diff --git a/source/mcode.c b/source/mcode.c
index 2e55b473..34f933ee 100644
--- a/source/mcode.c
+++ b/source/mcode.c
@@ -1932,8 +1932,21 @@ JSValue mcode_exec(JSContext *ctx, JSMCode *code, JSValue this_obj,
         if (iname) {
           JSValue key = JS_NewString(ctx, iname);
           frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
-          JSValue val = JS_GetProperty(ctx, ctx->global_obj, key);
-          frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
+          /* Try env (outer_frame) first, then global */
+          JSFunction *cur_fn = JS_VALUE_GET_FUNCTION(frame->function);
+          JSValue env = (cur_fn && cur_fn->kind == JS_FUNC_KIND_MCODE)
+                        ? cur_fn->u.mcode.outer_frame : JS_NULL;
+          JSValue val = JS_NULL;
+          if (!JS_IsNull(env)) {
+            val = JS_GetProperty(ctx, env, key);
+            frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
+          }
+          if (JS_IsNull(val)) {
+            key = JS_NewString(ctx, iname);
+            frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
+            val = JS_GetProperty(ctx, ctx->global_obj, key);
+            frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
+          }
           if (JS_IsNull(val)) {
             key = JS_NewString(ctx, iname);
             frame = (JSFrameRegister *)JS_VALUE_GET_PTR(frame_ref.val);
diff --git a/source/runtime.c b/source/runtime.c
index 359edebf..324df6ce 100644
--- a/source/runtime.c
+++ b/source/runtime.c
@@ -3193,6 +3193,9 @@ JSValue JS_GetPropertyValue (JSContext *ctx, JSValue this_obj, JSValue prop) {
 }
 
 JSValue JS_SetPropertyNumber (JSContext *js, JSValue obj, int idx, JSValue val) {
+  if (JS_IsText (obj)) {
+    return JS_ThrowTypeError (js, "strings are immutable");
+  }
   if (!JS_IsArray (obj)) {
     return JS_ThrowInternalError (js,
                                   "cannot set with a number on a non array");
@@ -3225,7 +3228,7 @@ JSValue JS_GetPropertyNumber (JSContext *js, JSValue obj, int idx) {
   if (JS_IsText (obj)) {
     uint32_t len = js_string_get_length (obj);
     if (idx < 0 || (uint32_t)idx >= len) { return JS_NULL; }
-    return js_sub_string (js, JS_VALUE_GET_STRING (obj), idx, idx + 1);
+    return js_sub_string_val (js, obj, idx, idx + 1);
   }
 
   return JS_NULL;