Upgrade to upstream WebKit 51cc3feb7298

[sosukesuzuki]

Merges upstream WebKit/WebKit main (51cc3fe, 880 commits since 39d4ce1) into the fork.

Conflict resolutions preserve the fork's additions while adopting upstream's changes:

• JSPromise cross-realm fix (webkit.org/b/316187): rejectPromise/fulfillPromise/performPromiseThenWithInternalMicrotask/reject/fulfill/rejectAsHandled/rejectWithCaughtException dropped their JSGlobalObject* parameter; promise jobs now queue on the promise's own realm. The fork's async-context capture/restore and synchronous module queue logic were re-applied on top of the new signatures.
• OrderedHashTable.h/OrderedHashTableHelper.h renamed to JSOrderedHashTable.h/JSOrderedHashTableHelper.h upstream; JSMap/JSSet includes updated.
• queueMicrotask fast/slow path split (queueMicrotaskSlow); the fork's 4-argument overload is kept and routes through the new path.
• createUndefinedVariableError keeps the fork's "X is not defined" message, now using upstream's OOM-safe tryMakeString structure.
• JSModuleLoader::innerModuleLoading keeps the fork's iterative worklist implementation with upstream's mechanical signature updates applied.

Note: JSType.h gained SentinelType before ObjectType, shifting all object JSType values by +1. The Bun-side mirror is updated in the corresponding bun PR.

Verified locally: JSC debug build succeeds; full Bun debug build against this tree passes promise/async-context/module smoke tests.

[coderabbitai]

Walkthrough

This PR updates repository and Apple build configuration, adds many JSTests microbenchmarks and stress tests across engine subsystems, and expands Test262 harness and conformance coverage for ArrayBuffer, Atomics, Error stack accessors, and iterator zip behavior.

Changes

Repository and Apple build configuration

Layer / File(s)	Summary
Repository metadata and ownership .gitattributes, .github/CODEOWNERS, .wkdev-sdk-version	Test-file attribution is narrowed, CODEOWNERS mappings are revised for payment, pointer capture, sandbox, and Apple Pay paths, and the wkdev SDK version is bumped.
Apple build and toolchain configuration CMakeLists.txt, CMakePresets.json, Configurations/CommonBase.xcconfig	iOS sysroot and Swift compiler setup are refactored, the mac preset uses Source/cmake/ninja-wrapper, and shared Apple xcconfig flags add build script fusion and another Swift warning policy.

JSTests microbenchmarks and stress coverage

Layer / File(s)	Summary
New microbenchmarks JSTests/microbenchmarks/*	New microbenchmarks cover array, map, set, regexp, string, typed array, weak collection, BigInt, Intl, and related operations.
Iterator and collection stress tests JSTests/stress/array-*, JSTests/stress/map-*, JSTests/stress/set-*, JSTests/stress/iterator-*, JSTests/stress/weak-*	Stress tests expand iterator fast-path, mid-iteration, cross-realm, invalidation, helper, weak collection, and collection cloning coverage.
Runtime and JIT regression tests JSTests/stress/bigint-*, JSTests/stress/dfg-*, JSTests/stress/ftl-*, JSTests/stress/osr-*, JSTests/stress/*	Additional stress coverage targets promises, JIT and GC regressions, array join behavior, property access edge cases, numeric conversion, WebAssembly table growth, and related runtime paths.
Regexp, string, locale, and Temporal tests JSTests/stress/regexp-*, JSTests/stress/string-*, JSTests/stress/intl-*, JSTests/stress/temporal-*, JSTests/stress/to-locale-*	String, regexp, Intl, locale-casing, and Temporal tests are expanded or adjusted, including many new regexp regression suites and updated Temporal Stage 4 expectations.

Test262 harness and ArrayBuffer or Atomics conformance

Layer / File(s)	Summary
Test262 configuration and harness helpers JSTests/test262/config.yaml, JSTests/test262/harness/*, JSTests/test262/latest-changes-summary.txt	Feature-level skips and harness helpers are updated, including new error-constructor utilities, accessor-property verification helpers, typed-array argument factories, and summary regeneration.
ArrayBuffer immutable and transferToImmutable coverage JSTests/test262/test/built-ins/ArrayBuffer/...	ArrayBuffer isView coverage is rewired through all typed-array constructors, and new immutable, sliceToImmutable, and transferToImmutable tests cover descriptors, coercion, detachment, resizing, and result contents.
TypedArray and Atomics conformance updates JSTests/test262/test/built-ins/ArrayIteratorPrototype/..., JSTests/test262/test/built-ins/Atomics/...	Typed-array constructor-argument wiring is updated, immutable-buffer Atomics cases are added, and many non-shared buffer tests switch to typed-array argument factories and revised harness options.

Test262 Error.stack and Iterator zip coverage

Layer / File(s)	Summary
Error.stack getter coverage JSTests/test262/test/built-ins/Error/prototype/stack/getter-*, .../instance-*, .../prop-desc.js	Getter behavior is covered for instances, prototypes, subclasses, proxies, cross-realm receivers, foreign newTarget, and receivers without [[ErrorData]], along with descriptor and enumerability checks.
Error.stack setter coverage JSTests/test262/test/built-ins/Error/prototype/stack/setter-*	Setter behavior is covered for creation, overwrite, delete round-trips, non-string values, non-extensible and prototype receivers, proxy interactions, cross-realm behavior, and assignment through inherited accessors.
Iterator.zip and zipKeyed tests JSTests/test262/test/built-ins/Iterator/zip/*, .../zipKeyed/*	Strict completion checks and fresh result container checks are added for Iterator.zip and Iterator.zipKeyed.

Possibly related PRs

• oven-sh/WebKit#236: Overlaps with the CMakeLists.txt refactor around Swift wrapper selection and iOS sysroot handling.
• oven-sh/WebKit#231: Touches the same iOS Swift and sysroot configuration areas updated here in CMakeLists.txt and shared Apple build settings.

[coderabbitai]

Actionable comments posted: 18

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

JSTests/stress/dataview-bytelength-ic-stub-stack-desync.js (1)

42-45: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add a post-transfer assertion to make the regression detectable.

Line 44 computes r after ab.transfer(), but the test never validates the detached-path output. That weakens regression detection for the byteLength IC desync case.

