diff --git a/Cargo.lock b/Cargo.lock
index 1220f972..45da668a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1275,6 +1275,7 @@ version = "0.1.0"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
+ "oxide_compiler",
  "oxide_dce",
  "oxide_emit",
  "oxide_ir",
diff --git a/crates/oxide_builtins/src/iterator.rs b/crates/oxide_builtins/src/iterator.rs
index 6107573f..963dbe90 100644
--- a/crates/oxide_builtins/src/iterator.rs
+++ b/crates/oxide_builtins/src/iterator.rs
@@ -353,7 +353,8 @@ fn is_typed_array_value(value: JsValue) -> bool {
     !ptr.is_null() && unsafe { &*ptr }.is_typed_array_obj()
 }
 
-fn is_callable(value: JsValue) -> bool {
+/// 判断值是否为可调用对象（native 或字节码函数）。
+pub(crate) fn is_callable(value: JsValue) -> bool {
     if !value.is_object() {
         return false;
     }
@@ -361,6 +362,86 @@ fn is_callable(value: JsValue) -> bool {
     !ptr.is_null() && unsafe { &*ptr }.is_function()
 }
 
+/// 把 `call_function_sync` 返回的 `Err` 文本恢复为原始异常值；
+/// 无保留的 uncaught 值时回退为普通 TypeError。
+pub(crate) fn engine_error<H: VmHost>(vm: &mut H, err: &str) -> JsValue {
+    vm.take_uncaught_value()
+        .unwrap_or_else(|| crate::error::create_type_error(vm, err))
+}
+
+/// IteratorClose：异常退出时调用迭代器包装器的 `return()`（转发给内层迭代器），
+/// 丢弃 return 自身抛出的错误，保留在途异常。
+pub(crate) fn close_iterator<H: VmHost>(vm: &mut H, iterator: JsValue) {
+    if !iterator.is_object() {
+        return;
+    }
+    let iter_obj = unsafe { &*iterator.as_js_object_ptr() };
+    let return_si = vm.kernel_core().perm_interner().intern("return").0;
+    if let Ok(ret) = vm.ordinary_get(iter_obj, return_si, iterator) {
+        if is_callable(ret) {
+            let _ = vm.call_function_sync(ret, iterator, &[]);
+        }
+    }
+}
+
+/// 遍历可迭代值，把每个元素交给 `on_elem`。
+///
+/// # 步骤
+/// 1. 经迭代协议取迭代器包装器，逐次 `next` 读取 `{done, value}`。
+/// 2. 每个元素调用 `on_elem`；元素读取或回调抛错时先 IteratorClose 再透传原异常。
+///
+/// # 返回值
+/// - `Ok(())`：迭代完成；
+/// - `Err`：迭代或回调抛出的原异常值（任意类型）。
+pub(crate) fn iterate_elements<H: VmHost, F>(vm: &mut H, iterable: JsValue, mut on_elem: F) -> Result<(), JsValue>
+where
+    F: FnMut(&mut H, JsValue) -> Result<(), JsValue>,
+{
+    let iterator = make_iterator_for_value(vm, iterable)?;
+    iterate_iterator(vm, iterator, &mut on_elem)
+}
+
+/// 遍历一个已取得的迭代器对象（带 `next`），把每个元素交给 `on_elem`。
+/// 与 [`iterate_elements`] 的差异：入参是迭代器本身而非可迭代值，
+/// 用于 Set 方法从 SetRecord 的 `keys` 方法返回值继续取元素。
+///
+/// # 副作用
+/// 迭代或回调抛错时调用迭代器的 `return()`（IteratorClose）后透传原异常。
+pub(crate) fn iterate_iterator<H: VmHost, F>(vm: &mut H, iterator: JsValue, mut on_elem: F) -> Result<(), JsValue>
+where
+    F: FnMut(&mut H, JsValue) -> Result<(), JsValue>,
+{
+    let next_si = vm.kernel_core().perm_interner().intern("next").0;
+    let done_si = vm.kernel_core().perm_interner().intern("done").0;
+    let value_si = vm.kernel_core().perm_interner().intern("value").0;
+    let run: Result<(), JsValue> = (|| {
+        loop {
+            let iter_obj = unsafe { &*iterator.as_js_object_ptr() };
+            let next_fn = vm.ordinary_get(iter_obj, next_si, iterator).map_err(|e| engine_error(vm, &e))?;
+            let result = vm
+                .call_function_sync(next_fn, iterator, &[])
+                .map_err(|e| engine_error(vm, &e))?;
+            if !result.is_object() {
+                return Err(crate::error::create_type_error(vm, "iterator result is not an object"));
+            }
+            let result_obj = unsafe { &*result.as_js_object_ptr() };
