a function")),
+                };
                 let writable = desc_data
                     .get_property("writable", ctx.shapes)
                     .map(|p| p.value.to_boolean())
@@ -754,25 +780,34 @@ fn object_define_property(args: &[Value], ctx: &mut NativeContext) -> Result<Val
                     .get_property("configurable", ctx.shapes)
                     .map(|p| p.value.to_boolean())
                     .unwrap_or(false);
-                (value, writable, enumerable, configurable)
+                (value, getter, setter, writable, enumerable, configurable)
             }
-            _ => (Value::Undefined, false, false, false),
+            _ => (Value::Undefined, None, None, false, false, false),
         }
     };
 
-    if let Some(HeapObject::Object(data)) = ctx.gc.get_mut(obj_ref) {
-        data.insert_property(
-            key,
-            Property {
-                value,
-                writable,
-                enumerable,
-                configurable,
-            },
-            ctx.shapes,
-        );
+    let prop = if getter.is_some() || setter.is_some() {
+        Property::accessor(getter, setter, enumerable, configurable)
+    } else {
+        Property {
+            value,
+            getter: None,
+            setter: None,
+            writable,
+            enumerable,
+            configurable,
+        }
+    };
+    match ctx.gc.get_mut(obj_ref) {
+        Some(HeapObject::Object(data)) => {
+            data.insert_property(key, prop, ctx.shapes);
+        }
+        Some(HeapObject::Function(fdata)) => {
+            fdata.properties.insert(key, prop);
+        }
+        _ => {}
     }
-    Ok(Value::Object(obj_ref))
+    Ok(args.first().cloned().unwrap_or(Value::Object(obj_ref)))
 }
 
 fn object_freeze(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
@@ -871,7 +906,7 @@ fn object_from_entries(args: &[Value], ctx: &mut NativeContext) -> Result<Value,
 
 fn object_has_own(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
     let obj_ref = match args.first() {
-        Some(Value::Object(r)) => *r,
+        Some(Value::Object(r)) | Some(Value::Function(r)) => *r,
         _ => return Ok(Value::Boolean(false)),
     };
     let key = args
@@ -880,6 +915,9 @@ fn object_has_own(args: &[Value], ctx: &mut NativeContext) -> Result<Value, Runt
         .unwrap_or_default();
     match ctx.gc.get(obj_ref) {
         Some(HeapObject::Object(data)) => Ok(Value::Boolean(data.contains_key(&key, ctx.shapes))),
+        Some(HeapObject::Function(fdata)) => {
+            Ok(Value::Boolean(fdata.properties.contains_key(&key)))
+        }
         _ => Ok(Value::Boolean(false)),
     }
 }
@@ -900,6 +938,8 @@ fn make_string_array(gc: &mut Gc<HeapObject>, shapes: &mut ShapeTable, items: &[
         "length".to_string(),
         Property {
             value: Value::Number(items.len() as f64),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
@@ -929,6 +969,8 @@ fn make_value_array_with_proto(
         "length".to_string(),
         Property {
             value: Value::Number(items.len() as f64),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
@@ -1521,6 +1563,8 @@ fn array_constructor(args: &[Value], ctx: &mut NativeContext) -> Result<Value, R
                 "length".to_string(),
                 Property {
                     value: Value::Number(len as f64),
+                    getter: None,
+                    setter: None,
                     writable: true,
                     enumerable: false,
                     configurable: false,
@@ -1590,6 +1634,8 @@ fn array_from_collection(
         HeapObject::Object(data) => match data.get_property("__obj_tag__", ctx.shapes) {
             Some(Property {
                 value: Value::String(tag),
+                getter: None,
+                setter: None,
                 ..
             }) => tag.clone(),
             _ => return None,
@@ -1982,6 +2028,8 @@ fn array_entries_next(_args: &[Value], ctx: &mut NativeContext) -> Result<Value,
         "length".to_string(),
         Property {
             value: Value::Number(2.0),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
@@ -2090,6 +2138,8 @@ fn string_iterator(_args: &[Value], ctx: &mut NativeContext) -> Result<Value, Ru
         "length".to_string(),
         Property {
             value: Value::Number(s.chars().count() as f64),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
@@ -6713,6 +6763,8 @@ impl<'a> JsonParser<'a> {
                 "length".to_string(),
                 Property {
                     value: Value::Number(0.0),
+                    getter: None,
+                    setter: None,
                     writable: true,
                     enumerable: false,
                     configurable: false,
@@ -6747,6 +6799,8 @@ impl<'a> JsonParser<'a> {
             "length".to_string(),
             Property {
                 value: Value::Number(items.len() as f64),
+                getter: None,
+                setter: None,
                 writable: true,
                 enumerable: false,
                 configurable: false,
diff --git a/crates/js/src/compiler.rs b/crates/js/src/compiler.rs
index 89bfd49..f6373c9 100644
--- a/crates/js/src/compiler.rs
+++ b/crates/js/src/compiler.rs
@@ -1868,41 +1868,51 @@ fn compile_destructuring_pattern(
 
 fn compile_function_decl(fc: &mut FunctionCompiler, func_def: &FunctionDef) -> Result<(), JsError> {
     let name = func_def.id.clone().unwrap_or_default();
-    let inner = compile_function_body_with_captures(fc, func_def)?;
-    let func_idx = fc.builder.add_function(inner);
-
     let existing = if name.is_empty() {
         None
     } else {
         fc.find_local_info(&name)
             .map(|local| (local.reg, local.is_captured))
     };
-    let is_captured = existing
+    let initially_captured = existing
         .map(|(_, captured)| captured)
         .unwrap_or_else(|| fc.captured_names.contains(name.as_str()));
     let reg = existing
         .map(|(reg, _)| reg)
-        .unwrap_or_else(|| fc.define_local_ext(&name, is_captured, false));
+        .unwrap_or_else(|| fc.define_local_ext(&name, initially_captured, false));
+    let cell_already_exists = existing.is_some_and(|(_, captured)| captured);
+
+    let inner = compile_function_body_with_captures(fc, func_def)?;
+    let func_idx = fc.builder.add_function(inner);
+
+    let is_captured = if name.is_empty() {
+        false
+    } else {
+        fc.find_local_info(&name)
+            .map(|local| local.is_captured)
+            .unwrap_or(initially_captured)
+    };
 