✅ Suggested patch

 ab.transfer();
 
 let r = hot(dv, A, objs);
+if (r[0] !== -1)
+    throw new Error("Expected detached DataView byteLength read to be caught and mapped to -1");

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/dataview-bytelength-ic-stub-stack-desync.js` around lines 42 -
45, After calling ab.transfer() and computing r with hot(dv, A, objs), add an
explicit assertion that verifies the detached-path output (the value in r) so
the byteLength IC desync regression is detectable; locate the code around
ab.transfer() and the hot(dv, A, objs) call and insert an assertion using the
existing test helpers (e.g., assertEq or assert) to compare r to the expected
result (or expected detached/null value) and fail the test if it differs.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@JSTests/stress/checkpoint-exception-handler-during-osr-exit.js`:
- Around line 36-37: The exception assertion condition using exn?.constructor
!== TypeError && exn?.message.indexOf("instanceof") < 0 is wrong and should use
logical OR and safer message access; update the check so it throws when the
exception is not a TypeError OR its message does not include "instanceof"
(change && to ||) and make the message lookup fully optional-chained (e.g., use
exn?.message?.indexOf("instanceof") < 0) while keeping the thrown Error text
("expected TypeError in instanceof") and referring to the same exn and TypeError
identifiers.

In
`@JSTests/stress/ftl-osr-exit-phantom-new-array-with-butterfly-having-a-bad-time-double-hole.js`:
- Around line 7-13: The test mutates Array.prototype[3] inside cb without
guaranteeing restoration; capture the original descriptor via
Object.getOwnPropertyDescriptor(Array.prototype, 3) before defining the custom
getter/setter in cb, wrap the mutation and test body in a try/finally, and in
the finally restore the original descriptor (using Object.defineProperty if
descriptor exists or delete Array.prototype[3] if it was undefined) so
getterCalls/setterCalls cleanup is always performed; apply the same pattern to
the other sites that modify Array.prototype[3] (the other places that define a
custom getter/setter).

In `@JSTests/stress/generator-expression-info-multiwide-remap.js`:
- Around line 16-21: The test currently swallows runtime failures by catching
exceptions from eval(code) and only printing them; change the catch(e) handler
so the exception is rethrown (or the test process terminated) after printing to
ensure failures fail the test — e.g., in the catch(e) for eval(code) call, keep
the print("Error: " + e) but add throw e (or call quit(1)) so runtime errors
don't get silently ignored.

In `@JSTests/stress/intl-canonical-iana-time-zone.js`:
- Around line 90-110: Uncomment and re-enable the Temporal check by replacing
the commented block with a runtime guard: wrap the legacy↔primary pairs test in
an if (typeof Temporal !== "undefined") { ... } so it only runs when Temporal is
available; inside, define the pairs array and iterate over it calling
shouldBeTrue(new Temporal.ZonedDateTime(0n, legacy).equals(new
Temporal.ZonedDateTime(0n, primary))) to exercise ZonedDateTime.prototype.equals
(which uses TimeZoneEquals) and ensure legacy aliases are accepted. Ensure you
reference Temporal.ZonedDateTime, ZonedDateTime.prototype.equals, and the pairs
list exactly as in the diff so the test logic matches the intended assertions.

In `@JSTests/stress/intl-datetimeformat-temporal-formatter-cache.js`:
- Around line 117-120: Replace the current boolean throw-check around
fmtDS.format(plainTime) with a try/catch that captures the thrown exception
(e.g., let err = null; try { fmtDS.format(plainTime); } catch (e) { err = e; })
and then assert the error is a TypeError using the existing test helpers (for
example: shouldBe(err instanceof TypeError, true, "dateStyle + PlainTime must
throw TypeError") or shouldBe(err.name, "TypeError", "...")). Ensure you
reference fmtDS.format and plainTime in the changed block and remove the old
threw boolean-only assertion.

In `@JSTests/stress/map-iterator-fully-packed-table.js`:
- Around line 60-63: The post-done iterator checks currently only assert done
=== true but must also assert value === undefined; update the assertions after
calling it.next() (the variable named after from the iterator it) to include
assert(after.value === undefined, "post-done iterator value") and do the same
for the other iterator's post-done check (the second iterator's after/it pair
around lines 80-82) so both iterators verify value is undefined when done.

In `@JSTests/stress/out-of-memory-while-creating-undefined-variable-error.js`:
- Around line 13-14: The test currently asserts exception.message == "Can't find
variable" which doesn't match this fork's createUndefinedVariableError wording;
update the check on exception.message (in the failing block that throws "FAILED:
" + exception.message) to assert the message contains or ends with "is not
defined" (e.g., use a substring or regex check against "is not defined") so it
matches the fork's createUndefinedVariableError output instead of the upstream
phrase.

In `@JSTests/stress/regexp-alternative-heavy.js`:
- Around line 9-12: The catch blocks that currently do `print(\`    BUILD ERROR:
${e.message}\`); return;` (and the similar prints at the other two catch sites)
swallow failures; replace each caught-error handling by rethrowing the error
(e.g., `throw e;`) or terminating the process with a non-zero status (e.g.,
`quit(1)`), so that the test fails hard on build/compile/runtime errors instead
of silently returning; locate the catch blocks that print "BUILD ERROR:
${e.message}" and change them to rethrow/quit accordingly.

In `@JSTests/stress/regexp-duplicate-named-captures-indices.js`:
- Around line 3-5: The test uses exec on /(?<x>a){2}z|(?<x>b){2}y|c/d with the
input "aac" which doesn't match so m is null; fix by using a matching input such
as "aaz" (or "bby") in the call to exec so m is non-null (i.e. change the
literal passed to exec from "aac" to "aaz") so the subsequent access to
m.indices.groups and the check for "x" will not dereference null.

In `@JSTests/stress/regress-171780137.js`:
- Line 10: Replace the weak negated assertion with two explicit checks: assert
that parsed[sym] === 42 and assert that parsed.foo === undefined. Locate the
current assertion using the symbols parsed and sym and change it to two
assertions (e.g., assert.eq(parsed[sym], 42) and assert.eq(parsed.foo,
undefined) or equivalent assert calls) so the test verifies the exact expected
state.

In `@JSTests/stress/temporal-calendar.js`:
- Around line 2-3: The test file is being unconditionally skipped by the "//@
skip" directive which prevents the new Temporal calendar assertions from
running; remove the "//@ skip" line (or replace it with a conditional skip that
only triggers when IntlDateTimeFormat Temporal support is actually missing) so
the Temporal calendar checks (e.g., the Stage‑4 calendar assertions referencing
toLocaleString) execute during test runs.

In `@JSTests/stress/temporal-duration.js`:
- Around line 2-3: Remove the global test skip (the line containing "//@ skip")
so the Temporal.Duration stress suite runs; instead isolate only the unsupported
toLocaleString assertions by removing or guarding the specific assertions that
call Duration.prototype.toLocaleString (the assertions noted around the
toLocaleString checks previously at lines ~286-288) so those three assertions
are skipped/disabled while keeping the rest of the suite active. Ensure the
global skip remains removed and only the toLocaleString calls
(Temporal.Duration.prototype.toLocaleString assertions) are the ones excluded or
wrapped with a conditional/skip helper.