+            let done = vm.ordinary_get(result_obj, done_si, result).map_err(|e| engine_error(vm, &e))?;
+            if oxide_runtime_api::to_boolean(done) {
+                break;
+            }
+            let elem = vm
+                .ordinary_get(result_obj, value_si, result)
+                .map_err(|e| engine_error(vm, &e))?;
+            on_elem(vm, elem)?;
+        }
+        Ok(())
+    })();
+    if run.is_err() {
+        close_iterator(vm, iterator);
+    }
+    run
+}
+
 fn is_map_value(value: JsValue) -> bool {
     if !value.is_object() {
         return false;
@@ -442,7 +523,12 @@ fn map_set_step<H: VmHost>(
             };
             make_iter_result(vm, value, false)
         }
-        None => make_iter_result(vm, JsValue::undefined(), true),
+        None => {
+            // 迭代器已耗尽：把下标推进到永不匹配的哨兵值，使后续 next() 恒返回 done，
+            // 即使集合之后又新增元素也不会"复活"。
+            vm.set_or_create_prop_value(wrapper, index_si, JsValue::int(i32::MAX));
+            make_iter_result(vm, JsValue::undefined(), true)
+        }
     }
 }
 
diff --git a/crates/oxide_builtins/src/map.rs b/crates/oxide_builtins/src/map.rs
index fc4ae64c..b7a3bddb 100644
--- a/crates/oxide_builtins/src/map.rs
+++ b/crates/oxide_builtins/src/map.rs
@@ -150,10 +150,92 @@ pub fn drop_map_native(obj: &mut JsObject) -> u64 {
     }
 }
 
-/// `Map` 构造函数：创建带空 IndexMap native 数据的 Map 对象。
-pub fn map_constructor<H: VmHost>(vm: &mut H, _args: &[u8]) -> NativeResult {
+/// `Map` 构造函数：创建带空 IndexMap native 数据的 Map 对象，若提供可迭代实参
+/// 则逐元素（须为对象）取 `[0]`/`[1]` 作为键值调用 set。
+///
+/// # 步骤
+/// 1. 校验 NewTarget：`this` 的原型须是 Map.prototype（普通调用 `Map()` 抛 TypeError）。
+/// 2. 创建空 Map。
+/// 3. 取 adder = Get(map, "set")，要求可调用（否则 TypeError）。
+/// 4. 对可迭代实参逐元素：元素须为对象（否则 TypeError），读 `0`/`1` 属性后调用 adder。
+///
+/// # 边界与前提
+/// - 无实参或实参为 null/undefined 时返回空 Map，不触碰 adder。
+/// - 任一环节抛错先 IteratorClose 再透传。
+pub fn map_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let is_new_call = this_val.is_object() && {
+        let map_proto = vm.session().builtin_world().map_proto.as_ptr() as *mut JsObject;
+        // 沿原型链查找 Map.prototype：`new Map()` 直接命中，子类 `super()` 经
+        // 子类 prototype 链命中；普通调用（global/undefined）不命中。
+        let this_ptr = this_val.as_js_object_ptr();
+        if this_ptr.is_null() {
+            false
+        } else {
+            let mut proto = unsafe { &*this_ptr }.proto();
+            let mut found = false;
+            for _ in 0..16 {
+                if !proto.is_object() {
+                    break;
+                }
+                let proto_ptr = proto.as_js_object_ptr();
+                if proto_ptr.is_null() {
+                    break;
+                }
+                if std::ptr::eq(proto_ptr, map_proto) {
+                    found = true;
+                    break;
+                }
+                proto = unsafe { &*proto_ptr }.proto();
+            }
+            found
+        }
+    };
+    if !is_new_call {
+        return NativeResult::Err(crate::error::create_type_error(vm, "Map must be called with new"));
+    }
+
     let map_obj = alloc_map(vm);
-    NativeResult::Ok(JsValue::from_js_object(map_obj))
+    let map_val = JsValue::from_js_object(map_obj);
+
+    if args.len() > 1 {
+        let iterable = vm.reg(args[1]);
+        if !iterable.is_undefined() && !iterable.is_null() {
+            let map_ref = unsafe { &*map_obj };
+            let set_si = vm.kernel_core().perm_interner().intern("set").0;