     if is_captured {
         // Create a cell if this declaration was not already hoisted for a
         // later-declaration capture, then store the closure into that cell.
-        if existing.is_none() {
+        if !cell_already_exists {
             fc.builder.emit_reg(Op::NewCell, reg);
         }
         let tmp = fc.alloc_reg();
         fc.builder.emit_reg_u16(Op::CreateClosure, tmp, func_idx);
         fc.builder.emit_reg_reg(Op::CellStore, reg, tmp);
-        // Also store as global.
-        if !name.is_empty() {
+        // Top-level function declarations are globals in script code. Nested
+        // function declarations must remain lexical; leaking helper names like
+        // `r` into globals can corrupt bundled module loader self-references.
+        if fc.is_top_level && !name.is_empty() {
             let name_idx = fc.builder.add_name(&name);
             fc.builder.emit_store_global(name_idx, tmp);
         }
         fc.free_reg(tmp);
     } else {
         fc.builder.emit_reg_u16(Op::CreateClosure, reg, func_idx);
-        // Also store as global so inner/recursive calls via LoadGlobal can find it.
-        if !name.is_empty() {
+        if fc.is_top_level && !name.is_empty() {
             let name_idx = fc.builder.add_name(&name);
             fc.builder.emit_store_global(name_idx, reg);
         }
diff --git a/crates/js/src/compression_streams.rs b/crates/js/src/compression_streams.rs
index cf9359d..95ad0af 100644
--- a/crates/js/src/compression_streams.rs
+++ b/crates/js/src/compression_streams.rs
@@ -112,6 +112,8 @@ fn build_byte_array(ctx: &mut NativeContext, bytes: &[u8]) -> Value {
         "length".to_string(),
         Property {
             value: Value::Number(bytes.len() as f64),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
diff --git a/crates/js/src/dom_bridge.rs b/crates/js/src/dom_bridge.rs
index 4623615..0ff837f 100644
--- a/crates/js/src/dom_bridge.rs
+++ b/crates/js/src/dom_bridge.rs
@@ -131,6 +131,8 @@ fn extract_uint8clamped_id(gc: &Gc<HeapObject>, shapes: &ShapeTable, this: &Valu
                 match data.get_property(UINT8_CLAMPED_ID_KEY, shapes) {
                     Some(Property {
                         value: Value::Number(n),
+                        getter: None,
+                        setter: None,
                         ..
                     }) => Some(n as u64),
                     _ => None,
@@ -155,6 +157,8 @@ pub fn resolve_uint8clamped_get(
         Some(HeapObject::Object(data)) => match data.get_property(UINT8_CLAMPED_ID_KEY, shapes) {
             Some(Property {
                 value: Value::Number(n),
+                getter: None,
+                setter: None,
                 ..
             }) => n as u64,
             _ => return None,
@@ -182,6 +186,8 @@ pub fn handle_uint8clamped_set(
         Some(HeapObject::Object(data)) => match data.get_property(UINT8_CLAMPED_ID_KEY, shapes) {
             Some(Property {
                 value: Value::Number(n),
+                getter: None,
+                setter: None,
                 ..
             }) => n as u64,
             _ => return false,
@@ -558,6 +564,8 @@ fn make_wrapper_array(
         "length".to_string(),
         Property {
             value: Value::Number(nodes.len() as f64),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
@@ -1251,6 +1259,8 @@ fn make_empty_array(gc: &mut Gc<HeapObject>, shapes: &mut ShapeTable) -> Value {
         "length".to_string(),
         Property {
             value: Value::Number(0.0),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
@@ -1583,6 +1593,8 @@ fn get_node_id(gc: &Gc<HeapObject>, shapes: &ShapeTable, wrapper: GcRef) -> Opti
         Some(HeapObject::Object(data)) => match data.get_property(NODE_ID_KEY, shapes) {
             Some(Property {
                 value: Value::Number(n),
+                getter: None,
+                setter: None,
                 ..
             }) => Some(NodeId::from_index(n as usize)),
             _ => None,
@@ -2537,6 +2549,8 @@ fn get_canvas_node_id(gc: &Gc<HeapObject>, shapes: &ShapeTable, this: &Value) ->
             Some(HeapObject::Object(data)) => match data.get_property(CANVAS_NODE_ID_KEY, shapes) {
                 Some(Property {
                     value: Value::Number(n),
+                    getter: None,
+                    setter: None,
                     ..
                 }) => Some(NodeId::from_index(n as usize)),
                 _ => None,
@@ -2593,6 +2607,8 @@ fn canvas_get_context(args: &[Value], ctx: &mut NativeContext) -> Result<Value,
         CANVAS_NODE_ID_KEY.to_string(),
         Property {
             value: Value::Number(canvas_node_id.index() as f64),
+            getter: None,
+            setter: None,
             writable: false,
             enumerable: false,
             configurable: false,
@@ -4049,6 +4065,8 @@ fn extract_path2d_id(val: Option<&Value>, gc: &Gc<HeapObject>, shapes: &ShapeTab
             HeapObject::Object(data) => match data.get_property(PATH2D_ID_KEY, shapes)? {
                 Property {
                     value: Value::Number(n),
+                    getter: None,
+                    setter: None,
                     ..
                 } => Some(n as u64),
                 _ => None,
@@ -4762,6 +4780,8 @@ pub fn resolve_dom_get(
                     "length".to_string(),
                     Property {
                         value: Value::Number(doc.attributes(node_id).map_or(0, |a| a.len()) as f64),
+                        getter: None,
+                        setter: None,
                         writable: false,
                         enumerable: false,
                         configurable: false,
@@ -5523,6 +5543,8 @@ pub fn handle_style_set(
         Some(HeapObject::Object(data)) => match data.get_property("__style_node_id__", shapes) {
             Some(Property {
                 value: Value::Number(n),
+                getter: None,
+                setter: None,
                 ..
             }) => NodeId::from_index(n as usize),
             _ => return false,
@@ -5564,6 +5586,8 @@ pub fn handle_canvas_ctx_set(
         Some(HeapObject::Object(data)) => match data.get_property(CANVAS_NODE_ID_KEY, shapes) {
             Some(Property {
                 value: Value::Number(n),
+                getter: None,
+                setter: None,
                 ..
             }) => NodeId::from_index(n as usize),
             _ => return false,
@@ -5847,6 +5871,8 @@ fn extract_gradient_id(
             HeapObject::Object(data) => match data.get_property(GRADIENT_ID_KEY, shapes) {
                 Some(Property {
                     value: Value::Number(n),
+                    getter: None,
+                    setter: None,
                     ..
                 }) => Some(n as u64),
                 _ => None,
@@ -5867,6 +5893,8 @@ fn extract_pattern_id(
             HeapObject::Object(data) => match data.get_property(PATTERN_ID_KEY, shapes) {
                 Some(Property {
                     value: Value::Number(n),
+                    getter: None,
+                    setter: None,
                     ..
                 }) => Some(n as u64),
                 _ => None,
@@ -6477,6 +6505,8 @@ fn pattern_set_transform(args: &[Value], ctx: &mut NativeContext) -> Result<Valu
                 Some(HeapObject::Object(data)) => match data.get_property(field, ctx.shapes) {
                     Some(Property {
                         value: Value::Number(n),
+                        getter: None,
+                        setter: None,
                         ..
                     }) => n,
                     _ => 0.0,
@@ -7405,6 +7435,8 @@ fn event_type_string(vm: &Vm, event_ref: GcRef) -> Option<String> {
         Some(HeapObject::Object(data)) => match data.get_property(EVENT_TYPE_KEY, &vm.shapes) {
             Some(Property {
                 value: Value::String(s),
+                getter: None,
+                setter: None,
                 ..
             }) => Some(s.clone()),
             _ => None,
@@ -7474,6 +7506,8 @@ fn invoke_listeners(
         Some(HeapObject::Object(data)) => match data.get_property(EVENT_TYPE_KEY, &vm.shapes) {
             Some(Property {
                 value: Value::String(s),
+                getter: None,
+                setter: None,
                 ..
             }) => s,
             _ => return,
@@ -7485,6 +7519,8 @@ fn invoke_listeners(
         Some(HeapObject::Object(data)) => match data.get_property(EVENT_PHASE_KEY, &vm.shapes) {
             Some(Property {
                 value: Value::Number(n),
+                getter: None,
+                setter: None,
                 ..
             }) => n as u8,
             _ => 0,
@@ -8143,6 +8179,8 @@ fn invoke_listeners_by_idx(
         Some(HeapObject::Object(data)) => match data.get_property(EVENT_TYPE_KEY, &vm.shapes) {
             Some(Property {
                 value: Value::String(s),
+                getter: None,
+                setter: None,
                 ..
             }) => s,
             _ => return,
diff --git a/crates/js/src/eventsource.rs b/crates/js/src/eventsource.rs
index 18c8ab5..bda5084 100644
--- a/crates/js/src/eventsource.rs
+++ b/crates/js/src/eventsource.rs
@@ -642,6 +642,8 @@ fn empty_array(shapes: &mut crate::shape::ShapeTable) -> ObjectData {
         "length".to_string(),
         Property {
             value: Value::Number(0.0),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
diff --git a/crates/js/src/fetch.rs b/crates/js/src/fetch.rs
index 9ebb4cd..9ffba22 100644
--- a/crates/js/src/fetch.rs
+++ b/crates/js/src/fetch.rs
@@ -29,6 +29,21 @@ pub struct FetchResult {
     pub redirected: bool,
 }
 
+/// A fully resolved fetch request offered to the embedder before the built-in
+/// network path runs.
+#[derive(Clone)]
+pub struct HostFetchRequest {
+    pub url: String,
+    pub method: String,
+    pub headers: Vec<(String, String)>,
+    pub body: Option<Vec<u8>>,
+    pub document_origin: Option<String>,
+    pub cors_mode: String,
+    pub credentials_mode: String,
+}
+
+type HostFetchHandler = Box<dyn FnMut(&HostFetchRequest) -> Option<Result<FetchResult, String>>>;
+
 /// A fetch that is in-flight or just completed.
 struct PendingFetch {
     /// The promise returned to JS.
@@ -46,6 +61,8 @@ thread_local! {
     static DOCUMENT_ORIGIN: RefCell<Option<String>> = const { RefCell::new(None) };
     /// Serialized document URL used to resolve relative fetch() inputs.
     static DOCUMENT_BASE_URL: RefCell<Option<String>> = const { RefCell::new(None) };
+    /// Embedder-provided fast path for requests already satisfied by the host.
+    static HOST_FETCH_HANDLER: RefCell<Option<HostFetchHandler>> = RefCell::new(None);
 }
 
 static NEXT_BODY_STREAM_ID: AtomicU64 = AtomicU64::new(1);
@@ -102,9 +119,11 @@ pub fn set_document_origin(origin: &str) {
     DOCUMENT_ORIGIN.with(|o| *o.borrow_mut() = Some(origin.to_string()));
 }
 
-/// Clear the document origin (e.g. when detaching the document).
+/// Clear the document origin (e.g. when detaching the document) and any host
+/// fetch handler tied to that document.
 pub fn clear_document_origin() {
     DOCUMENT_ORIGIN.with(|o| *o.borrow_mut() = None);
+    clear_host_fetch_handler();
 }
 
