runtime: builtins must throw spec-mandated TypeError/RangeError on invalid this/args

Summary

Built-in functions and methods do not throw the spec-mandated TypeError /
RangeError on invalid arguments or invalid this. A parity sweep shows 282
failures with the signature "Expected a … to be thrown but no exception was
thrown at all" (test262) / "Missing expected exception" (node-core) — the single
largest behavioral cluster in the report.

This is the runtime-validation side of Perry's "no runtime type validation"
design: where the spec requires an operation to reject bad input, Perry silently
proceeds.

Evidence (from `scripts/parity_gap_report.py`, 2026-05-31)

282 failures. Top categories: Set (28), WeakSet (28), Function (24), WeakMap
(23), fs (20), Map (13), TypedArray (11), buffer (8), process (8), zlib (8),
http (6), ArrayBuffer (5).

The cleanest sub-pattern is this-not-object / not-callable brand checks —
e.g. calling a Set/Map/WeakSet/WeakMap prototype method with a non-object this
must throw, and Function.prototype.apply/bind/Symbol.hasInstance must reject a
non-callable this:

built-ins/Set/prototype/{add,delete,forEach,has,values}/this-not-object-throw.js
built-ins/WeakSet/prototype/{add,delete,has}/this-not-object-throw.js
built-ins/WeakMap/prototype/{...}/this-not-object-throw.js
built-ins/Function/prototype/apply/this-not-callable-realm.js
built-ins/Function/prototype/Symbol.hasInstance/{this-val-not-callable,value-non-obj}.js

On the node-core side the same gap surfaces as missing ERR_INVALID_ARG_TYPE /
ERR_OUT_OF_RANGE throws across fs / buffer / process / zlib.

Repro

const s = new Set();
Set.prototype.add.call({}, 1);   // should throw TypeError (this is not a Set); Perry: no throw

Function.prototype.apply.call(undefined, null, []);  // should throw TypeError; Perry: no throw

Why it's high-leverage

One semantic — "perform the spec's brand/type check and throw before doing the
work" — applied across the collection prototypes and Function.prototype clears
the largest single block of failures (~100+ from Set/Map/Weak*/Function alone),
and the same pattern extends to the node-core arg-validation cases.

Suggested scope

Add the this/argument brand checks at the top of the affected builtin methods
(Set/Map/WeakSet/WeakMap prototype methods, Function.prototype.apply/bind/
hasInstance) and the constructor/method arg-range checks for the node-core APIs,
each throwing the spec-correct error type.

Filed from the parity-gap radar. Cluster: 282 "no exception was thrown" /
"Missing expected exception" failures across ~25 categories.

fix(runtime): brand-check collection prototype methods (#3662)

fix(runtime): brand-check collection prototype methods (#3662) (#3739)

fix(runtime): brand-check Function.prototype apply/call/bind this (#3662

fix(node): throw spec arg-validation errors for fs/process/zlib (#3662)…

fix(runtime): validate typed-array constructor length (#3662) (#4093)

Status / decomposition (2026-06-02)

This umbrella (~282 "no exception thrown" failures) has been largely cleared by
general work + targeted PRs. A re-sweep against node --experimental-strip-types
shows most categories now behave correctly (Set/Map/Weak*, Function apply/call/bind,
fs/zlib/process, all String.prototype this-coercibility, ArrayBuffer/TypedArray
prototype this checks, Number toFixed/toString/etc.).

Merged sub-clusters

fix(runtime): brand-check collection prototype methods (#3662) #3739 — collection prototype brand checks (Set/Map/WeakSet/WeakMap)
fix(runtime): brand-check Function.prototype apply/call/bind this (#3662) #4073 — Function.prototype.{apply,call,bind} not-callable this
fix(node): throw spec arg-validation errors for fs/process/zlib (#3662) #4082 — node-core arg validation (fs/zlib/process)

Open PRs

fix(runtime): validate typed-array constructor length (#3662) #4093 — typed-array constructor length RangeError (negative / Infinity / ≥2^53)
fix(runtime): implement Function.prototype[Symbol.hasInstance] (#3662) #4098 — Function.prototype[Symbol.hasInstance] (was undefined)

Remaining tail — filed as granular issues (per the workable-backlog preference):

runtime: Map/WeakMap.prototype.set reflective on invalid receiver crashes (SIGBUS) instead of TypeError (#3662) #4099 — Map/WeakMap.prototype.set reflective on a bad receiver crashes (SIGBUS) instead of throwing. Also masks the rest of the test_gap_3662_collection_brand_check.ts output. High (crash).
runtime: Number/Boolean/Symbol/BigInt prototype methods don't brand-check this (reflective call returns [object Object] instead of TypeError) (#3662) #4100 — Number/Boolean/Symbol/BigInt prototype methods don't brand-check this (reflective call returns [object Object] instead of TypeError; also fixes wrong-value reflective toString)
runtime: Function.prototype.toString returns [object Object] for functions (no source reconstruction; no this brand check) #4101 — Function.prototype.toString returns [object Object] for functions (source reconstruction + brand check)
runtime: dynamic instanceof / reflective hasInstance with Array/Object/Date constructor values returns false (#3662 follow-up) #4102 — dynamic instanceof / reflective hasInstance with Array/Object/Date constructor values
runtime: typed-array view constructor new TA(buffer, byteOffset, length) doesn't validate offset/length (#3662 / #4093 follow-up) #4103 — typed-array view ctor new TA(buffer, byteOffset, length) offset/length validation

Suggest closing this umbrella once #4093 + #4098 land, tracking the rest via the
granular issues above.

fix(runtime): implement Function.prototype[Symbol.hasInstance] (#3662) (

Update: the #4099 crash (highest-value remaining item) now has a fix in PR #4111 — installing the collection size accessor before the data methods (root-caused to an accessor-install desync corrupting Map.prototype.set). The pre-existing test_gap_3662_collection_brand_check.ts (which crashed on main) now passes. Remaining: #4100 (primitive-wrapper brand checks), #4101, #4102, #4103.

fix(runtime): stop size-accessor install corrupting Map/Set.prototype…

Final disposition (this work cycle)

The substantive, tractable items are fixed and the remainder is decomposed into granular, investigation-backed issues.