+            let adder = match vm.ordinary_get(map_ref, set_si, map_val) {
+                Ok(v) => v,
+                Err(err) => return NativeResult::Err(crate::iterator::engine_error(vm, &err)),
+            };
+            if !crate::iterator::is_callable(adder) {
+                return NativeResult::Err(crate::error::create_type_error(vm, "Map.set is not callable"));
+            }
+            let key_si = vm.kernel_core().perm_interner().intern("0").0;
+            let value_si = vm.kernel_core().perm_interner().intern("1").0;
+            if let Err(err) = crate::iterator::iterate_elements(vm, iterable, |vm, item| {
+                if !item.is_object() {
+                    return Err(crate::error::create_type_error(vm, "iterator value is not an entry object"));
+                }
+                let item_obj = unsafe { &*item.as_js_object_ptr() };
+                let k = match vm.ordinary_get(item_obj, key_si, item) {
+                    Ok(v) => v,
+                    Err(err) => return Err(crate::iterator::engine_error(vm, &err)),
+                };
+                let v = match vm.ordinary_get(item_obj, value_si, item) {
+                    Ok(v) => v,
+                    Err(err) => return Err(crate::iterator::engine_error(vm, &err)),
+                };
+                match vm.call_function_sync(adder, map_val, &[k, v]) {
+                    Ok(_) => Ok(()),
+                    Err(err) => Err(crate::iterator::engine_error(vm, &err)),
+                }
+            }) {
+                return NativeResult::Err(err);
+            }
+        }
+    }
+
+    NativeResult::Ok(map_val)
 }
 
 /// `Map.prototype.set(key, value)`：插入/更新键值对，返回 this。
@@ -205,6 +287,29 @@ pub fn map_clear<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     NativeResult::Ok(JsValue::undefined())
 }
 
+/// `Map.prototype.forEach(callbackfn, thisArg)`：按插入序对每个键值对调用回调，
+/// 回调参数为 `(value, key, map)`。迭代期间新增的键值对也会被访问。
+pub fn map_for_each<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let inner = native_try!(get_map_inner(vm, this_val));
+    let callback = vm.reg(if args.len() > 1 { args[1] } else { 0 });
+    if !crate::iterator::is_callable(callback) {
+        return NativeResult::Err(crate::error::create_type_error(vm, "callback is not a function"));
+    }
+    let this_arg = if args.len() > 2 { vm.reg(args[2]) } else { JsValue::undefined() };
+    // 按下标迭代：每次回调后重新读当前下标（支持迭代期间插入）。
+    let mut index = 0usize;
+    loop {
+        let entry = unsafe { (*inner).get_index(index).map(|(key, value)| (key.0, *value)) };
+        let Some((key, value)) = entry else { break };
+        index += 1;
+        if let Err(err) = vm.call_function_sync(callback, this_arg, &[value, key, this_val]) {
+            return NativeResult::Err(crate::iterator::engine_error(vm, &err));
+        }
+    }
+    NativeResult::Ok(JsValue::undefined())
+}
+
 /// `Map.prototype.size` getter：返回键值对数量。
 pub fn map_size<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
diff --git a/crates/oxide_builtins/src/set.rs b/crates/oxide_builtins/src/set.rs
index 01b492d7..86ee058d 100644
--- a/crates/oxide_builtins/src/set.rs
+++ b/crates/oxide_builtins/src/set.rs
@@ -20,20 +20,32 @@ macro_rules! native_try {
 #[derive(Clone, Copy)]
 pub struct SetKey(pub JsValue);
 
+/// 把 int/double 数值统一归一化为可比较的位模式：NaN 用专属哨兵、±0 归 +0，
+/// 使 `0`(int) 与 `0.0`/`-0.0`(double) 视为同一键，且 NaN 与任何数值都不同。
+fn numeric_key_bits(val: JsValue) -> Option<u64> {