In `@JSTests/stress/temporal-timezone.js`:
- Around line 2-3: Remove the file-level skip so the Temporal assertions
execute: delete or comment out the literal line "//@ skip" at the top of
JSTests/stress/temporal-timezone.js (the file-level skip that prevents the whole
test from running), leaving the FIXME comment intact so the file runs and the
new Temporal toLocaleString checks are executed.

In `@JSTests/stress/typedarray-forEach-transition.js`:
- Around line 12-14: The failure message drops the index because the Error
constructor is called with two arguments; update the throw in the if (v !==
0xDEAD) branch so the index variable i is included in the error message (e.g.
build a single string by concatenating or using a template literal) so the
thrown Error includes "read stale value at index <i>" for easier debugging.

In
`@JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/argument-coercion.js`:
- Line 246: The typeof comparisons for Symbol are using the bare undefined
instead of the string "undefined", causing the checks around Symbol.toPrimitive
to always be incorrect; update the two conditions that read `typeof Symbol ===
undefined` and `typeof Symbol !== undefined` to use string comparisons (`typeof
Symbol === "undefined"` and `typeof Symbol !== "undefined"`) so the guards
around Symbol.toPrimitive (referenced in the loop that checks
Symbol.toPrimitive) behave correctly.

In
`@JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/this-is-not-object.js`:
- Around line 39-46: The loop over badReceivers indexes entries that can be
undefined when optional features are absent; before accessing badReceivers[i][0]
and [1] (the label/value), guard the lookup by first retrieving the entry (e.g.,
var entry = badReceivers[i]) and skip it if undefined (continue) or only then
extract var label = entry[0]; var value = entry[1]; This ensures
Symbol/BigInt-placeholder undefined entries don't get indexed and the intended
assert.throws path still runs.

In
`@JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/this-is-not-object.js`:
- Around line 29-43: The test builds badReceivers with conditional entries that
may be undefined when Symbol/BigInt are missing and then dereferences them in
the loop; filter out those undefined entries before iterating (e.g. replace
iteration over badReceivers with badReceivers =
badReceivers.filter(function(e){return e !== undefined;}) or similar) so the
for-loop that uses label and value (variables from badReceivers[i]) never tries
to access properties of undefined; update the code around the badReceivers
declaration/for loop to perform this filter prior to using label/value.

In `@JSTests/test262/test/built-ins/Atomics/xor/immutable-buffer.js`:
- Around line 32-52: The test currently iterates over all typed array
constructors with testWithAllTypedArrayConstructors which can include
non-Atomics-compatible types; change the iteration to use the helper that
restricts to Atomics-compatible integer typed arrays (e.g.
testWithAtomicsTypedArrayConstructors or testWithIntegerTypedArrayConstructors)
so that TA (the typed array under test) and the Atomics.xor(ta, index, value)
call exercise immutable-buffer write validation specifically; keep the rest of
the test (index/value objects and assertions) unchanged.

---

Outside diff comments:
In `@JSTests/stress/dataview-bytelength-ic-stub-stack-desync.js`:
- Around line 42-45: After calling ab.transfer() and computing r with hot(dv, A,
objs), add an explicit assertion that verifies the detached-path output (the
value in r) so the byteLength IC desync regression is detectable; locate the
code around ab.transfer() and the hot(dv, A, objs) call and insert an assertion
using the existing test helpers (e.g., assertEq or assert) to compare r to the
expected result (or expected detached/null value) and fail the test if it
differs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: fce9a711-f4bf-40b1-bdc5-95664c884be7

📥 Commits

Reviewing files that changed from the base of the PR and between 6d586e2 and cf78490.

📒 Files selected for processing (300)