 /// Get the current document origin, if set.
@@ -122,12 +141,39 @@ pub fn clear_document_base_url() {
     DOCUMENT_BASE_URL.with(|u| *u.borrow_mut() = None);
 }
 
+/// Install an embedder-provided fetch handler for the current thread.
+///
+/// The handler is consulted after local `data:`/`file:` handling and before
+/// the built-in network client is used. Returning `None` falls through to the
+/// normal network path; returning `Some` resolves or rejects the JS promise
+/// with the supplied result.
+pub fn set_host_fetch_handler<F>(handler: F)
+where
+    F: FnMut(&HostFetchRequest) -> Option<Result<FetchResult, String>> + 'static,
+{
+    HOST_FETCH_HANDLER.with(|h| {
+        *h.borrow_mut() = Some(Box::new(handler));
+    });
+}
+
+/// Remove any embedder-provided fetch handler for the current thread.
+pub fn clear_host_fetch_handler() {
+    HOST_FETCH_HANDLER.with(|h| {
+        h.borrow_mut().take();
+    });
+}
+
+fn try_host_fetch(request: &HostFetchRequest) -> Option<Result<FetchResult, String>> {
+    HOST_FETCH_HANDLER.with(|h| h.borrow_mut().as_mut().and_then(|handler| handler(request)))
+}
+
 /// Reset fetch state (useful for tests).
 pub fn reset_fetch_state() {
     FETCH_STATE.with(|s| s.borrow_mut().clear());
     FETCH_BODY_STREAMS.with(|s| s.borrow_mut().clear());
     FETCH_UPLOAD_STREAMS.with(|s| s.borrow_mut().clear());
     clear_document_base_url();
+    clear_host_fetch_handler();
 }
 
 /// Returns true if there are any in-flight fetches.
@@ -289,6 +335,27 @@ pub fn fetch_native(args: &[Value], ctx: &mut NativeContext) -> Result<Value, Ru
         return Ok(Value::Object(promise));
     }
 
+    let request = HostFetchRequest {
+        url: url_str.clone(),
+        method: method.clone(),
+        headers: req_headers.clone(),
+        body: body.clone(),
+        document_origin: doc_origin.clone(),
+        cors_mode: cors_mode.clone(),
+        credentials_mode: credentials_mode.clone(),
+    };
+    if let Some(result) = try_host_fetch(&request) {
+        match result {
+            Ok(result) => {
+                let response = create_response_object(ctx.gc, ctx.shapes, &result);
+                set_builtin_prop(ctx.gc, ctx.shapes, response, "body", Value::Null);
+                resolve_promise_internal(ctx.gc, ctx.shapes, promise, Value::Object(response));
+            }
+            Err(err) => reject_promise_internal(ctx.gc, ctx.shapes, promise, Value::String(err)),
+        }
+        return Ok(Value::Object(promise));
+    }
+
     let body_stream_id = NEXT_BODY_STREAM_ID.fetch_add(1, Ordering::Relaxed);
     let body_events = Arc::new(Mutex::new(Vec::new()));
     let body_cancelled = Arc::new(Mutex::new(false));
@@ -2219,6 +2286,50 @@ mod tests {
         result
     }
 
+    #[test]
+    fn test_fetch_uses_host_handler() {
+        reset_fetch_state();
+        crate::timers::reset_timers();
+
+        let seen = Arc::new(AtomicBool::new(false));
+        let seen_for_handler = Arc::clone(&seen);
+        set_document_base_url("https://example.test/page.html");
+        set_host_fetch_handler(move |request| {
+            seen_for_handler.store(true, Ordering::SeqCst);
+            assert_eq!(request.url, "https://example.test/data.txt");
+            assert_eq!(request.method, "GET");
+            Some(Ok(FetchResult {
+                status: 200,
+                status_text: "OK".to_string(),
+                headers: vec![("Content-Type".to_string(), "text/plain".to_string())],
+                body: b"from host".to_vec(),
+                body_stream_id: None,
+                url: request.url.clone(),
+                redirected: false,
+            }))
+        });
+
+        let console = Rc::new(CapturedConsole::new());
+        let source = r#"
+            fetch("/data.txt").then(function(resp) {
+                return resp.text();
+            }).then(function(text) {
+                console.log("body:" + text);
+            });
+        "#;
+        let program = Parser::parse(source).expect("parse failed");
+        let func = compiler::compile(&program).expect("compile failed");
+        let mut vm = Vm::new();
+        init_fetch_api(&mut vm);
+        vm.set_console_output(Box::new(RcConsole(console.clone())));
+        vm.execute(&func).expect("execute failed");
+        vm.run_event_loop(25).expect("event loop failed");
+
+        assert!(seen.load(Ordering::SeqCst));
+        assert_eq!(console.log_messages.borrow().as_slice(), ["body:from host"]);
+        reset_fetch_state();
+    }
+
     fn spawn_chunked_server(chunks: Vec<&'static [u8]>) -> String {
         let listener = TcpListener::bind("127.0.0.1:0").expect("bind test server");
         let addr = listener.local_addr().expect("local addr");
diff --git a/crates/js/src/indexeddb.rs b/crates/js/src/indexeddb.rs
index 1ae30a3..31707fc 100644
--- a/crates/js/src/indexeddb.rs
+++ b/crates/js/src/indexeddb.rs
@@ -130,6 +130,8 @@ pub fn idb_to_value(gc: &mut Gc<HeapObject>, shapes: &mut ShapeTable, val: &IdbV
                 "length".to_string(),
                 Property {
                     value: Value::Number(items.len() as f64),
+                    getter: None,
+                    setter: None,
                     writable: true,
                     enumerable: false,
                     configurable: false,
@@ -971,6 +973,8 @@ fn make_string_list(gc: &mut Gc<HeapObject>, shapes: &mut ShapeTable, items: &[S
         "length".to_string(),
         Property {
             value: Value::Number(items.len() as f64),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
@@ -1866,6 +1870,8 @@ fn idb_store_get_all(_args: &[Value], ctx: &mut NativeContext) -> Result<Value,
         "length".to_string(),
         Property {
             value: Value::Number(values.len() as f64),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
diff --git a/crates/js/src/main_thread_worker.rs b/crates/js/src/main_thread_worker.rs
index b5584df..fa76c87 100644
--- a/crates/js/src/main_thread_worker.rs
+++ b/crates/js/src/main_thread_worker.rs
@@ -259,6 +259,8 @@ fn empty_array(shapes: &mut crate::shape::ShapeTable) -> ObjectData {
         "length".to_string(),
         Property {
             value: Value::Number(0.0),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
@@ -450,6 +452,8 @@ fn append_to_array(arr_ref: GcRef, val: Value, ctx: &mut NativeContext) {
             "length".to_string(),
             Property {
                 value: Value::Number((len + 1) as f64),
+                getter: None,
+                setter: None,
                 writable: true,
                 enumerable: false,
                 configurable: false,
@@ -483,6 +487,8 @@ fn remove_from_array(arr_ref: GcRef, target: GcRef, ctx: &mut NativeContext) {
             "length".to_string(),
             Property {
                 value: Value::Number(kept.len() as f64),
+                getter: None,
+                setter: None,
                 writable: true,
                 enumerable: false,
                 configurable: false,
diff --git a/crates/js/src/performance.rs b/crates/js/src/performance.rs
index 3c732d1..4774321 100644
--- a/crates/js/src/performance.rs
+++ b/crates/js/src/performance.rs
@@ -109,6 +109,8 @@ fn empty_array_value(ctx: &mut NativeContext) -> Value {
         "length".to_string(),
         Property {
             value: Value::Number(0.0),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
diff --git a/crates/js/src/structured_clone.rs b/crates/js/src/structured_clone.rs
index b94f061..411991f 100644
--- a/crates/js/src/structured_clone.rs
+++ b/crates/js/src/structured_clone.rs
@@ -445,6 +445,8 @@ fn read_value(
                     "length".to_string(),
                     Property {
                         value: Value::Number(len as f64),
+                        getter: None,
+                        setter: None,
                         writable: true,
                         enumerable: false,
                         configurable: false,
@@ -697,6 +699,8 @@ mod tests {
                 "length".to_string(),
                 Property {
                     value: Value::Number(elems.len() as f64),
+                    getter: None,
+                    setter: None,
                     writable: true,
                     enumerable: false,
                     configurable: false,
@@ -754,6 +758,8 @@ mod tests {
                 "length".to_string(),
                 Property {
                     value: Value::Number(2.0),
+                    getter: None,
+                    setter: None,
                     writable: true,
                     enumerable: false,
                     configurable: false,
diff --git a/crates/js/src/typed_array.rs b/crates/js/src/typed_array.rs
index 9b8895c..c2412db 100644
--- a/crates/js/src/typed_array.rs
+++ b/crates/js/src/typed_array.rs
@@ -201,6 +201,7 @@ fn alloc_typed_array(
     ctx: &mut NativeContext,
 ) -> Value {
     let mut obj = ObjectData::new();
+    let set_fn = make_native(ctx.gc, "set", typed_array_set_method);
     obj.insert_property(
         "__ta_kind__".to_string(),
         Property::builtin(Value::String(kind.name().to_string())),
@@ -226,6 +227,11 @@ fn alloc_typed_array(
         Property::builtin(Value::Number(0.0)),
         ctx.shapes,
     );
+    obj.insert_property(
+        "set".to_string(),
+        Property::builtin(Value::Function(set_fn)),
+        ctx.shapes,
+    );
     for i in 0..length {
         let v = initial
             .as_ref()
@@ -236,6 +242,90 @@ fn alloc_typed_array(
     Value::Object(ctx.gc.alloc(HeapObject::Object(obj)))
 }
 