+    let d = if val.is_int() {
+        val.as_int() as f64
+    } else if val.is_double() {
+        val.as_double()
+    } else {
+        return None;
+    };
+    if d.is_nan() {
+        // 哨兵必须避开 0 与所有合法 f64 位模式碰撞（f64 位模式永不为 1）。
+        Some(1)
+    } else if d == 0.0 {
+        Some(0.0f64.to_bits())
+    } else {
+        Some(d.to_bits())
+    }
+}
+
 impl PartialEq for SetKey {
     fn eq(&self, other: &Self) -> bool {
-        if self.0.is_double() && other.0.is_double() {
-            let a = self.0.as_double();
-            let b = other.0.as_double();
-            if a.is_nan() && b.is_nan() {
-                return true;
-            }
-            if a == 0.0 && b == 0.0 {
-                return true;
-            }
+        if let (Some(a), Some(b)) = (numeric_key_bits(self.0), numeric_key_bits(other.0)) {
             return a == b;
         }
-        // SAFETY: JsValue 是 8 字节 NaN-box Copy 值；此处以原始位定义非 double 值的同一性。
+        // SAFETY: JsValue 是 8 字节 NaN-box Copy 值；此处以原始位定义非数值值的同一性。
         unsafe { std::mem::transmute::<JsValue, u64>(self.0) == std::mem::transmute::<JsValue, u64>(other.0) }
     }
 }
@@ -42,15 +54,8 @@ impl Eq for SetKey {}
 
 impl Hash for SetKey {
     fn hash<H: Hasher>(&self, state: &mut H) {
-        if self.0.is_double() {
-            let d = self.0.as_double();
-            if d.is_nan() {
-                0u64.hash(state);
-            } else if d == 0.0 {
-                0.0f64.to_bits().hash(state);
-            } else {
-                d.to_bits().hash(state);
-            }
+        if let Some(bits) = numeric_key_bits(self.0) {
+            bits.hash(state);
         } else {
             // SAFETY: JsValue 是 8 字节 NaN-box Copy 值；哈希原始位与上面的相等判定一致。
             unsafe { std::mem::transmute::<JsValue, u64>(self.0).hash(state) }
@@ -186,10 +191,77 @@ pub fn drop_set_native(obj: &mut JsObject) -> u64 {
     }
 }
 
-/// `Set` 构造函数：创建带空 IndexSet native 数据的 Set 对象。
-pub fn set_constructor<H: VmHost>(vm: &mut H, _args: &[u8]) -> NativeResult {
+/// `Set` 构造函数：创建带空 IndexSet native 数据的 Set 对象，若提供可迭代实参
+/// 则按插入序逐个 add。
+///
+/// # 步骤
+/// 1. 校验 NewTarget：`this` 的原型须是 Set.prototype（普通调用 `Set()` 抛 TypeError）。
+/// 2. 创建空 Set。
+/// 3. 取 adder = Get(set, "add")，要求可调用（否则 TypeError）。
+/// 4. 对可迭代实参逐元素调用 adder（异常时先 IteratorClose 再透传）。
+///
+/// # 边界与前提
+/// - 无实参或实参为 null/undefined 时返回空 Set，不触碰 adder。
+pub fn set_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let is_new_call = this_val.is_object() && {
+        let set_proto = vm.session().builtin_world().set_proto.as_ptr() as *mut JsObject;
+        // 沿原型链查找 Set.prototype：`new Set()` 直接命中，子类 `super()` 经
+        // 子类 prototype 链命中；普通调用（global/undefined）不命中。
+        let this_ptr = this_val.as_js_object_ptr();
+        if this_ptr.is_null() {
+            false
+        } else {
+            let mut proto = unsafe { &*this_ptr }.proto();
+            let mut found = false;
+            for _ in 0..16 {
+                if !proto.is_object() {
+                    break;
+                }
+                let proto_ptr = proto.as_js_object_ptr();
+                if proto_ptr.is_null() {
+                    break;
+                }
+                if std::ptr::eq(proto_ptr, set_proto) {
+                    found = true;
+                    break;
+                }
+                proto = unsafe { &*proto_ptr }.proto();
+            }
+            found
+        }
+    };