• .gitattributes
• .github/CODEOWNERS
• .wkdev-sdk-version
• CMakeLists.txt
• CMakePresets.json
• Configurations/CommonBase.xcconfig
• JSTests/microbenchmarks/array-iterator-fast-entries.js
• JSTests/microbenchmarks/array-iterator-fast-keys.js
• JSTests/microbenchmarks/array-iterator-fast-values.js
• JSTests/microbenchmarks/array-prototype-lastIndexOf-double-large.js
• JSTests/microbenchmarks/bigint-heap-dec.js
• JSTests/microbenchmarks/bigint-heap-inc.js
• JSTests/microbenchmarks/intl-string-tolocalelowercase.js
• JSTests/microbenchmarks/intl-string-tolocaleuppercase.js
• JSTests/microbenchmarks/map-clone-large.js
• JSTests/microbenchmarks/map-clone.js
• JSTests/microbenchmarks/map-iterator-fast-entries.js
• JSTests/microbenchmarks/map-iterator-fast-keys.js
• JSTests/microbenchmarks/map-iterator-fast-values.js
• JSTests/microbenchmarks/regexp-matchall-digit-cached.js
• JSTests/microbenchmarks/regexp-matchall-digit-literal.js
• JSTests/microbenchmarks/regexp-search-digit-cached.js
• JSTests/microbenchmarks/regexp-search-digit-literal.js
• JSTests/microbenchmarks/set-clone-large.js
• JSTests/microbenchmarks/set-clone.js
• JSTests/microbenchmarks/set-iterator-fast-entries.js
• JSTests/microbenchmarks/set-iterator-fast-keys.js
• JSTests/microbenchmarks/set-iterator-fast-values.js
• JSTests/microbenchmarks/string-from-code-point.js
• JSTests/microbenchmarks/string-iterator-for-of-ascii.js
• JSTests/microbenchmarks/string-iterator-for-of-surrogate-pairs.js
• JSTests/microbenchmarks/string-iterator-spread-surrogate-pairs.js
• JSTests/microbenchmarks/string-matchall-digit-short.js
• JSTests/microbenchmarks/string-matchall-letter-short.js
• JSTests/microbenchmarks/string-search-digit-short.js
• JSTests/microbenchmarks/typed-array-allocate-float64-variable-length.js
• JSTests/microbenchmarks/typed-array-allocate-int32-constant-512.js
• JSTests/microbenchmarks/typed-array-allocate-uint8-variable-length.js
• JSTests/microbenchmarks/weak-map-constructor-empty.js
• JSTests/microbenchmarks/weak-set-constructor-empty.js
• JSTests/stress/array-iterator-fast-cross-realm.js
• JSTests/stress/array-iterator-fast-ftl.js
• JSTests/stress/array-iterator-fast-iterator-proto-symbol-iterator-overridden.js
• JSTests/stress/array-iterator-fast-keys-values-entries.js
• JSTests/stress/array-iterator-fast-mid-iteration.js
• JSTests/stress/array-iterator-fast-multi-mode-cross-realm-prototype.js
• JSTests/stress/array-iterator-fast-non-array-iterated-object.js
• JSTests/stress/array-iterator-fast-own-symbol-iterator-on-instance.js
• JSTests/stress/array-iterator-fast-watchpoint-invalidate-next.js
• JSTests/stress/array-iterator-fast-watchpoint-invalidate-symbol-iterator.js
• JSTests/stress/array-join-dfg-empty-separator.js
• JSTests/stress/array-join-dfg-object-separator-tostring-once.js
• JSTests/stress/array-join-dfg-string-separator.js
• JSTests/stress/array-join-dfg-tostring-mutation.js
• JSTests/stress/array-join-dfg-undefined-separator.js
• JSTests/stress/array-join-dfg-untyped-separator.js
• JSTests/stress/array-join-tostring-adds-indexed-prototype-property.js
• JSTests/stress/array-prototype-valueOf-override-should-not-break-toPrimitive.js
• JSTests/stress/b3cppi-ssa-dominance.js
• JSTests/stress/baseline-op-del-by-id-write-barrier.js
• JSTests/stress/baseline-op-del-by-val-write-barrier.js
• JSTests/stress/bigint-in-place-thresholds.js
• JSTests/stress/bigint-inc-dec-in-place.js
• JSTests/stress/checkpoint-exception-handler-during-osr-exit.js
• JSTests/stress/create-many-realms.js
• JSTests/stress/cross-realm-await-thenable-resolve-realm.js
• JSTests/stress/cross-realm-promise-internal-reaction-realm.js
• JSTests/stress/cross-realm-promise-microtask-ordering.js
• JSTests/stress/dataview-bytelength-ic-stub-stack-desync.js
• JSTests/stress/decouple-calllinkinfo-from-access-case.js
• JSTests/stress/dfg-boolean-to-number-known-boolean-use-via-iterator-fast-path.js
• JSTests/stress/dfg-ensure-absence-dictionary-then-property.js
• JSTests/stress/dfg-ensure-absence-own-then-property.js
• JSTests/stress/dfg-new-typed-array-with-size-zero-fill.js
• JSTests/stress/direct-eval-cache-rope.js
• JSTests/stress/fixobviousspills-earlydefs.js
• JSTests/stress/ftl-materialize-new-array-with-butterfly.js
• JSTests/stress/ftl-osr-exit-phantom-new-array-with-butterfly-having-a-bad-time-double-hole.js
• JSTests/stress/ftl-osr-exit-phantom-new-array-with-butterfly-having-a-bad-time-int32-hole.js
• JSTests/stress/ftl-osr-exit-phantom-new-array-with-butterfly-having-a-bad-time.js
• JSTests/stress/generator-expression-info-multiwide-remap.js
• JSTests/stress/get-by-id-constant-fold-dictionary-head-shadow-property.js
• JSTests/stress/get-by-val-double-subscript-out-of-uint32-range.js
• JSTests/stress/growable-sharedarraybuffer-parallel-grow-during-prototype-methods.js
• JSTests/stress/intl-canonical-iana-time-zone.js
• JSTests/stress/intl-datetimeformat-temporal-formatter-cache.js
• JSTests/stress/iterator-fast-path-mode-mixing.js
• JSTests/stress/iterator-helpers-fast-path-drain-and-reentrancy.js
• JSTests/stress/iterator-helpers-set-entries-exception-check.js
• JSTests/stress/iterator-prototype-forEach-map-set-iterator-close.js
• JSTests/stress/iterator-prototype-includes.js
• JSTests/stress/jsonp-large-array-index.js
• JSTests/stress/map-iterator-fast-cross-realm.js
• JSTests/stress/map-iterator-fast-ftl.js
• JSTests/stress/map-iterator-fast-iterator-proto-symbol-iterator-overridden.js
• JSTests/stress/map-iterator-fast-keys-values-entries.js
• JSTests/stress/map-iterator-fast-mid-iteration.js
• JSTests/stress/map-iterator-fast-watchpoint-invalidate-next.js
• JSTests/stress/map-iterator-fast-watchpoint-invalidate-symbol-iterator.js
• JSTests/stress/map-iterator-fully-packed-table.js
• JSTests/stress/map-set-clone-large-table.js
• JSTests/stress/map-set-for-of-fast-iterator-storage.js
• JSTests/stress/new-weak-map-weak-set-dfg.js
• JSTests/stress/number-tostring-methods-out-of-range-arguments.js
• JSTests/stress/osr-exit-scratch-buffer-gc.js
• JSTests/stress/out-of-memory-while-creating-undefined-variable-error.js
• JSTests/stress/parseint-large-result-int32-boxing.js
• JSTests/stress/proxy-revoke.js
• JSTests/stress/regexp-alternative-heavy.js
• JSTests/stress/regexp-bol-optimize-out-of-stack.js
• JSTests/stress/regexp-character-class-latin1-boundary.js
• JSTests/stress/regexp-combined-large.js
• JSTests/stress/regexp-deep-nested.js
• JSTests/stress/regexp-duplicate-named-captures-indices.js
• JSTests/stress/regexp-fixedcount-zero-length-content-backtrack.js
• JSTests/stress/regexp-greedy-nested-quantifier-backtrack.js
• JSTests/stress/regexp-greedy-varcount-minfail.js
• JSTests/stress/regexp-greedy-varcount-multialt.js
• JSTests/stress/regexp-heavy-mixed.js
• JSTests/stress/regexp-large-quantifier.js
• JSTests/stress/regexp-lookahead-heavy.js
• JSTests/stress/regexp-multialt-content-backtracking.js
• JSTests/stress/regexp-nongreedy-varcount-content-backtrack.js
• JSTests/stress/regexp-quantify-atom-copy-term-out-of-stack.js
• JSTests/stress/regexp-unicode-case-insensitive-ascii-range-canonical-set.js
• JSTests/stress/regexp-variable-count-native.js
• JSTests/stress/regexp-variable-counted-parentheses-with-min.js
• JSTests/stress/regress-159954.js
• JSTests/stress/regress-168411205.js
• JSTests/stress/regress-171780137.js
• JSTests/stress/set-iterator-fast-cross-realm.js
• JSTests/stress/set-iterator-fast-ftl.js
• JSTests/stress/set-iterator-fast-iterator-proto-symbol-iterator-overridden.js
• JSTests/stress/set-iterator-fast-keys-values-entries.js
• JSTests/stress/set-iterator-fast-mid-iteration.js
• JSTests/stress/set-iterator-fast-watchpoint-invalidate-next.js
• JSTests/stress/set-iterator-fast-watchpoint-invalidate-symbol-iterator.js
• JSTests/stress/stack-overflow-regexp.js
• JSTests/stress/string-at-cse-array-mode.js
• JSTests/stress/string-from-code-point-intrinsic.js
• JSTests/stress/string-from-code-point-out-of-range.js
• JSTests/stress/string-iterator-fast-path.js
• JSTests/stress/string-iterator-surrogate-pairs.js
• JSTests/stress/string-prototype-matchall-edge-cases.js
• JSTests/stress/string-prototype-matchall-species-constructor.js
• JSTests/stress/string-prototype-matchall-tostring-once.js
• JSTests/stress/string-prototype-matchall-tostring-recompiles-regexp.js
• JSTests/stress/string-prototype-matchall-watchpoint-invalidation.js
• JSTests/stress/string-prototype-search-edge-cases.js
• JSTests/stress/string-prototype-search-strength-reduction.js
• JSTests/stress/string-prototype-search-watchpoint-invalidation.js
• JSTests/stress/temporal-calendar.js
• JSTests/stress/temporal-duration.js
• JSTests/stress/temporal-plaindate.js
• JSTests/stress/temporal-plaindatetime.js
• JSTests/stress/temporal-plainmonthday.js
• JSTests/stress/temporal-plaintime.js
• JSTests/stress/temporal-plainyearmonth.js
• JSTests/stress/temporal-timezone.js
• JSTests/stress/to-locale-case-root-fast-path.js
• JSTests/stress/typedarray-forEach-transition.js
• JSTests/stress/wasm-funcref-table-grow-gc-marking-gap.js
• JSTests/stress/weak-map-weak-set-lazy-buffer.js
• JSTests/stress/yarr-jit-shared-lead-prefilter.js
• JSTests/test262/config.yaml
• JSTests/test262/expectations.yaml
• JSTests/test262/harness/assert.js
• JSTests/test262/harness/nativeErrors.js