+fn typed_array_set_method(args: &[Value], ctx: &mut NativeContext) -> Result<Value, RuntimeError> {
+    let target_ref = match ctx.this {
+        Value::Object(r) => r,
+        _ => {
+            return Err(RuntimeError::type_error(
+                "TypedArray.set requires a typed array",
+            ))
+        }
+    };
+    let (kind, target_len) = typed_array_kind_and_length(ctx.gc, ctx.shapes, target_ref)
+        .ok_or_else(|| RuntimeError::type_error("TypedArray.set requires a typed array"))?;
+    let offset = args
+        .get(1)
+        .map(|v| v.to_number().max(0.0) as usize)
+        .unwrap_or(0);
+    let source_values = match args.first() {
+        Some(Value::Object(r)) => read_array_like_values(*r, ctx),
+        Some(Value::Function(r)) => read_array_like_values(*r, ctx),
+        _ => Vec::new(),
+    };
+
+    for (idx, value) in source_values.into_iter().enumerate() {
+        let target_idx = offset + idx;
+        if target_idx >= target_len {
+            break;
+        }
+        if let Some(HeapObject::Object(data)) = ctx.gc.get_mut(target_ref) {
+            data.set_property(target_idx.to_string(), kind.coerce(&value), ctx.shapes);
+        }
+    }
+    Ok(Value::Undefined)
+}
+
+fn typed_array_kind_and_length(
+    gc: &Gc<HeapObject>,
+    shapes: &ShapeTable,
+    obj: GcRef,
+) -> Option<(TypedArrayKind, usize)> {
+    let data = match gc.get(obj)? {
+        HeapObject::Object(data) => data,
+        _ => return None,
+    };
+    let kind = data
+        .get_property("__ta_kind__", shapes)
+        .and_then(|p| match p.value {
+            Value::String(name) => TypedArrayKind::from_name(&name),
+            _ => None,
+        })?;
+    let len = data
+        .get_property("length", shapes)
+        .map(|p| p.value.to_number().max(0.0) as usize)
+        .unwrap_or(0);
+    Some((kind, len))
+}
+
+fn read_array_like_values(obj: GcRef, ctx: &NativeContext) -> Vec<Value> {
+    let length = match ctx.gc.get(obj) {
+        Some(HeapObject::Object(data)) => data
+            .get_property("length", ctx.shapes)
+            .map(|p| p.value.to_number().max(0.0) as usize)
+            .unwrap_or(0),
+        Some(HeapObject::Function(_)) => 0,
+        _ => 0,
+    };
+    let mut values = Vec::with_capacity(length);
+    for i in 0..length {
+        let key = i.to_string();
+        let value = match ctx.gc.get(obj) {
+            Some(HeapObject::Object(data)) => data
+                .get_property(&key, ctx.shapes)
+                .map(|p| p.value.clone())
+                .unwrap_or(Value::Undefined),
+            Some(HeapObject::Function(fdata)) => fdata
+                .properties
+                .get(&key)
+                .map(|p| p.value.clone())
+                .unwrap_or(Value::Undefined),
+            _ => Value::Undefined,
+        };
+        values.push(value);
+    }
+    values
+}
+
 /// Constructor body used by every kind. We resolve `self` to a `TypedArrayKind`
 /// via the `__ta_kind__` slot the make_native closure setup would need — but
 /// `make_native` only takes a static fn pointer, so each kind gets its own
@@ -528,6 +618,28 @@ mod tests {
         assert_eq!(r, "2:100,200");
     }
 
+    #[test]
+    fn set_copies_array_like_with_offset_and_coercion() {
+        let r = eval(
+            "var a = new Uint8Array(4); a.set([3, 260], 1); \
+             typeof a.set + ':' + a[0] + ',' + a[1] + ',' + a[2] + ',' + a[3]",
+        )
+        .unwrap();
+        assert_eq!(r, "function:0,3,4,0");
+    }
+
+    #[test]
+    fn set_copies_typed_array_source() {
+        let r = eval(
+            "var src = new Uint8Array([7, 8]); \
+             var dst = new Uint8Array(4); \
+             dst.set(src, 2); \
+             dst[0] + ',' + dst[1] + ',' + dst[2] + ',' + dst[3]",
+        )
+        .unwrap();
+        assert_eq!(r, "0,0,7,8");
+    }
+
     #[test]
     fn indexed_read_write_round_trip() {
         let r = eval(
diff --git a/crates/js/src/vm.rs b/crates/js/src/vm.rs
index c4dcf9f..5b73596 100644
--- a/crates/js/src/vm.rs
+++ b/crates/js/src/vm.rs
@@ -76,9 +76,7 @@ impl Traceable for HeapObject {
                     visitor(proto);
                 }
                 for prop in fdata.properties.values() {
-                    if let Some(r) = prop.value.gc_ref() {
-                        visitor(r);
-                    }
+                    prop.trace(visitor);
                 }
                 for &uv in &fdata.upvalues {
                     visitor(uv);
@@ -111,6 +109,10 @@ impl Traceable for HeapObject {
 pub struct Property {
     /// The property's value (for data properties).
     pub value: Value,
+    /// Getter function for accessor properties.
+    pub getter: Option<GcRef>,
+    /// Setter function for accessor properties.
+    pub setter: Option<GcRef>,
     /// Whether the value can be changed via assignment.
     pub writable: bool,
     /// Whether the property shows up in `for...in` and `Object.keys`.
@@ -125,6 +127,8 @@ impl Property {
     pub fn data(value: Value) -> Self {
         Self {
             value,
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: true,
             configurable: true,
@@ -135,11 +139,46 @@ impl Property {
     pub fn builtin(value: Value) -> Self {
         Self {
             value,
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,
         }
     }
+
+    /// Create an accessor property.
+    pub fn accessor(
+        getter: Option<GcRef>,
+        setter: Option<GcRef>,
+        enumerable: bool,
+        configurable: bool,
+    ) -> Self {
+        Self {
+            value: Value::Undefined,
+            getter,
+            setter,
+            writable: false,
+            enumerable,
+            configurable,
+        }
+    }
+
+    pub fn is_accessor(&self) -> bool {
+        self.getter.is_some() || self.setter.is_some()
+    }
+
+    fn trace(&self, visitor: &mut dyn FnMut(GcRef)) {
+        if let Some(r) = self.value.gc_ref() {
+            visitor(r);
+        }
+        if let Some(getter) = self.getter {
+            visitor(getter);
+        }
+        if let Some(setter) = self.setter {
+            visitor(setter);
+        }
+    }
 }
 
 /// Result of a property removal attempt.
@@ -190,6 +229,8 @@ impl ObjectData {
                 let desc = shapes.lookup(*shape, key)?;
                 Some(Property {
                     value: slots[desc.index as usize].clone(),
+                    getter: None,
+                    setter: None,
                     writable: desc.attrs.writable,
                     enumerable: desc.attrs.enumerable,
                     configurable: desc.attrs.configurable,
@@ -211,6 +252,14 @@ impl ObjectData {
     /// exists, updates its slot value (ignoring attribute differences). If it
     /// does not exist, transitions to a child shape.
     pub fn insert_property(&mut self, key: String, prop: Property, shapes: &mut ShapeTable) {
+        if prop.is_accessor() {
+            self.to_dictionary(shapes);
+            if let ObjectStorage::Dictionary(map) = &mut self.storage {
+                map.insert(key, prop);
+            }
+            return;
+        }
+
         let attrs = PropertyAttrs {
             writable: prop.writable,
             enumerable: prop.enumerable,
@@ -249,6 +298,9 @@ impl ObjectData {
             }
             ObjectStorage::Dictionary(map) => {
                 if let Some(prop) = map.get_mut(key) {
+                    if prop.is_accessor() {
+                        return false;
+                    }
                     if prop.writable {
                         prop.value = val;
                         return true;
@@ -275,6 +327,9 @@ impl ObjectData {
             }
             ObjectStorage::Dictionary(map) => {
                 if let Some(prop) = map.get_mut(&key) {
+                    if prop.is_accessor() {
+                        return;
+                    }
                     if prop.writable {
                         prop.value = val;
                     }
@@ -337,6 +392,8 @@ impl ObjectData {
                         name,
                         Property {
                             value: slots[desc.index as usize].clone(),
+                            getter: None,
+                            setter: None,
                             writable: desc.attrs.writable,
                             enumerable: desc.attrs.enumerable,
                             configurable: desc.attrs.configurable,
@@ -387,6 +444,8 @@ impl ObjectData {
                     name,
                     Property {
                         value: slots[desc.index as usize].clone(),
+                        getter: None,
+                        setter: None,
                         writable: desc.attrs.writable,
                         enumerable: desc.attrs.enumerable,
                         configurable: desc.attrs.configurable,
@@ -434,9 +493,7 @@ impl ObjectData {
             }
             ObjectStorage::Dictionary(map) => {
                 for prop in map.values() {
-                    if let Some(r) = prop.value.gc_ref() {
-                        visitor(r);
-                    }
+                    prop.trace(visitor);
                 }
             }
         }
@@ -906,53 +963,6 @@ fn nullish_property_read_error(receiver: &Value, key: &str) -> Option<RuntimeErr
 