+    if !is_new_call {
+        return NativeResult::Err(crate::error::create_type_error(vm, "Set must be called with new"));
+    }
+
     let set_obj = alloc_set(vm);
-    NativeResult::Ok(JsValue::from_js_object(set_obj))
+    let set_val = JsValue::from_js_object(set_obj);
+
+    if args.len() > 1 {
+        let iterable = vm.reg(args[1]);
+        if !iterable.is_undefined() && !iterable.is_null() {
+            let set_ref = unsafe { &*set_obj };
+            let add_si = vm.kernel_core().perm_interner().intern("add").0;
+            let adder = match vm.ordinary_get(set_ref, add_si, set_val) {
+                Ok(v) => v,
+                Err(err) => return NativeResult::Err(crate::iterator::engine_error(vm, &err)),
+            };
+            if !crate::iterator::is_callable(adder) {
+                return NativeResult::Err(crate::error::create_type_error(vm, "Set.add is not callable"));
+            }
+            if let Err(err) = crate::iterator::iterate_elements(vm, iterable, |vm, elem| {
+                match vm.call_function_sync(adder, set_val, &[elem]) {
+                    Ok(_) => Ok(()),
+                    Err(err) => Err(crate::iterator::engine_error(vm, &err)),
+                }
+            }) {
+                return NativeResult::Err(err);
+            }
+        }
+    }
+
+    NativeResult::Ok(set_val)
 }
 
 /// `Set.prototype.add(value)`：插入元素，返回 this。
@@ -231,6 +303,29 @@ pub fn set_clear<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     NativeResult::Ok(JsValue::undefined())
 }
 
+/// `Set.prototype.forEach(callbackfn, thisArg)`：按插入序对每个值调用回调，
+/// 回调参数为 `(value, value, set)`。迭代期间新增的元素也会被访问。
+pub fn set_for_each<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let inner = native_try!(get_set_inner(vm, this_val));
+    let callback = vm.reg(if args.len() > 1 { args[1] } else { 0 });
+    if !crate::iterator::is_callable(callback) {
+        return NativeResult::Err(crate::error::create_type_error(vm, "callback is not a function"));
+    }
+    let this_arg = if args.len() > 2 { vm.reg(args[2]) } else { JsValue::undefined() };
+    // 按下标迭代：每次回调后重新读当前下标（支持迭代期间插入）。
+    let mut index = 0usize;
+    loop {
+        let value = unsafe { (*inner).get_index(index).map(|elem| elem.0) };
+        let Some(value) = value else { break };
+        index += 1;
+        if let Err(err) = vm.call_function_sync(callback, this_arg, &[value, value, this_val]) {
+            return NativeResult::Err(crate::iterator::engine_error(vm, &err));
+        }
+    }
+    NativeResult::Ok(JsValue::undefined())
+}
+
 /// `Set.prototype.size` getter：返回元素数量。
 pub fn set_size<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
@@ -271,3 +366,369 @@ pub fn set_keys<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         crate::iterator::set_values_iter_next::<H> as *const (),
     ))
 }
+
+/// SetRecord 协议：读取参数对象的 `size`/`has`/`keys` 并校验。
+///
+/// # 步骤
+/// 1. 参数非对象抛 TypeError。
+/// 2. `size` 经 ToNumber 转换，为 NaN 抛 TypeError。
+/// 3. `has`/`keys` 须可调用，否则抛 TypeError。
+///
+/// # 返回值
+/// `(对象, size, has, keys)`。
+fn get_set_record<H: VmHost>(vm: &mut H, other: JsValue) -> Result<(JsValue, f64, JsValue, JsValue), JsValue> {
+    if !other.is_object() {
+        return Err(crate::error::create_type_error(vm, "argument is not an object"));
+    }
+    let obj = unsafe { &*other.as_js_object_ptr() };
+    let size_si = vm.kernel_core().perm_interner().intern("size").0;
+    let raw_size = vm