• JSTests/test262/harness/propertyHelper.js
• JSTests/test262/harness/proxyTrapsHelper.js
• JSTests/test262/harness/sta.js
• JSTests/test262/harness/temporalHelpers.js
• JSTests/test262/harness/testTypedArray.js
• JSTests/test262/latest-changes-summary.txt
• JSTests/test262/test/built-ins/ArrayBuffer/isView/arg-is-typedarray-buffer.js
• JSTests/test262/test/built-ins/ArrayBuffer/isView/arg-is-typedarray-constructor.js
• JSTests/test262/test/built-ins/ArrayBuffer/isView/arg-is-typedarray-subclass-instance.js
• JSTests/test262/test/built-ins/ArrayBuffer/isView/arg-is-typedarray.js
• JSTests/test262/test/built-ins/ArrayBuffer/isView/invoked-as-a-fn.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/immutable/prop-desc.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/immutable/return-immutable.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/immutable/this-has-no-arraybufferdata-internal.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/immutable/this-is-not-object.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/immutable/this-is-sharedarraybuffer.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/argument-coercion.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/modify-source-after-return.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/not-a-constructor.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/prop-desc.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/this-becomes-detached.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/this-grows.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/this-has-no-arraybufferdata-internal.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/this-is-not-detached.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/this-is-not-object.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/this-is-sharedarraybuffer.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/this-shrinks.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/new-length-coercion.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/not-a-constructor.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/prop-desc.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/this-has-no-arraybufferdata-internal.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/this-is-not-detachable.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/this-is-not-object.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/this-is-sharedarraybuffer.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/to-larger.js
• JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/to-same-or-smaller.js
• JSTests/test262/test/built-ins/ArrayIteratorPrototype/next/detach-typedarray-in-progress.js
• JSTests/test262/test/built-ins/Atomics/add/bad-range.js
• JSTests/test262/test/built-ins/Atomics/add/bigint/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/add/good-views.js
• JSTests/test262/test/built-ins/Atomics/add/immutable-buffer.js
• JSTests/test262/test/built-ins/Atomics/add/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/add/non-shared-int-views-throws.js
• JSTests/test262/test/built-ins/Atomics/and/bad-range.js
• JSTests/test262/test/built-ins/Atomics/and/bigint/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/and/good-views.js
• JSTests/test262/test/built-ins/Atomics/and/immutable-buffer.js
• JSTests/test262/test/built-ins/Atomics/and/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/and/non-shared-int-views-throws.js
• JSTests/test262/test/built-ins/Atomics/compareExchange/bad-range.js
• JSTests/test262/test/built-ins/Atomics/compareExchange/bigint/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/compareExchange/good-views.js
• JSTests/test262/test/built-ins/Atomics/compareExchange/immutable-buffer.js
• JSTests/test262/test/built-ins/Atomics/compareExchange/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/compareExchange/non-shared-int-views-throws.js
• JSTests/test262/test/built-ins/Atomics/exchange/bad-range.js
• JSTests/test262/test/built-ins/Atomics/exchange/bigint/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/exchange/good-views.js
• JSTests/test262/test/built-ins/Atomics/exchange/immutable-buffer.js
• JSTests/test262/test/built-ins/Atomics/exchange/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/exchange/non-shared-int-views-throws.js
• JSTests/test262/test/built-ins/Atomics/exchange/nonshared-int-views.js
• JSTests/test262/test/built-ins/Atomics/isLockFree/bigint/expected-return-value.js
• JSTests/test262/test/built-ins/Atomics/load/bad-range.js
• JSTests/test262/test/built-ins/Atomics/load/bigint/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/load/good-views.js
• JSTests/test262/test/built-ins/Atomics/load/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/load/non-shared-int-views-throws.js
• JSTests/test262/test/built-ins/Atomics/notify/immutable-buffer-returns-0.js
• JSTests/test262/test/built-ins/Atomics/or/bad-range.js
• JSTests/test262/test/built-ins/Atomics/or/bigint/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/or/good-views.js
• JSTests/test262/test/built-ins/Atomics/or/immutable-buffer.js
• JSTests/test262/test/built-ins/Atomics/or/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/or/non-shared-int-views-throws.js
• JSTests/test262/test/built-ins/Atomics/store/bad-range.js
• JSTests/test262/test/built-ins/Atomics/store/bigint/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/store/good-views.js
• JSTests/test262/test/built-ins/Atomics/store/immutable-buffer.js
• JSTests/test262/test/built-ins/Atomics/store/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/store/non-shared-int-views-throws.js
• JSTests/test262/test/built-ins/Atomics/sub/bad-range.js
• JSTests/test262/test/built-ins/Atomics/sub/bigint/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/sub/good-views.js
• JSTests/test262/test/built-ins/Atomics/sub/immutable-buffer.js
• JSTests/test262/test/built-ins/Atomics/sub/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/sub/non-shared-int-views-throws.js
• JSTests/test262/test/built-ins/Atomics/xor/bad-range.js
• JSTests/test262/test/built-ins/Atomics/xor/bigint/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/xor/good-views.js
• JSTests/test262/test/built-ins/Atomics/xor/immutable-buffer.js
• JSTests/test262/test/built-ins/Atomics/xor/non-shared-bufferdata.js
• JSTests/test262/test/built-ins/Atomics/xor/non-shared-int-views-throws.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-cross-realm.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-data-property-shadows.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-error-as-prototype.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-error-instance.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-error-prototype.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-foreign-new-target.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-no-error-data.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-not-a-constructor.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-receiver-is-proxy.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-subclass.js
• JSTests/test262/test/built-ins/Error/prototype/stack/getter-this-not-object.js
• JSTests/test262/test/built-ins/Error/prototype/stack/instance-no-own-stack.js
• JSTests/test262/test/built-ins/Error/prototype/stack/instance-not-enumerable.js
• JSTests/test262/test/built-ins/Error/prototype/stack/prop-desc.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-creates-own-property.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-cross-realm.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-delete-round-trip.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-empty-string.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-existing-own-property.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-no-argument.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-non-error-receiver.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-non-extensible-receiver.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-non-string-value.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-non-writable-stack.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-not-a-constructor.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-own-accessor.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-proxy-trap-rejects.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-proxy-trap-throws.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-proxy-wrapping-prototype.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-receiver-is-null-proto.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-receiver-is-other-prototype.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-receiver-is-prototype.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-receiver-is-proxy.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-this-not-object.js
• JSTests/test262/test/built-ins/Error/prototype/stack/setter-via-assignment.js
• JSTests/test262/test/built-ins/Iterator/zip/iterator-zip-iteration-strict-checks-remaining-done.js
• JSTests/test262/test/built-ins/Iterator/zip/result-arrays-are-fresh.js
• JSTests/test262/test/built-ins/Iterator/zipKeyed/iterator-zip-iteration-strict-checks-remaining-done.js
• JSTests/test262/test/built-ins/Iterator/zipKeyed/result-objects-are-fresh.js