Shipped this cycle (CI-green):

PR fix(runtime): validate typed-array constructor length (#3662) #4093 — typed-array constructor length RangeError
PR fix(runtime): implement Function.prototype[Symbol.hasInstance] (#3662) #4098 — Function.prototype[Symbol.hasInstance] (was undefined)
PR fix(runtime): stop size-accessor install corrupting Map/Set.prototype.set (#4099) #4111 — fixed the runtime: Map/WeakMap.prototype.set reflective on invalid receiver crashes (SIGBUS) instead of TypeError (#3662) #4099 crash: the size accessor install was corrupting Map.prototype.set, so Map.prototype.set.call(...) SIGBUS'd. Root-caused to an accessor/data-field desync; install the accessor before the data methods. The previously-crashing test_gap_3662_collection_brand_check.ts now passes.

Remaining — tracked, each needs a deeper/architectural change (not the collection recipe):

runtime: Number/Boolean/Symbol/BigInt prototype methods don't brand-check this (reflective call returns [object Object] instead of TypeError) (#3662) #4100 — Number/Boolean/Symbol/BigInt prototype brand checks. Investigated: the populate_builtin_prototype_methods interception (which works for collections) does not work here — Number.prototype.valueOf.call(x) doesn't read from the populated singleton prototype; it resolves via the shared noop thunk that re-dispatches by name and loses the Number origin. Needs interception at the reflective-dispatch site. (Full analysis in the issue.)
runtime: Function.prototype.toString returns [object Object] for functions (no source reconstruction; no this brand check) #4101 — Function.prototype.toString returns [object Object] (needs function-source retention).
runtime: dynamic instanceof / reflective hasInstance with Array/Object/Date constructor values returns false (#3662 follow-up) #4102 — dynamic instanceof / reflective hasInstance with Array/Object/Date constructor values (needs constructor-value identity on the dynamic path).
runtime: typed-array view constructor new TA(buffer, byteOffset, length) doesn't validate offset/length (#3662 / #4093 follow-up) #4103 — typed-array view ctor new TA(buffer, byteOffset, length) offset/length validation (needs real view modeling).

Recommend closing this umbrella once #4093/#4098/#4111 merge, and letting #4100–#4103 proceed as independent issues.

fix(runtime): cap field_count to inline capacity in ensure_key_in_key…

Resolved — full cluster verified byte-identical to Node

All decomposed sub-issues are fixed and merged, and the whole cluster was re-verified end-to-end against node --experimental-strip-types on a clean main build (HEAD includes #4124):

Area	Fixed by
Collection (Set/Map/WeakMap/WeakSet) brand checks	#3739
`Function.prototype.{apply,call,bind}` not-callable `this`	#4073
node-core arg validation (fs/zlib/process)	#4082
Typed-array constructor length `RangeError`	#4093
`Function.prototype[Symbol.hasInstance]`	#4098
Map/WeakMap.set reflective crash → TypeError (#4099)	#4111 + #4113
dynamic `instanceof` Array/Object/Date (#4102)	#4107
typed-array view offset/length + alignment (#4103)	#4107
`Function.prototype.toString` source + brand check (#4101)	#4108
Number/Boolean/Symbol/BigInt prototype brand checks (#4100)	#4112 + #4124 (typed `.call`)

Spot-checked all of: collection/Function/String/Number/Boolean/Symbol/BigInt prototype this brand checks (computed and statically-typed .call), typed-array constructor + view validation, hasInstance, dynamic instanceof, and Function.prototype.toString — every case matches Node.

Closing as completed.

runtime: bind thisArg in dynamic array-method dispatch; V8 receiver i…

fix: dynamic array-method dispatch dropped the thisArg — extracted bu…

Navigation Menu

Repository navigation

runtime: builtins must throw spec-mandated TypeError/RangeError on invalid this/args #3662

Summary

Evidence (from `scripts/parity_gap_report.py`, 2026-05-31)

Repro

Why it's high-leverage

Suggested scope

Status / decomposition (2026-06-02)

Final disposition (this work cycle)

Resolved — full cluster verified byte-identical to Node

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

runtime: builtins must throw spec-mandated TypeError/RangeError on invalid this/args #3662

Description

Summary

Evidence (from scripts/parity_gap_report.py, 2026-05-31)

Repro

Why it's high-leverage

Suggested scope

Activity

proggeramlug commented on Jun 2, 2026

Status / decomposition (2026-06-02)

proggeramlug commented on Jun 2, 2026

proggeramlug commented on Jun 2, 2026

Final disposition (this work cycle)

proggeramlug commented on Jun 2, 2026

Resolved — full cluster verified byte-identical to Node

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Evidence (from `scripts/parity_gap_report.py`, 2026-05-31)