 // ── Property access helpers ──────────────────────────────────
 
-/// Get an object's own property value using IC, also returning shape+slot for IC
-/// update if the property was found as an own property on a shaped object.
-fn gc_get_property_ic(
-    gc: &Gc<HeapObject>,
-    obj_ref: GcRef,
-    key: &str,
-    shapes: &ShapeTable,
-) -> (Value, Option<(ShapeId, u32)>) {
-    let proto = match gc.get(obj_ref) {
-        Some(HeapObject::Object(data)) => {
-            if let ObjectStorage::Shaped { shape, slots } = &data.storage {
-                if let Some(desc) = shapes.lookup(*shape, key) {
-                    return (
-                        slots[desc.index as usize].clone(),
-                        Some((*shape, desc.index)),
-                    );
-                }
-            } else if let ObjectStorage::Dictionary(map) = &data.storage {
-                if let Some(prop) = map.get(key) {
-                    return (prop.value.clone(), None);
-                }
-            }
-            data.prototype
-        }
-        Some(HeapObject::Function(fdata)) => {
-            if let Some(prop) = fdata.properties.get(key) {
-                return (prop.value.clone(), None);
-            }
-            if key == "prototype" {
-                if let Some(proto_ref) = fdata.prototype_obj {
-                    return (Value::Object(proto_ref), None);
-                }
-                return (Value::Undefined, None);
-            }
-            None
-        }
-        _ => return (Value::Undefined, None),
-    };
-    if let Some(proto_ref) = proto {
-        // Prototype chain hit — do NOT provide IC info (only own properties).
-        let val = gc_get_property(gc, proto_ref, key, shapes);
-        (val, None)
-    } else {
-        (Value::Undefined, None)
-    }
-}
-
 /// Get a property from an object, walking the prototype chain.
 fn gc_get_property(gc: &Gc<HeapObject>, obj_ref: GcRef, key: &str, shapes: &ShapeTable) -> Value {
     let proto = {
@@ -1509,6 +1519,92 @@ impl Vm {
         self.console_output = output;
     }
 
+    fn property_value(&mut self, prop: Property, receiver: Value) -> Result<Value, RuntimeError> {
+        match prop.getter {
+            Some(getter) => self.call_function_with_this(getter, receiver, &[]),
+            None => Ok(prop.value),
+        }
+    }
+
+    fn get_object_property_value(
+        &mut self,
+        obj_ref: GcRef,
+        key: &str,
+    ) -> Result<Value, RuntimeError> {
+        let mut current = Some(obj_ref);
+        while let Some(current_ref) = current {
+            let (prop, proto) = match self.gc.get(current_ref) {
+                Some(HeapObject::Object(data)) => {
+                    (data.get_property(key, &self.shapes), data.prototype)
+                }
+                Some(HeapObject::Function(fdata)) => {
+                    if let Some(prop) = fdata.properties.get(key) {
+                        (Some(prop.clone()), None)
+                    } else if key == "prototype" {
+                        return Ok(fdata
+                            .prototype_obj
+                            .map(Value::Object)
+                            .unwrap_or(Value::Undefined));
+                    } else {
+                        (None, None)
+                    }
+                }
+                _ => return Ok(Value::Undefined),
+            };
+            if let Some(prop) = prop {
+                return self.property_value(prop, Value::Object(obj_ref));
+            }
+            current = proto;
+        }
+        Ok(Value::Undefined)
+    }
+
+    fn get_object_property_value_ic(
+        &mut self,
+        obj_ref: GcRef,
+        key: &str,
+    ) -> Result<(Value, Option<(ShapeId, u32)>), RuntimeError> {
+        let mut current = Some(obj_ref);
+        while let Some(current_ref) = current {
+            let (prop, proto, own_slot) = match self.gc.get(current_ref) {
+                Some(HeapObject::Object(data)) => match &data.storage {
+                    ObjectStorage::Shaped { shape, slots } => {
+                        if let Some(desc) = self.shapes.lookup(*shape, key) {
+                            return Ok((
+                                slots[desc.index as usize].clone(),
+                                Some((*shape, desc.index)),
+                            ));
+                        }
+                        (None, data.prototype, None)
+                    }
+                    ObjectStorage::Dictionary(map) => (map.get(key).cloned(), data.prototype, None),
+                },
+                Some(HeapObject::Function(fdata)) => {
+                    if let Some(prop) = fdata.properties.get(key) {
+                        (Some(prop.clone()), None, None)
+                    } else if key == "prototype" {
+                        return Ok((
+                            fdata
+                                .prototype_obj
+                                .map(Value::Object)
+                                .unwrap_or(Value::Undefined),
+                            None,
+                        ));
+                    } else {
+                        (None, None, None)
+                    }
+                }
+                _ => return Ok((Value::Undefined, None)),
+            };
+            if let Some(prop) = prop {
+                let value = self.property_value(prop, Value::Object(obj_ref))?;
+                return Ok((value, own_slot));
+            }
+            current = proto;
+        }
+        Ok((Value::Undefined, None))
+    }
+
     /// Attach a DOM document to this VM, registering the `document` global
     /// and enabling DOM-JS interop.
     pub fn attach_document(&mut self, doc: Document) {
@@ -2477,6 +2573,8 @@ impl Vm {
             "__gen__".to_string(),
             Property {
                 value: Value::Object(gen_ref),
+                getter: None,
+                setter: None,
                 writable: false,
                 enumerable: false,
                 configurable: false,
@@ -2600,6 +2698,8 @@ impl Vm {
             "length".to_string(),
             Property {
                 value: Value::Number(args.len() as f64),
+                getter: None,
+                setter: None,
                 writable: true,
                 enumerable: false,
                 configurable: true,
@@ -3152,6 +3252,8 @@ impl Vm {
             "__gen__".to_string(),
             Property {
                 value: Value::Object(gen_ref),
+                getter: None,
+                setter: None,
                 writable: false,
                 enumerable: false,
                 configurable: false,
@@ -4500,6 +4602,8 @@ impl Vm {
                             "constructor".to_string(),
                             Property {
                                 value: Value::Function(gc_ref),
+                                getter: None,
+                                setter: None,
                                 writable: true,
                                 enumerable: false,
                                 configurable: true,
@@ -4549,26 +4653,28 @@ impl Vm {
                                 &key,
                             )
                         })
-                        .unwrap_or_else(|| gc_get_property(&self.gc, *gc_ref, &key, &self.shapes)),
+                        .map(Ok)
+                        .unwrap_or_else(|| self.get_object_property_value(*gc_ref, &key))?,
                         Value::Function(gc_ref) => self.get_function_property(*gc_ref, &key),
                         Value::String(s) => {
                             let v = string_get_property(s, &key);
                             if matches!(v, Value::Undefined) {
-                                self.string_prototype
-                                    .map(|p| gc_get_property(&self.gc, p, &key, &self.shapes))
-                                    .unwrap_or(Value::Undefined)
+                                match self.string_prototype {
+                                    Some(p) => self.get_object_property_value(p, &key)?,
+                                    None => Value::Undefined,
+                                }
                             } else {
                                 v
                             }
                         }
-                        Value::Number(_) => self
-                            .number_prototype
-                            .map(|p| gc_get_property(&self.gc, p, &key, &self.shapes))
-                            .unwrap_or(Value::Undefined),
-                        Value::Boolean(_) => self
-                            .boolean_prototype
-                            .map(|p| gc_get_property(&self.gc, p, &key, &self.shapes))
-                            .unwrap_or(Value::Undefined),
+                        Value::Number(_) => match self.number_prototype {
+                            Some(p) => self.get_object_property_value(p, &key)?,
+                            None => Value::Undefined,
+                        },
+                        Value::Boolean(_) => match self.boolean_prototype {
+                            Some(p) => self.get_object_property_value(p, &key)?,
+                            None => Value::Undefined,
+                        },
                         _ => Value::Undefined,
                     };
                     // DOM dynamic property interception.
@@ -4715,6 +4821,8 @@ impl Vm {
                         "length".to_string(),
                         Property {
                             value: Value::Number(0.0),
+                            getter: None,
+                            setter: None,
                             writable: true,
                             enumerable: false,
                             configurable: false,
@@ -4784,7 +4892,7 @@ impl Vm {
                                 } else {
                                     // Try own-property lookup for IC update.
                                     let (val, own_slot) =
-                                        gc_get_property_ic(&self.gc, *gc_ref, &key, &self.shapes);
+                                        self.get_object_property_value_ic(*gc_ref, &key)?;
                                     if let Some((shape, slot_index)) = own_slot {
                                         self.frames[fi].func.inline_caches[ic_idx]
                                             .update(shape, slot_index);
@@ -4796,21 +4904,22 @@ impl Vm {
                             Value::String(s) => {
                                 let v = string_get_property(s, &key);
                                 if matches!(v, Value::Undefined) {
-                                    self.string_prototype
-                                        .map(|p| gc_get_property(&self.gc, p, &key, &self.shapes))
-                                        .unwrap_or(Value::Undefined)
+                                    match self.string_prototype {
+                                        Some(p) => self.get_object_property_value(p, &key)?,
+                                        None => Value::Undefined,
+                                    }
                                 } else {
                                     v
                                 }
                             }
-                            Value::Number(_) => self
-                                .number_prototype
-                                .map(|p| gc_get_property(&self.gc, p, &key, &self.shapes))
-                                .unwrap_or(Value::Undefined),
-                            Value::Boolean(_) => self
-                                .boolean_prototype
-                                .map(|p| gc_get_property(&self.gc, p, &key, &self.shapes))
-                                .unwrap_or(Value::Undefined),
+                            Value::Number(_) => match self.number_prototype {
+                                Some(p) => self.get_object_property_value(p, &key)?,
+                                None => Value::Undefined,
+                            },
+                            Value::Boolean(_) => match self.boolean_prototype {
+                                Some(p) => self.get_object_property_value(p, &key)?,
+                                None => Value::Undefined,
+                            },
                             _ => Value::Undefined,
                         };
                         // DOM dynamic property interception.
@@ -4985,6 +5094,8 @@ impl Vm {
                         "length".to_string(),
                         Property {
                             value: Value::Number(keys.len() as f64),
+                            getter: None,
+                            setter: None,
                             writable: true,
                             enumerable: false,
                             configurable: false,
@@ -5281,6 +5392,8 @@ impl Vm {
                                 "length".to_string(),
                                 Property {
                                     value: Value::Number((len + 1) as f64),
+                                    getter: None,
+                                    setter: None,
                                     writable: true,
                                     enumerable: false,
                                     configurable: false,
@@ -5417,12 +5530,35 @@ impl Vm {
     }
 