💤 Files with no reviewable changes (3)

• JSTests/test262/test/built-ins/Atomics/isLockFree/bigint/expected-return-value.js
• JSTests/test262/test/built-ins/Atomics/exchange/nonshared-int-views.js
• JSTests/stress/proxy-revoke.js

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fix exception assertion logic (&& should be ||) and guard message access.

This condition currently accepts wrong exceptions when either side happens to pass. It should fail if the exception is not a TypeError or the message does not mention instanceof. Also make message access fully optional-chained.

Suggested patch

-if (exn?.constructor !== TypeError && exn?.message.indexOf("instanceof") < 0) {
+if (exn?.constructor !== TypeError || exn?.message?.indexOf("instanceof") < 0) {
     throw new Error("expected TypeError in instanceof");
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if (exn?.constructor !== TypeError && exn?.message.indexOf("instanceof") < 0) {
	throw new Error("expected TypeError in instanceof");
	if (exn?.constructor !== TypeError || exn?.message?.indexOf("instanceof") < 0) {
	throw new Error("expected TypeError in instanceof");

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/checkpoint-exception-handler-during-osr-exit.js` around lines
36 - 37, The exception assertion condition using exn?.constructor !== TypeError
&& exn?.message.indexOf("instanceof") < 0 is wrong and should use logical OR and
safer message access; update the check so it throws when the exception is not a
TypeError OR its message does not include "instanceof" (change && to ||) and
make the message lookup fully optional-chained (e.g., use
exn?.message?.indexOf("instanceof") < 0) while keeping the thrown Error text
("expected TypeError in instanceof") and referring to the same exn and TypeError
identifiers.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Ensure Array.prototype[3] is always cleaned up.

This test mutates Array.prototype but never guarantees restoration. If a run aborts mid-file, prototype pollution can affect later tests in the same process.

Suggested fix

 trigger = true;
-let a = opt(true);
+let a;
+try {
+    a = opt(true);

 // After having a bad time, the rematerialized Array uses SlowPutArrayStorage and index 3 must be
 // a hole at the OSR exit. The subsequent a[3] = 4.4 store in baseline code must therefore be
 // forwarded to the Array.prototype setter instead of creating an own property.
 if (a.hasOwnProperty(3))
@@
 if (a.hasOwnProperty(3) || a[3] !== 42)
     throw new Error("after reverse, index 3 should still be a hole reading 42 from the getter, got: " + a[3]);
-gc();
+    gc();
+} finally {
+    delete Array.prototype[3];
+}

Also applies to: 42-44, 70-70

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@JSTests/stress/ftl-osr-exit-phantom-new-array-with-butterfly-having-a-bad-time-double-hole.js`
around lines 7 - 13, The test mutates Array.prototype[3] inside cb without
guaranteeing restoration; capture the original descriptor via
Object.getOwnPropertyDescriptor(Array.prototype, 3) before defining the custom
getter/setter in cb, wrap the mutation and test body in a try/finally, and in
the finally restore the original descriptor (using Object.defineProperty if
descriptor exists or delete Array.prototype[3] if it was undefined) so
getterCalls/setterCalls cleanup is always performed; apply the same pattern to
the other sites that modify Array.prototype[3] (the other places that define a
custom getter/setter).

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Do not swallow runtime failures in this regression test.

The catch block only prints, so eval(code) failures won’t fail the test and regressions can slip through.

Suggested fix

-try {
-    eval(code);
-    print("Done");
-} catch(e) {
-    print("Error: " + e);
-}
+eval(code);
+print("Done");

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	try {
	eval(code);
	print("Done");
	} catch(e) {
	print("Error: " + e);
	}
	eval(code);
	print("Done");

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/generator-expression-info-multiwide-remap.js` around lines 16
- 21, The test currently swallows runtime failures by catching exceptions from
eval(code) and only printing them; change the catch(e) handler so the exception
is rethrown (or the test process terminated) after printing to ensure failures
fail the test — e.g., in the catch(e) for eval(code) call, keep the
print("Error: " + e) but add throw e (or call quit(1)) so runtime errors don't
get silently ignored.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Re-enable the Temporal behavior check with a runtime guard instead of commented code.

This block is currently inert, so the claimed Temporal.ZonedDateTime.prototype.equals() observability is not tested and regressions can slip through.