+        .ordinary_get(obj, size_si, other)
+        .map_err(|e| crate::iterator::engine_error(vm, &e))?;
+    let num_size = match oxide_runtime_api::to_number_full(raw_size, vm) {
+        Ok(n) => n,
+        Err(err) => return Err(crate::error::create_type_error(vm, &err)),
+    };
+    if num_size.is_nan() {
+        return Err(crate::error::create_type_error(vm, "size must be a number"));
+    }
+    let has_si = vm.kernel_core().perm_interner().intern("has").0;
+    let has = vm
+        .ordinary_get(obj, has_si, other)
+        .map_err(|e| crate::iterator::engine_error(vm, &e))?;
+    if !crate::iterator::is_callable(has) {
+        return Err(crate::error::create_type_error(vm, "has must be callable"));
+    }
+    let keys_si = vm.kernel_core().perm_interner().intern("keys").0;
+    let keys = vm
+        .ordinary_get(obj, keys_si, other)
+        .map_err(|e| crate::iterator::engine_error(vm, &e))?;
+    if !crate::iterator::is_callable(keys) {
+        return Err(crate::error::create_type_error(vm, "keys must be callable"));
+    }
+    Ok((other, num_size, has, keys))
+}
+
+/// 把 -0.0 归一化为 +0.0（集合运算把 `-0𝔽` 当 `+0𝔽` 处理）。
+fn normalize_neg_zero(value: JsValue) -> JsValue {
+    if value.is_double() {
+        let d = value.as_double();
+        if d == 0.0 && d.is_sign_negative() {
+            return JsValue::float(0.0);
+        }
+    }
+    value
+}
+
+/// 用一个已填充的 `SetInner` 创建普通 Set 对象（原型为 Set.prototype）。
+fn alloc_set_with_inner<H: VmHost>(vm: &mut H, inner: SetInner) -> JsValue {
+    let set_proto = vm.session().builtin_world().set_proto.as_ptr() as *mut JsObject;
+    let mut obj = JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(set_proto));
+    obj.set_set(true);
+    obj.set_native_data(Box::into_raw(Box::new(inner)) as *mut u8);
+    JsValue::from_js_object(vm.alloc_object(obj))
+}
+
+/// 回调控制流：`Continue` 继续迭代，`Stop` 提前终止并 IteratorClose。
+enum KeysFlow {
+    Continue,
+    Stop,
+}
+
+/// 调用 SetRecord 的 `keys` 方法取得迭代器并逐元素回调。
+///
+/// # 步骤
+/// 1. `Call(keys, set)` 得迭代器对象（非对象抛 TypeError）。
+/// 2. 逐次 `next` 读取 `{done, value}` 交给 `f`。
+/// 3. 迭代抛错或 `f` 返回 `Stop` 时先 IteratorClose 再返回。
+///
+/// # 返回值
+/// `Ok(Continue)` 迭代耗尽；`Ok(Stop)` 回调提前终止；`Err` 透传异常。
+fn iterate_record_keys<H: VmHost, F>(
+    vm: &mut H, set: JsValue, keys_method: JsValue, mut f: F,
+) -> Result<KeysFlow, JsValue>
+where
+    F: FnMut(&mut H, JsValue) -> Result<KeysFlow, JsValue>,
+{
+    let iter = match vm.call_function_sync(keys_method, set, &[]) {
+        Ok(v) => v,
+        Err(err) => return Err(crate::iterator::engine_error(vm, &err)),
+    };
+    if !iter.is_object() {
+        return Err(crate::error::create_type_error(vm, "keys() result is not an object"));
+    }
+    let next_si = vm.kernel_core().perm_interner().intern("next").0;
+    let done_si = vm.kernel_core().perm_interner().intern("done").0;
+    let value_si = vm.kernel_core().perm_interner().intern("value").0;
+    let mut flow = KeysFlow::Continue;
+    let run: Result<(), JsValue> = (|| {
+        loop {
+            let iter_obj = unsafe { &*iter.as_js_object_ptr() };
+            let next_fn = vm
+                .ordinary_get(iter_obj, next_si, iter)
+                .map_err(|e| crate::iterator::engine_error(vm, &e))?;
+            let result = vm
+                .call_function_sync(next_fn, iter, &[])
+                .map_err(|e| crate::iterator::engine_error(vm, &e))?;
+            if !result.is_object() {