     fn get_function_property(&mut self, func_ref: GcRef, key: &str) -> Value {
-        let value = gc_get_property(&self.gc, func_ref, key, &self.shapes);
-        if !matches!(value, Value::Undefined) {
+        let own = match self.gc.get(func_ref) {
+            Some(HeapObject::Function(fdata)) => {
+                if let Some(prop) = fdata.properties.get(key) {
+                    Some(prop.clone())
+                } else if key == "prototype" {
+                    return fdata
+                        .prototype_obj
+                        .map(Value::Object)
+                        .unwrap_or(Value::Undefined);
+                } else {
+                    None
+                }
+            }
+            _ => None,
+        };
+        if let Some(prop) = own {
+            return self
+                .property_value(prop, Value::Function(func_ref))
+                .unwrap_or(Value::Undefined);
+        }
+        if let Some(value) = self.function_builtin_method(key) {
             return value;
         }
-        self.function_builtin_method(key)
-            .unwrap_or(Value::Undefined)
+        match self.object_prototype {
+            Some(proto) => self
+                .get_object_property_value(proto, key)
+                .unwrap_or(Value::Undefined),
+            None => Value::Undefined,
+        }
     }
 
     fn function_builtin_method(&mut self, key: &str) -> Option<Value> {
@@ -5753,7 +5889,7 @@ impl Vm {
             };
             let val = match &receiver {
                 Value::Object(gc_ref) => {
-                    let (val, own_slot) = gc_get_property_ic(&self.gc, *gc_ref, &key, &self.shapes);
+                    let (val, own_slot) = self.get_object_property_value_ic(*gc_ref, &key)?;
                     if let Some((shape, slot_index)) = own_slot {
                         self.frames[fi].func.inline_caches[ic_idx as usize]
                             .update(shape, slot_index);
@@ -5764,21 +5900,22 @@ impl Vm {
                 Value::String(s) => {
                     let v = string_get_property(s, &key);
                     if matches!(v, Value::Undefined) {
-                        self.string_prototype
-                            .map(|p| gc_get_property(&self.gc, p, &key, &self.shapes))
-                            .unwrap_or(Value::Undefined)
+                        match self.string_prototype {
+                            Some(p) => self.get_object_property_value(p, &key)?,
+                            None => Value::Undefined,
+                        }
                     } else {
                         v
                     }
                 }
-                Value::Number(_) => self
-                    .number_prototype
-                    .map(|p| gc_get_property(&self.gc, p, &key, &self.shapes))
-                    .unwrap_or(Value::Undefined),
-                Value::Boolean(_) => self
-                    .boolean_prototype
-                    .map(|p| gc_get_property(&self.gc, p, &key, &self.shapes))
-                    .unwrap_or(Value::Undefined),
+                Value::Number(_) => match self.number_prototype {
+                    Some(p) => self.get_object_property_value(p, &key)?,
+                    None => Value::Undefined,
+                },
+                Value::Boolean(_) => match self.boolean_prototype {
+                    Some(p) => self.get_object_property_value(p, &key)?,
+                    None => Value::Undefined,
+                },
                 _ => Value::Undefined,
             };
             let val = match val {
@@ -5904,14 +6041,15 @@ impl Vm {
             return Err(err);
         }
         let val = match &receiver {
-            Value::Object(r) => gc_get_property(&self.gc, *r, &key, &self.shapes),
+            Value::Object(r) => self.get_object_property_value(*r, &key)?,
             Value::Function(r) => self.get_function_property(*r, &key),
             Value::String(s) => {
                 let v = string_get_property(s, &key);
                 if matches!(v, Value::Undefined) {
-                    self.string_prototype
-                        .map(|p| gc_get_property(&self.gc, p, &key, &self.shapes))
-                        .unwrap_or(Value::Undefined)
+                    match self.string_prototype {
+                        Some(p) => self.get_object_property_value(p, &key)?,
+                        None => Value::Undefined,
+                    }
                 } else {
                     v
                 }
@@ -6237,6 +6375,8 @@ impl Vm {
             "length".to_string(),
             Property {
                 value: Value::Number(0.0),
+                getter: None,
+                setter: None,
                 writable: true,
                 enumerable: false,
                 configurable: false,
@@ -7585,6 +7725,690 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_define_property_accessor_getter_is_lazy() {
+        let src = r#"
+            var exports = {};
+            Object.defineProperty(exports, "default", {
+                enumerable: true,
+                get: function() { return value; }
+            });
+            var value = function(s) { return s + "!"; };
+            var desc = Object.getOwnPropertyDescriptor(exports, "default");
+            exports.default("ok") + ":" + typeof desc.get + ":" + Object.keys(exports)[0]
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "ok!:function:default"),
+            v => panic!("expected accessor result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_define_property_accessor_on_function_object() {
+        let src = r#"
+            function Events() {}
+            Events.privInstance = { attachConsoleListener: function(listener) { return "attached"; } };
+            Object.defineProperty(Events, "instance", {
+                get: function() { return Events.privInstance; }
+            });
+            var desc = Object.getOwnPropertyDescriptor(Events, "instance");
+            Events.instance.attachConsoleListener({}) + ":" + typeof desc.get + ":" +
+                Object.hasOwn(Events, "instance")
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "attached:function:true"),
+            v => panic!("expected function accessor result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_static_accessor_returns_constructed_instance_with_prototype_method() {
+        let src = r#"
+            function EventSource() {
+                this.privConsoleListener = undefined;
+            }
+            EventSource.prototype.attach = function(listener) {
+                return {
+                    detach: function() {
+                        return "detached";
+                    }
+                };
+            };
+            EventSource.prototype.attachConsoleListener = function(listener) {
+                if (this.privConsoleListener) {
+                    this.privConsoleListener.detach();
+                }
+                this.privConsoleListener = this.attach(function(event) {
+                    return listener.onEvent(event);
+                });
+                return this.privConsoleListener;
+            };
+
+            function ConsoleLoggingListener(level) {
+                this.privLogLevelFilter = level;
+            }
+            ConsoleLoggingListener.prototype.onEvent = function(event) {
+                return event;
+            };
+
+            function Events() {}
+            Object.defineProperty(Events, "instance", {
+                get: function() {
+                    return Events.privInstance;
+                }
+            });
+            Events.privInstance = new EventSource();
+
+            var attached = Events.instance.attachConsoleListener(new ConsoleLoggingListener(4));
+            typeof attached.detach + ":" + attached.detach()
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:detached"),
+            v => panic!("expected attached listener result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_circular_commonjs_accessor_constructor_bootstrap() {
+        let src = r#"
+            var modules = [
+                ,
+                function(module, exports, require) {
+                    Object.defineProperty(exports, "__esModule", { value: true });
+                    var logging = require(2);
+                    var attached = require(6).Events.instance.attachConsoleListener(
+                        new logging.ConsoleLoggingListener()
+                    );
+                    exports.result = typeof attached.detach + ":" + attached.detach();
+                },
+                function(module, exports, require) {
+                    Object.defineProperty(exports, "__esModule", { value: true });
+                    exports.ConsoleLoggingListener = void 0;
+                    var levels = require(5);
+                    function ConsoleLoggingListener(level) {
+                        if (level === undefined) {
+                            level = levels.LogLevel.None;
+                        }
+                        this.privLogLevelFilter = level;
+                    }
+                    ConsoleLoggingListener.prototype.onEvent = function(event) {
+                        return event;
+                    };
+                    exports.ConsoleLoggingListener = ConsoleLoggingListener;
+                },
+                function() {},
+                function() {},
+                function(module, exports, require) {
+                    Object.defineProperty(exports, "__esModule", { value: true });
+                    var events = require(6);
+                    Object.defineProperty(exports, "LogLevel", {
+                        enumerable: true,
+                        get: function() {
+                            return events.EventType;
+                        }
+                    });
+                },
+                function(module, exports, require) {
+                    Object.defineProperty(exports, "__esModule", { value: true });
+                    exports.Events = exports.EventType = void 0;
+                    var EventType;
+                    (function(EventType) {
+                        EventType[EventType.Debug = 0] = "Debug";
+                        EventType[EventType.Info = 1] = "Info";
+                        EventType[EventType.None = 4] = "None";
+                    })(EventType || (exports.EventType = EventType = {}));
+
+                    function EventSource() {
+                        this.privConsoleListener = undefined;