Proposed fix

-// FIXME: ZonedDateTime — test via Temporal.ZonedDateTime once implemented.
-// if (typeof Temporal !== "undefined") {
-//     const pairs = [
-//         ["Asia/Calcutta",          "Asia/Kolkata"],
-//         ["America/Buenos_Aires",   "America/Argentina/Buenos_Aires"],
-//         ["Europe/Kiev",            "Europe/Kyiv"],
-//         ["Asia/Katmandu",          "Asia/Kathmandu"],
-//         ["US/Pacific",             "America/Los_Angeles"],
-//         ["GB",                     "Europe/London"],
-//         ["Brazil/East",            "America/Sao_Paulo"],
-//         ["UCT",                    "UTC"],
-//         ["Etc/UTC",                "UTC"],
-//         ["Zulu",                   "UTC"],
-//     ];
-//     for (const [legacy, primary] of pairs) {
-//         shouldBeTrue(new Temporal.ZonedDateTime(0n, legacy).equals(new Temporal.ZonedDateTime(0n, primary)));
-//     }
-// }
+if (typeof Temporal !== "undefined"
+    && Temporal.ZonedDateTime
+    && typeof Temporal.ZonedDateTime.prototype.equals === "function") {
+    const pairs = [
+        ["Asia/Calcutta", "Asia/Kolkata"],
+        ["America/Buenos_Aires", "America/Argentina/Buenos_Aires"],
+        ["Europe/Kiev", "Europe/Kyiv"],
+        ["Asia/Katmandu", "Asia/Kathmandu"],
+        ["US/Pacific", "America/Los_Angeles"],
+        ["GB", "Europe/London"],
+        ["Brazil/East", "America/Sao_Paulo"],
+        ["UCT", "UTC"],
+        ["Etc/UTC", "UTC"],
+        ["Zulu", "UTC"],
+    ];
+    for (const [legacy, primary] of pairs)
+        shouldBeTrue(new Temporal.ZonedDateTime(0n, legacy).equals(new Temporal.ZonedDateTime(0n, primary)));
+}

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// Temporal.ZonedDateTime uses the same hashmap-backed TimeZoneID lookup as Intl, so
	// legacy aliases must also be accepted there. ZonedDateTime.prototype.equals() uses
	// TimeZoneEquals internally, which recognises legacy ↔ primary as the same timezone.
	// FIXME: ZonedDateTime — test via Temporal.ZonedDateTime once implemented.
	// if (typeof Temporal !== "undefined") {
	// const pairs = [
	// ["Asia/Calcutta", "Asia/Kolkata"],
	// ["America/Buenos_Aires", "America/Argentina/Buenos_Aires"],
	// ["Europe/Kiev", "Europe/Kyiv"],
	// ["Asia/Katmandu", "Asia/Kathmandu"],
	// ["US/Pacific", "America/Los_Angeles"],
	// ["GB", "Europe/London"],
	// ["Brazil/East", "America/Sao_Paulo"],
	// ["UCT", "UTC"],
	// ["Etc/UTC", "UTC"],
	// ["Zulu", "UTC"],
	// ];
	// for (const [legacy, primary] of pairs) {
	// shouldBeTrue(new Temporal.ZonedDateTime(0n, legacy).equals(new Temporal.ZonedDateTime(0n, primary)));
	// }
	// }
	if (typeof Temporal !== "undefined"
	&& Temporal.ZonedDateTime
	&& typeof Temporal.ZonedDateTime.prototype.equals === "function") {
	const pairs = [
	["Asia/Calcutta", "Asia/Kolkata"],
	["America/Buenos_Aires", "America/Argentina/Buenos_Aires"],
	["Europe/Kiev", "Europe/Kyiv"],
	["Asia/Katmandu", "Asia/Kathmandu"],
	["US/Pacific", "America/Los_Angeles"],
	["GB", "Europe/London"],
	["Brazil/East", "America/Sao_Paulo"],
	["UCT", "UTC"],
	["Etc/UTC", "UTC"],
	["Zulu", "UTC"],
	];
	for (const [legacy, primary] of pairs)
	shouldBeTrue(new Temporal.ZonedDateTime(0n, legacy).equals(new Temporal.ZonedDateTime(0n, primary)));
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/intl-canonical-iana-time-zone.js` around lines 90 - 110,
Uncomment and re-enable the Temporal check by replacing the commented block with
a runtime guard: wrap the legacy↔primary pairs test in an if (typeof Temporal
!== "undefined") { ... } so it only runs when Temporal is available; inside,
define the pairs array and iterate over it calling shouldBeTrue(new
Temporal.ZonedDateTime(0n, legacy).equals(new Temporal.ZonedDateTime(0n,
primary))) to exercise ZonedDateTime.prototype.equals (which uses
TimeZoneEquals) and ensure legacy aliases are accepted. Ensure you reference
Temporal.ZonedDateTime, ZonedDateTime.prototype.equals, and the pairs list
exactly as in the diff so the test logic matches the intended assertions.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

Per current Intl.DateTimeFormat + Temporal behavior, should new Intl.DateTimeFormat("en-US", { dateStyle: "short" }).format(new Temporal.PlainTime(...))throwTypeError?

💡 Result:

Yes, calling new Intl.DateTimeFormat("en-US", { dateStyle: "short" }).format(new Temporal.PlainTime(...)) should throw a TypeError [1]. According to the Intl.DateTimeFormat specification regarding Temporal types, the options provided must be compatible with the object being formatted [2][3]. Specifically, when the dateStyle option is specified, the DateTimeFormat instance is restricted to formatting objects that contain date components, such as Temporal.PlainDate, Temporal.PlainYearMonth, or Temporal.PlainMonthDay [2][3]. Conversely, to format a Temporal.PlainTime object, the instance must be configured with timeStyle or relevant time component options [2][3]. Because Temporal.PlainTime does not contain date information, attempting to format it using an Intl.DateTimeFormat instance configured with dateStyle (which implicitly requires date components) results in an error [1]. Technical documentation and TC39 discussions confirm that this mismatch between the formatting options and the Temporal type's available data leads to a TypeError [1].

Citations:

• 1: Clarify timeStyle:long/full for Plain types tc39/proposal-temporal#2795
• 2: https://developer.cdn.mozilla.net/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl/DateTimeFormat/DateTimeFormat
• 3: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl/DateTimeFormat/DateTimeFormat

---

Assert TypeError explicitly for dateStyle + PlainTime.

dateStyle config is incompatible with Temporal.PlainTime (no date fields), so formatting should throw a TypeError—the test should capture the error and assert its type instead of only checking that something threw.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/intl-datetimeformat-temporal-formatter-cache.js` around lines
117 - 120, Replace the current boolean throw-check around
fmtDS.format(plainTime) with a try/catch that captures the thrown exception
(e.g., let err = null; try { fmtDS.format(plainTime); } catch (e) { err = e; })
and then assert the error is a TypeError using the existing test helpers (for
example: shouldBe(err instanceof TypeError, true, "dateStyle + PlainTime must
throw TypeError") or shouldBe(err.name, "TypeError", "...")). Ensure you
reference fmtDS.format and plainTime in the changed block and remove the old
threw boolean-only assertion.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix dropped index in failure message.