+                return Err(crate::error::create_type_error(vm, "iterator result is not an object"));
+            }
+            let result_obj = unsafe { &*result.as_js_object_ptr() };
+            let done = vm
+                .ordinary_get(result_obj, done_si, result)
+                .map_err(|e| crate::iterator::engine_error(vm, &e))?;
+            if oxide_runtime_api::to_boolean(done) {
+                break;
+            }
+            let value = vm
+                .ordinary_get(result_obj, value_si, result)
+                .map_err(|e| crate::iterator::engine_error(vm, &e))?;
+            flow = f(vm, value)?;
+            if matches!(flow, KeysFlow::Stop) {
+                break;
+            }
+        }
+        Ok(())
+    })();
+    if run.is_err() || matches!(flow, KeysFlow::Stop) {
+        crate::iterator::close_iterator(vm, iter);
+    }
+    run.map(|()| flow)
+}
+
+/// `Set.prototype.union(other)`：返回 this 与 other 的并集（新 Set，顺序为 this 在前）。
+///
+/// # 步骤
+/// 1. 取 SetRecord，复制 this 的 [[SetData]]。
+/// 2. 经 other 的 `keys()` 迭代追加缺失元素，`-0𝔽` 归一化为 `+0𝔽`。
+///
+/// # 注意事项
+/// 只调用 other 的 `keys`，不调用 `has`。
+pub fn set_union<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let inner = native_try!(get_set_inner(vm, this_val));
+    let other = vm.reg(if args.len() > 1 { args[1] } else { 0 });
+    let (rec_set, _size, _has, rec_keys) = match get_set_record(vm, other) {
+        Ok(r) => r,
+        Err(err) => return NativeResult::Err(err),
+    };
+    let mut result: SetInner = unsafe { (*inner).clone() };
+    let flow = match iterate_record_keys(vm, rec_set, rec_keys, |_vm, value| {
+        result.insert(SetKey(normalize_neg_zero(value)));
+        Ok(KeysFlow::Continue)
+    }) {
+        Ok(f) => f,
+        Err(err) => return NativeResult::Err(err),
+    };
+    debug_assert!(matches!(flow, KeysFlow::Continue));
+    NativeResult::Ok(alloc_set_with_inner(vm, result))
+}
+
+/// `Set.prototype.intersection(other)`：返回 this 与 other 的交集（新 Set）。
+///
+/// # 步骤
+/// 1. 取 SetRecord。
+/// 2. this 元素数 ≤ other 时：遍历 this，保留 other 的 `has(e)` 为真的元素（顺序为 this）。
+/// 3. 否则遍历 other 的 `keys()`，保留 this 中含有的元素（顺序为 other）。
+pub fn set_intersection<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let inner = native_try!(get_set_inner(vm, this_val));
+    let other = vm.reg(if args.len() > 1 { args[1] } else { 0 });
+    let (rec_set, rec_size, rec_has, rec_keys) = match get_set_record(vm, other) {
+        Ok(r) => r,
+        Err(err) => return NativeResult::Err(err),
+    };
+    let this_size = unsafe { (*inner).len() } as f64;
+    let mut result = SetInner::new();
+    if this_size <= rec_size {
+        let entries: Vec<JsValue> = unsafe { (*inner).iter().map(|k| k.0).collect() };
+        for e in entries {
+            let in_other = match vm.call_function_sync(rec_has, rec_set, &[e]) {
+                Ok(v) => v,
+                Err(err) => return NativeResult::Err(crate::iterator::engine_error(vm, &err)),
+            };
+            if oxide_runtime_api::to_boolean(in_other) {
+                result.insert(SetKey(e));
+            }
+        }
+    } else {
+        match iterate_record_keys(vm, rec_set, rec_keys, |_vm, value| {
+            let value = normalize_neg_zero(value);
+            if unsafe { (*inner).contains(&SetKey(value)) } {
+                result.insert(SetKey(value));
+            }
+            Ok(KeysFlow::Continue)
+        }) {
+            Ok(_) => {}