+                    }
+                    EventSource.prototype.attach = function(listener) {
+                        return {
+                            detach: function() {
+                                return "detached";
+                            }
+                        };
+                    };
+                    EventSource.prototype.attachConsoleListener = function(listener) {
+                        if (this.privConsoleListener) {
+                            this.privConsoleListener.detach();
+                        }
+                        this.privConsoleListener = this.attach(function(event) {
+                            return listener.onEvent(event);
+                        });
+                        return this.privConsoleListener;
+                    };
+
+                    function Events() {}
+                    Object.defineProperty(Events, "instance", {
+                        get: function() {
+                            return Events.privInstance;
+                        }
+                    });
+                    Events.privInstance = new EventSource();
+                    exports.Events = Events;
+                }
+            ];
+            var cache = {};
+            function require(id) {
+                var cached = cache[id];
+                if (void 0 !== cached) {
+                    return cached.exports;
+                }
+                var module = cache[id] = { exports: {} };
+                modules[id].call(module.exports, module, module.exports, require);
+                return module.exports;
+            }
+            require(1).result
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:detached"),
+            v => panic!("expected circular bootstrap result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_commonjs_module_exports_survive_define_property_marker() {
+        let src = r#"
+            var modules = [
+                ,
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function(module, exports, require) {
+                    Object.defineProperty(exports, "__esModule", { value: true });
+                    exports.PlatformEvent = exports.EventType = void 0;
+                    var EventType;
+                    (function(EventType) {
+                        EventType[EventType.Connected = 0] = "Connected";
+                    })(EventType || (exports.EventType = EventType = {}));
+                    var PlatformEvent = function() {
+                        function PlatformEvent() {}
+                        PlatformEvent.prototype.dispose = function() { return "disposed"; };
+                        return PlatformEvent;
+                    }();
+                    exports.PlatformEvent = PlatformEvent;
+                },
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function() {},
+                function(module, exports, require) {
+                    var base = require(8);
+                    exports.result = typeof base.PlatformEvent + ":" +
+                        (new base.PlatformEvent()).dispose() + ":" +
+                        Object.prototype.hasOwnProperty.call(base, "PlatformEvent");
+                }
+            ];
+            var cache = {};
+            function require(id) {
+                var cached = cache[id];
+                if (void 0 !== cached) {
+                    return cached.exports;
+                }
+                var module = cache[id] = { exports: {} };
+                return modules[id].call(module.exports, module, module.exports, require), module.exports;
+            }
+            for (var i = 0; i < 120; i = i + 1) {
+                require(8);
+            }
+            require(25).result
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:disposed:true"),
+            v => panic!("expected CommonJS export result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_commonjs_module_array_assignments_survive_define_property_marker() {
+        let src = r#"
+            var modules = [];
+            modules[8] = function(module, exports, require) {
+                Object.defineProperty(exports, "__esModule", { value: true });
+                exports.PlatformEvent = exports.EventType = void 0;
+                var EventType;
+                (function(EventType) {
+                    EventType[EventType.Connected = 0] = "Connected";
+                })(EventType || (exports.EventType = EventType = {}));
+                var PlatformEvent = function() {
+                    function PlatformEvent() {}
+                    PlatformEvent.prototype.dispose = function() { return "disposed"; };
+                    return PlatformEvent;
+                }();
+                exports.PlatformEvent = PlatformEvent;
+            };
+            modules[25] = function(module, exports, require) {
+                var base = require(8);
+                exports.result = typeof base.PlatformEvent + ":" +
+                    (new base.PlatformEvent()).dispose() + ":" +
+                    Object.prototype.hasOwnProperty.call(base, "PlatformEvent");
+            };
+            var cache = {};
+            function require(id) {
+                var cached = cache[id];
+                if (void 0 !== cached) {
+                    return cached.exports;
+                }
+                var module = cache[id] = { exports: {} };
+                modules[id].call(module.exports, module, module.exports, require);
+                return module.exports;
+            }
+            require(25).result
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:disposed:true"),
+            v => panic!("expected CommonJS export result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_webpack_default_export_getter_is_callable_through_sequence() {
+        let src = r#"
+            var modules = [
+                ,
+                function(module, exports, require) {
+                    require.r(exports);
+                    require.d(exports, { default: function() { return make; } });
+                    function make(value) {
+                        return value + "!";
+                    }
+                },
+                function(module, exports, require) {
+                    var imported = require(1);
+                    exports.result = (0, imported.default)("ok");
+                }
+            ];
+            var cache = {};
+            function require(id) {
+                var cached = cache[id];
+                if (void 0 !== cached) {
+                    return cached.exports;
+                }
+                var module = cache[id] = { exports: {} };
+                modules[id].call(module.exports, module, module.exports, require);
+                return module.exports;
+            }
+            require.d = function(target, map) {
+                for (var key in map) {
+                    if (require.o(map, key) && !require.o(target, key)) {
+                        Object.defineProperty(target, key, {
+                            enumerable: true,
+                            get: map[key]
+                        });
+                    }
+                }
+            };
+            require.o = function(obj, prop) {
+                return Object.prototype.hasOwnProperty.call(obj, prop);
+            };
+            require.r = function(exports) {
+                Object.defineProperty(exports, "__esModule", { value: true });
+            };
+            require(2).result
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "ok!"),
+            v => panic!("expected callable default export result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_return_sequence_uses_last_expression() {
+        match eval("function f() { var o = { value: 42 }; return o.missing, o.value; } f()")
+            .unwrap()
+        {
+            Value::Number(n) => assert_eq!(n, 42.0),
+            v => panic!("expected sequence result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_function_objects_inherit_object_prototype_methods() {
+        let src = r#"
+            typeof Object.hasOwnProperty + ":" +
+                Object.hasOwnProperty.call({ PlatformEvent: 1 }, "PlatformEvent")
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:true"),
+            v => panic!("expected inherited hasOwnProperty result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_nested_function_declaration_does_not_shadow_outer_parameter() {
+        let src = r#"
+            function module(require) {
+                var helper = function(base, derived) {
+                    function require() { return "inner"; }
+                    return "helper";
+                };
+                return require(8);
+            }
+            module(function(id) { return "loader:" + id; })
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "loader:8"),
+            v => panic!("expected outer parameter result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_nested_var_declaration_does_not_shadow_outer_parameter() {
+        let src = r#"
+            function module(require) {
+                var helper = function(source) {
+                    for (var require in source) {
+                    }
+                    return "helper";
+                };
+                return require(8);
+            }
+            module(function(id) { return "loader:" + id; })
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "loader:8"),
+            v => panic!("expected outer parameter result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_called_nested_var_declaration_does_not_shadow_outer_parameter() {
+        let src = r#"
+            function module(r) {
+                var exportStar = function(source, target) {
+                    for (var r in source) {
+                        target[r] = source[r];
+                    }
+                };
+                exportStar({ a: 1 }, {});
+                return typeof r.d + ":" + typeof r(8);
+            }
+            var loader = function(id) { return { id: id }; };
+            loader.d = function() {};
+            module(loader)
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:object"),
+            v => panic!("expected loader parameter result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_nested_function_declaration_can_reference_itself() {
+        let src = r#"
+            (function() {
+                function recur(n) {
+                    return n === 0 ? "ok" : recur(n - 1);
+                }
+                return recur(2);
+            })()
