[proggeramlug]

Summary

Typed-array constructors silently clamped a negative or out-of-range length argument to 0 instead of throwing the spec-mandated RangeError. This is the ECMAScript-constructor slice of the #3662 "builtins must throw the spec error on invalid args" cluster.

Prior #3662 sub-clusters already merged:

• collection prototype brand checks — fix(runtime): brand-check collection prototype methods (#3662) #3739
• Function.prototype.{apply,call,bind} not-callable this — fix(runtime): brand-check Function.prototype apply/call/bind this (#3662) #4073
• node-core fs/zlib/process arg validation — fix(node): throw spec arg-validation errors for fs/process/zlib (#3662) #4082

Before

new Uint8Array(-1)        // -> length-0 Uint8Array (no throw)
new Float64Array(Infinity) // -> length-0 (no throw)

After (byte-identical to node --experimental-strip-types)

RangeError: Invalid typed array length: -1
RangeError: Invalid typed array length: Infinity

What changed

A shared ToIndex-style length validator: truncate toward zero (NaN → 0, 2.5 → 2, no throw) and throw a plain RangeError: Invalid typed array length: <n> (no .code, matching Node) when the resulting integer is negative, Infinity, or >= 2**53.

• typedarray.rs — typed_array_length_or_throw, wired into js_typed_array_new_empty (literal-length path) and js_typed_array_new (INT32-tagged and plain-double runtime-dispatch paths). Covers Int8/16/32, Uint16/32, Float32/64, Uint8ClampedArray.
• buffer/from.rs — uint8array_length_or_throw, wired into js_uint8array_alloc (literal path) and js_uint8array_new (runtime path). Uint8Array is backed by a BufferHeader in Perry, so it has its own path.
• codegen/expr/arrays_finds.rs — stop clamping the literal integer length with .max(0) so a negative literal reaches the runtime validator.

Testing

New gap test test-files/test_gap_3662_typedarray_length.ts is byte-identical to node --experimental-strip-types in both the default auto-optimize and PERRY_NO_AUTO_OPTIMIZE=1 builds (covers literal + variable negative lengths, Infinity, 2**53, and the non-throwing NaN/fractional truncation cases).

Out of scope

The 3-arg buffer-view form new Uint8Array(buffer, byteOffset, length) offset/length bounds validation is a deeper feature gap (Perry does not yet model real views — the byteOffset getter is hardcoded to 0), tracked separately.