At Line 13, new Error("read stale value at index ", i) drops i, so failures lose the index context.

Suggested patch

-            throw new Error("read stale value at index ", i);
+            throw new Error(`read stale value at index ${i}`);

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if (v !== 0xDEAD) {
	throw new Error("read stale value at index ", i);
	}
	if (v !== 0xDEAD) {
	throw new Error(`read stale value at index ${i}`);
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/stress/typedarray-forEach-transition.js` around lines 12 - 14, The
failure message drops the index because the Error constructor is called with two
arguments; update the throw in the if (v !== 0xDEAD) branch so the index
variable i is included in the error message (e.g. build a single string by
concatenating or using a template literal) so the thrown Error includes "read
stale value at index <i>" for easier debugging.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Incorrect typeof comparison with undefined.

Lines 246 and 361 compare the result of typeof Symbol (which is a string) directly with undefined (not a string). This will never work as intended.

Line 246: typeof Symbol === undefined should be typeof Symbol === "undefined"
Line 361: typeof Symbol !== undefined should be typeof Symbol !== "undefined"

The current code at line 246 will always be false, potentially skipping Symbol.toPrimitive tests even when Symbol is available.

🔧 Proposed fix

-    if (typeof Symbol === undefined || !Symbol.toPrimitive) continue;
+    if (typeof Symbol === "undefined" || !Symbol.toPrimitive) continue;

-  if (typeof Symbol !== undefined && Symbol.toPrimitive) {
+  if (typeof Symbol !== "undefined" && Symbol.toPrimitive) {

Also applies to: 361-361

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/argument-coercion.js`
at line 246, The typeof comparisons for Symbol are using the bare undefined
instead of the string "undefined", causing the checks around Symbol.toPrimitive
to always be incorrect; update the two conditions that read `typeof Symbol ===
undefined` and `typeof Symbol !== undefined` to use string comparisons (`typeof
Symbol === "undefined"` and `typeof Symbol !== "undefined"`) so the guards
around Symbol.toPrimitive (referenced in the loop that checks
Symbol.toPrimitive) behave correctly.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Guard optional-feature placeholders before indexing.

When Symbol or BigInt is unavailable, entries become undefined, but Line 45/Line 46 index them unconditionally. That throws before the intended assert.throws path.

Suggested fix

 for (var i = 0; i < badReceivers.length; i++) {
+  if (!badReceivers[i]) continue;
   var label = badReceivers[i][0];
   var value = badReceivers[i][1];
   calls = [];

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@JSTests/test262/test/built-ins/ArrayBuffer/prototype/sliceToImmutable/this-is-not-object.js`
around lines 39 - 46, The loop over badReceivers indexes entries that can be
undefined when optional features are absent; before accessing badReceivers[i][0]
and [1] (the label/value), guard the lookup by first retrieving the entry (e.g.,
var entry = badReceivers[i]) and skip it if undefined (continue) or only then
extract var label = entry[0]; var value = entry[1]; This ensures
Symbol/BigInt-placeholder undefined entries don't get indexed and the intended
assert.throws path still runs.

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Filter optional receiver entries before iterating.

Line 42/Line 43 can dereference undefined when Symbol or BigInt is unavailable, causing this test to fail for the wrong reason.

Suggested fix

 var badReceivers = [
   ["undefined", undefined],
   ["null", null],
   ["number", 42],
   ["string", "1"],
   ["true", true],
   ["false", false],
   typeof Symbol === "undefined" ? undefined : ["unique symbol", Symbol("1")],
   typeof Symbol === "undefined" || !Symbol.for ? undefined : ["registered symbol", Symbol.for("1")],
   typeof BigInt === "undefined" ? undefined : ["bigint", BigInt(1)]
-];
+].filter(Boolean);

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	var badReceivers = [
	["undefined", undefined],
	["null", null],
	["number", 42],
	["string", "1"],
	["true", true],
	["false", false],
	typeof Symbol === "undefined" ? undefined : ["unique symbol", Symbol("1")],
	typeof Symbol === "undefined" || !Symbol.for ? undefined : ["registered symbol", Symbol.for("1")],
	typeof BigInt === "undefined" ? undefined : ["bigint", BigInt(1)]
	];
	for (var i = 0; i < badReceivers.length; i++) {
	var label = badReceivers[i][0];
	var value = badReceivers[i][1];
	var badReceivers = [
	["undefined", undefined],
	["null", null],
	["number", 42],
	["string", "1"],
	["true", true],
	["false", false],
	typeof Symbol === "undefined" ? undefined : ["unique symbol", Symbol("1")],
	typeof Symbol === "undefined" || !Symbol.for ? undefined : ["registered symbol", Symbol.for("1")],
	typeof BigInt === "undefined" ? undefined : ["bigint", BigInt(1)]
	].filter(Boolean);
	for (var i = 0; i < badReceivers.length; i++) {
	var label = badReceivers[i][0];
	var value = badReceivers[i][1];

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@JSTests/test262/test/built-ins/ArrayBuffer/prototype/transferToImmutable/this-is-not-object.js`
around lines 29 - 43, The test builds badReceivers with conditional entries that
may be undefined when Symbol/BigInt are missing and then dereferences them in
the loop; filter out those undefined entries before iterating (e.g. replace
iteration over badReceivers with badReceivers =
badReceivers.filter(function(e){return e !== undefined;}) or similar) so the
for-loop that uses label and value (variables from badReceivers[i]) never tries
to access properties of undefined; update the code around the badReceivers
declaration/for loop to perform this filter prior to using label/value.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Constrain constructor coverage to Atomics-compatible typed arrays.

At Line 32, testWithAllTypedArrayConstructors can include non-integer typed arrays, which may throw TypeError for the wrong reason and dilute this immutable-buffer assertion. Use an Atomics-compatible constructor helper/set so the failure specifically exercises immutable buffer write validation.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@JSTests/test262/test/built-ins/Atomics/xor/immutable-buffer.js` around lines
32 - 52, The test currently iterates over all typed array constructors with
testWithAllTypedArrayConstructors which can include non-Atomics-compatible
types; change the iteration to use the helper that restricts to
Atomics-compatible integer typed arrays (e.g.
testWithAtomicsTypedArrayConstructors or testWithIntegerTypedArrayConstructors)
so that TA (the typed array under test) and the Atomics.xor(ta, index, value)
call exercise immutable-buffer write validation specifically; keep the rest of
the test (index/value objects and assertions) unchanged.

[github-actions]

Preview Builds

Commit	Release	Date
cf784902	autobuild-preview-pr-248-cf784902	2026-06-04 08:39:54 UTC