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "ok"),
+            v => panic!("expected recursive result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_nested_function_declaration_does_not_poison_loader_self_reference() {
+        let src = r#"
+            (function() {
+                var modules = [];
+                modules[0] = function(module, exports, require) {
+                    exports.value = 1;
+                };
+                modules[1] = function(module, exports, require) {
+                    exports.result = typeof require.d + ":" + typeof require(0);
+                };
+                var cache = {};
+                function r(id) {
+                    var cached = cache[id];
+                    if (void 0 !== cached) {
+                        return cached.exports;
+                    }
+                    var module = cache[id] = { exports: {} };
+                    return modules[id].call(module.exports, module, module.exports, r), module.exports;
+                }
+                r.d = function() {};
+                function poison() {
+                    function r() { return "inner"; }
+                    return r;
+                }
+                poison();
+                return r(1).result;
+            })()
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:object"),
+            v => panic!("expected loader self-reference result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_nested_function_declaration_passes_self_reference_as_argument() {
+        let src = r#"
+            (function() {
+                var modules = [
+                    ,
+                    function(module, exports, require) {
+                        exports.result = typeof require + ":" + typeof require(2);
+                    },
+                    function(module, exports, require) {
+                        exports.value = "ok";
+                    }
+                ];
+                var cache = {};
+                function require(id) {
+                    var cached = cache[id];
+                    if (void 0 !== cached) {
+                        return cached.exports;
+                    }
+                    var module = cache[id] = { exports: {} };
+                    return modules[id].call(module.exports, module, module.exports, require),
+                        module.exports;
+                }
+                return require(1).result;
+            })()
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:object"),
+            v => panic!("expected self-referential loader result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_typescript_extends_helper_does_not_shadow_require_parameter() {
+        let src = r#"
+            function module(r) {
+                var n, i = this && this.__extends || (
+                    n = function(e, t) {
+                        return n = Object.setPrototypeOf ||
+                            function(e, t) {
+                                for (var r in t) {
+                                    if (t.hasOwnProperty(r)) {
+                                        e[r] = t[r];
+                                    }
+                                }
+                            },
+                            n(e, t);
+                    },
+                    function(e, t) {
+                        function r() {
+                            this.constructor = e;
+                        }
+                        n(e, t);
+                        e.prototype = t === null ? Object.create(t) :
+                            (r.prototype = t.prototype, new r());
+                    }
+                );
+                return typeof r.d + ":" + typeof r(8);
+            }
+            var loader = function(id) { return { id: id }; };
+            loader.d = function() {};
+            module(loader)
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:object"),
+            v => panic!("expected loader parameter result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_function_property_assignment_with_arrow_value() {
+        let src = r#"
+            function loader(id) { return { id: id }; }
+            loader.d = (target, map) => {};
+            typeof loader.d + ":" + typeof loader(8)
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:object"),
+            v => panic!("expected function property result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_webpack_module_extends_prefix_keeps_require_parameter() {
+        let src = r#"
+            function module(e, t, r) {
+                "use strict";
+                var n, i = this && this.__extends || (
+                    n = function(e, t) {
+                        return n = Object.setPrototypeOf ||
+                            { __proto__: [] } instanceof Array && function(e, t) {
+                                e.__proto__ = t;
+                            } ||
+                            function(e, t) {
+                                for (var r in t) {
+                                    t.hasOwnProperty(r) && (e[r] = t[r]);
+                                }
+                            },
+                            n(e, t);
+                    },
+                    function(e, t) {
+                        function r() {
+                            this.constructor = e;
+                        }
+                        n(e, t);
+                        e.prototype = t === null ? Object.create(t) :
+                            (r.prototype = t.prototype, new r());
+                    }
+                );
+                Object.defineProperty(t, "__esModule", { value: true });
+                t.ConnectionMessageSentEvent =
+                    t.ConnectionMessageReceivedEvent =
+                    t.ConnectionEstablishErrorEvent =
+                    t.ConnectionErrorEvent =
+                    t.ConnectionClosedEvent =
+                    t.ConnectionEstablishedEvent =
+                    t.ConnectionStartEvent =
+                    t.ConnectionEvent =
+                    t.ServiceEvent = void 0;
+                var o = r(8);
+                return typeof r.d + ":" + typeof o + ":" + o.PlatformEvent;
+            }
+            var loader = function(id) {
+                return { PlatformEvent: "platform:" + id, EventType: { Info: 1 } };
+            };
+            loader.d = function() {};
+            var exports = {};
+            module.call(exports, {}, exports, loader)
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:object:platform:8"),
+            v => panic!("expected loader parameter result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_nested_var_in_helper_initializer_does_not_shadow_require_parameter() {
+        let src = r#"
+            function module(e, t, r) {
+                var n = this && this.__createBinding || (
+                    Object.create ?
+                        function(e, t, r, n) {
+                            void 0 === n && (n = r);
+                            Object.defineProperty(e, n, {
+                                enumerable: true,
+                                get: function() { return t[r]; }
+                            });
+                        } :
+                        function(e, t, r, n) {
+                            void 0 === n && (n = r);
+                            e[n] = t[r];
+                        }
+                    ),
+                    i = this && this.__exportStar || function(e, t) {
+                        for (var r in e)
+                            "default" === r || t.hasOwnProperty(r) || n(t, e, r);
+                    };
+                return typeof r + ":" + typeof r(2);
+            }
+            var loader = function(id) { return { id: id }; };
+            module({}, {}, loader)
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:object"),
+            v => panic!("expected loader parameter result, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_function_call_forwards_all_arguments_after_this_arg() {
+        let src = r#"
+            function module(e, t, r) {
+                return typeof r.d + ":" + typeof r(8);
+            }
+            var loader = function(id) { return { id: id }; };
+            loader.d = function() {};
+            module.call({}, {}, {}, loader)
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:object"),
+            v => panic!("expected forwarded loader argument, got {v:?}"),
+        }
+    }
+
+    #[test]
+    fn test_closure_creation_does_not_clobber_function_parameter() {
+        let src = r#"
+            function module(r) {
+                var n, i;
+                n = function(e, t) {
+                    return n = function(e, t) { return "set"; }, n(e, t);
+                };
+                i = function(e, t) {
+                    function r() { this.constructor = e; }
+                    n(e, t);
+                    return r;
+                };
+                return typeof r.d + ":" + typeof r(8);
+            }
+            var loader = function(id) { return { id: id }; };
+            loader.d = function() {};
+            module(loader)
+        "#;
+        match eval(src).unwrap() {
+            Value::String(s) => assert_eq!(s, "function:object"),
+            v => panic!("expected loader parameter result, got {v:?}"),
+        }
+    }
+
     #[test]
     fn test_delete_property() {
         let src = r#"
@@ -7622,6 +8446,8 @@ mod tests {
             "x".to_string(),
             Property {
                 value: Value::Number(1.0),
+                getter: None,
+                setter: None,
                 writable: true,
                 enumerable: true,
                 configurable: false,
@@ -7652,6 +8478,8 @@ mod tests {
             "frozen".to_string(),
             Property {
                 value: Value::Number(42.0),
+                getter: None,
+                setter: None,
                 writable: false,
                 enumerable: true,
                 configurable: false,
diff --git a/crates/js/src/wasm.rs b/crates/js/src/wasm.rs
index f0c0fd1..fefc2d4 100644
--- a/crates/js/src/wasm.rs
+++ b/crates/js/src/wasm.rs
@@ -1767,6 +1767,8 @@ fn make_value_array(gc: &mut Gc<HeapObject>, shapes: &mut ShapeTable, values: &[
         "length".to_string(),
         Property {
             value: Value::Number(values.len() as f64),
+            getter: None,
+            setter: None,
             writable: true,
             enumerable: false,
             configurable: false,