test262 regressions introduced by the #5579 fix batch (Object.defineProperty writable + RegExp /u-mode escapes + TypedArray species)

[proggeramlug]

Severity: MEDIUM (fix-batch regressions)

The 2026-06-24 re-measure (main @ 911a97948, node v26.3.0) shows the #5579 fix batch recovered the big regression clusters (overall 90.7% → 93.3%) but introduced 26 fresh test262 failures that passed on the prior run (sweep-0623). Three concrete sub-clusters:

1. Object.defineProperty / defineProperties — "property should be writable" (15)

A property defined with {writable:true} (or default) now reports non-writable. Suspect: #5574 (own valueOf wins in member dispatch), #5588 (Object.assign Proxy), or #5597 (static-method delete).

built-ins/Object/defineProperty/15.2.3.6-4-278.js          Expected obj[property] to be writable, but not
built-ins/Object/defineProperty/15.2.3.6-4-285.js
built-ins/Object/defineProperty/15.2.3.6-4-531-11.js       Expected obj[prop] to be writable
built-ins/Object/defineProperties/15.2.3.7-6-a-267.js
built-ins/Object/defineProperties/15.2.3.7-6-a-274.js   (… 15 total, -267/-268/-274..-277, -278/-279/-285..-288, -531-11/-540-7/-547-3)

2. RegExp unicode-mode restricted escapes — #5594 over-relaxed (2)

#5594 made Annex B legacy escapes (\1 decimal, \c control) valid — but they must still throw SyntaxError under the /u (and /v) flag. The unicode-mode strictness was lost.

built-ins/RegExp/unicode_restricted_octal_escape.js        RegExp("\1","u"): Expected a SyntaxError to be thrown
built-ins/RegExp/unicode_restricted_identity_escape_c.js   Expected a SyntaxError to be thrown

3. TypedArray speciesctor — silent (no output) (4)

%TypedArray%.prototype species-constructor path: a throwing species ctor / callback now produces no output (silent early exit or swallowed throw).

built-ins/TypedArray/prototype/slice/speciesctor-get-ctor-returns-throws.js
built-ins/TypedArray/prototype/map/speciesctor-get-ctor-returns-throws.js
built-ins/TypedArray/prototype/subarray/speciesctor-get-ctor-returns-throws.js
built-ins/TypedArray/prototype/every/returns-true-if-every-cb-returns-true.js

Plus misc: Array.prototype.copyWithin coerced-values, Collator phonebook ordering, DateTimeFormat calendar fallback, an optional-chaining missed-negative.

Measure

scripts/test262_subset.py --root /root/test262 --dir built-ins language intl402 annexB --jobs 6

on the internal Linux sweep host. Reproduce the set by diffing the .failures.txt sidecar against the prior known-good sweep.

Separate from the ~179 residual #5579 eval-code/indirect + annexB-global-eval cases (tracked on #5579) — those were already failing before this batch; the 26 here are net-new.

[proggeramlug]

Partially fixed by #5628. Targeted re-measure 2026-06-24 (main @ c72302d7e) of the affected dirs — of the 22 cases that fell in swept dirs, 17 now pass, 5 still fail:

• ✅ Object.defineProperty / defineProperties "should be writable" (15) — fixed (array own-accessor setter dispatch).
• ✅ RegExp /u-mode legacy escapes (2) — fixed (\1 / \c now correctly throw SyntaxError under /u).
• ❌ TypedArray speciesctor (4) — still (no output): slice / map / subarray speciesctor-get-ctor-returns-throws, and every/returns-true-if-every-cb-returns-true.
• ❌ Array.prototype.copyWithin coerced-values-start-change-start (1) — still failing.

(The other 4 of the original 26 — Collator / DateTimeFormat / DurationFormat / optional-chaining — were outside the swept dirs and not re-checked here.)

Keeping open for the TypedArray species-constructor path (a throwing species ctor is swallowed → silent no-output) + the copyWithin case.

[proggeramlug]

Re-measure 2026-06-25 (main @ 9a3d246): the 4 TypedArray speciesctor cases now pass — only 1 left: built-ins/Array/prototype/copyWithin/coerced-values-start-change-start.js. (Object-writable + RegExp /u-mode were fixed earlier by #5628.) Nearly done.

[proggeramlug]

Resolved by #5673 (resolve forwarded grown-array prototype in copyWithin inherited-index reads). Re-measure 2026-06-26 (main @ c56e566): the last case (copyWithin/coerced-values-start-change-start.js) now passes. All of #5625 (Object-writable #5628, RegExp /u-mode #5628, TypedArray speciesctor, Array copyWithin #5673) is fixed. Closing.