Fix compat-table failures: Array.at, AnnexB if-decl, Proxy observable gets

Jint/HoistingScope.cs

@@ -319,15 +319,20 @@ private void VisitCore(Node node, Node? parent, HashSet<string>? enclosingLexica
                                 // Track this function name as a lexical binding so inner scopes
                                 // can't AnnexB-hoist a same-named function (replacing with var
                                 // would conflict with this block-level lexical binding).
-                                if (effectiveLexicalNames is null)
+                                // Skip for IfStatement branches - sibling branches (consequent/alternate)
+                                // are not nested scopes and should not block each other.
+                                if (node.Type is not NodeType.IfStatement)
                                 {
-                                    effectiveLexicalNames = new HashSet<string>(StringComparer.Ordinal);
+                                    if (effectiveLexicalNames is null)
+                                    {
+                                        effectiveLexicalNames = new HashSet<string>(StringComparer.Ordinal);
+                                    }
+                                    else if (ReferenceEquals(effectiveLexicalNames, enclosingLexicalNames))
+                                    {
+                                        effectiveLexicalNames = new HashSet<string>(enclosingLexicalNames, StringComparer.Ordinal);
+                                    }
+                                    effectiveLexicalNames.Add(fnName);
                                 }
-                                else if (ReferenceEquals(effectiveLexicalNames, enclosingLexicalNames))
-                                {
-                                    effectiveLexicalNames = new HashSet<string>(enclosingLexicalNames, StringComparer.Ordinal);
-                                }
-                                effectiveLexicalNames.Add(fnName);
                             }
                         }
                     }

Jint/Native/Array/ArrayPrototype.cs

@@ -890,22 +890,22 @@ private JsValue At(JsValue thisObject, JsCallArguments arguments)
         var len = target.GetLength();
         var relativeIndex = TypeConverter.ToInteger(arguments.At(0));
 
-        ulong actualIndex;
+        long actualIndex;
         if (relativeIndex < 0)
         {
-            actualIndex = (ulong) (len + relativeIndex);
+            actualIndex = (long) (len + relativeIndex);
         }
         else
         {
-            actualIndex = (ulong) relativeIndex;
+            actualIndex = (long) relativeIndex;
         }
 
-        if (actualIndex < 0 || actualIndex >= len)
+        if (actualIndex < 0 || (ulong) actualIndex >= len)
         {
             return Undefined;
         }
 
-        return target.Get(actualIndex);
+        return target.Get((ulong) actualIndex);
     }
 
     /// <summary>

Jint/Native/RegExp/RegExpConstructor.cs

@@ -479,6 +479,17 @@ internal JsRegExp RegExpInitialize(JsRegExp r, JsValue pattern, JsValue flags, b
         return r;
     }
 
+    /// <summary>
+    /// https://tc39.es/ecma262/#sec-regexpcreate
+    /// RegExpCreate(P, F) - creates a new RegExp without calling IsRegExp on the pattern.
+    /// Used by String.prototype.match/search/split per spec.
+    /// </summary>
+    internal JsRegExp RegExpCreate(JsValue pattern, JsValue flags)
+    {
+        var r = RegExpAlloc(this);
+        return RegExpInitialize(r, pattern, flags);
+    }
+
     private JsRegExp RegExpAlloc(JsValue newTarget)
     {
         if (ReferenceEquals(newTarget, this))

Jint/Native/RegExp/RegExpPrototype.cs

@@ -161,9 +161,10 @@ private JsValue Replace(JsValue thisObject, JsCallArguments arguments)
         }
 
         // check if we can access fast path
+        // Derive sticky from already-read flags string to avoid extra observable property access
         if (!fullUnicode
             && !mayHaveNamedCaptures
-            && !TypeConverter.ToBoolean(rx.Get(PropertySticky))
+            && !flags.Contains('y')
             && rx is JsRegExp rei && rei.HasDefaultRegExpExec)
         {
             var count = global ? int.MaxValue : 1;

Jint/Native/String/StringPrototype.cs

@@ -865,13 +865,15 @@ private JsValue Split(JsValue thisObject, JsCallArguments arguments)
         // Coerce into a number, true will become 1
         var lim = limit.IsUndefined() ? uint.MaxValue : TypeConverter.ToUint32(limit);
 
+        // Per spec, if we got here the separator didn't have @@split, so just ToString it.
+        // Don't call IsRegExp - it would be an observable extra property access (@@match).
         if (separator.IsNull())
         {
             separator = "null";
         }
         else if (!separator.IsUndefined())
         {
-            if (!separator.IsRegExp())
+            if (separator is not JsRegExp)
             {
                 separator = TypeConverter.ToJsString(separator); // Coerce into a string, for an object call toString()
             }
@@ -1014,7 +1016,7 @@ private JsValue Search(JsValue thisObject, JsCallArguments arguments)
             }
         }
 
-        var rx = (JsRegExp) _realm.Intrinsics.RegExp.Construct([regex]);
+        var rx = _realm.Intrinsics.RegExp.RegExpCreate(regex, JsValue.Undefined);
         var s = TypeConverter.ToJsString(thisObject);
         return _engine.Invoke(rx, GlobalSymbolRegistry.Search, [s]);
     }
@@ -1187,7 +1189,7 @@ private JsValue Match(JsValue thisObject, JsCallArguments arguments)
             }
         }
 
-        var rx = (JsRegExp) _realm.Intrinsics.RegExp.Construct([regex]);
+        var rx = _realm.Intrinsics.RegExp.RegExpCreate(regex, JsValue.Undefined);
 
         var s = TypeConverter.ToJsString(thisObject);
         return _engine.Invoke(rx, GlobalSymbolRegistry.Match, [s]);