+            Err(err) => return NativeResult::Err(err),
+        }
+    }
+    NativeResult::Ok(alloc_set_with_inner(vm, result))
+}
+
+/// `Set.prototype.difference(other)`：返回 this 中不在 other 的元素（新 Set）。
+///
+/// # 步骤
+/// 1. 取 SetRecord。
+/// 2. this 元素数 ≤ other 时：遍历 this，保留 other 的 `has(e)` 为假的元素。
+/// 3. 否则复制 this，经 other 的 `keys()` 逐个移除存在的元素。
+pub fn set_difference<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let inner = native_try!(get_set_inner(vm, this_val));
+    let other = vm.reg(if args.len() > 1 { args[1] } else { 0 });
+    let (rec_set, rec_size, rec_has, rec_keys) = match get_set_record(vm, other) {
+        Ok(r) => r,
+        Err(err) => return NativeResult::Err(err),
+    };
+    let this_size = unsafe { (*inner).len() } as f64;
+    let mut result = SetInner::new();
+    if this_size <= rec_size {
+        let entries: Vec<JsValue> = unsafe { (*inner).iter().map(|k| k.0).collect() };
+        for e in entries {
+            let in_other = match vm.call_function_sync(rec_has, rec_set, &[e]) {
+                Ok(v) => v,
+                Err(err) => return NativeResult::Err(crate::iterator::engine_error(vm, &err)),
+            };
+            if !oxide_runtime_api::to_boolean(in_other) {
+                result.insert(SetKey(e));
+            }
+        }
+    } else {
+        unsafe {
+            for k in (*inner).iter() {
+                result.insert(*k);
+            }
+        }
+        match iterate_record_keys(vm, rec_set, rec_keys, |_vm, value| {
+            result.shift_remove(&SetKey(normalize_neg_zero(value)));
+            Ok(KeysFlow::Continue)
+        }) {
+            Ok(_) => {}
+            Err(err) => return NativeResult::Err(err),
+        }
+    }
+    NativeResult::Ok(alloc_set_with_inner(vm, result))
+}
+
+/// `Set.prototype.symmetricDifference(other)`：返回对称差集（新 Set）。
+///
+/// # 步骤
+/// 1. 取 SetRecord，复制 this 的 [[SetData]]。
+/// 2. 经 other 的 `keys()`：元素已在结果中则移除，否则追加。
+pub fn set_symmetric_difference<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let inner = native_try!(get_set_inner(vm, this_val));
+    let other = vm.reg(if args.len() > 1 { args[1] } else { 0 });
+    let (rec_set, _size, _has, rec_keys) = match get_set_record(vm, other) {
+        Ok(r) => r,
+        Err(err) => return NativeResult::Err(err),
+    };
+    let mut result: SetInner = unsafe { (*inner).clone() };
+    match iterate_record_keys(vm, rec_set, rec_keys, |_vm, value| {
+        let key = SetKey(normalize_neg_zero(value));
+        if result.shift_remove(&key) {
+            // 已在结果中（交集部分）→ 移除。
+        } else {
+            result.insert(key);
+        }
+        Ok(KeysFlow::Continue)
+    }) {
+        Ok(_) => {}
+        Err(err) => return NativeResult::Err(err),
+    }
+    NativeResult::Ok(alloc_set_with_inner(vm, result))
+}
+
+/// `Set.prototype.isSubsetOf(other)`：this 的每个元素都在 other 中。
+/// this 元素数 > other 的 size 时直接返回 false；否则遍历 this 调 other 的 `has`。
+pub fn set_is_subset_of<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let inner = native_try!(get_set_inner(vm, this_val));
+    let other = vm.reg(if args.len() > 1 { args[1] } else { 0 });
+    let (rec_set, rec_size, rec_has, _rec_keys) = match get_set_record(vm, other) {
+        Ok(r) => r,
+        Err(err) => return NativeResult::Err(err),
+    };
+    if (unsafe { (*inner).len() }) as f64 > rec_size {
+        return NativeResult::Ok(JsValue::bool(false));
+    }
+    let entries: Vec<JsValue> = unsafe { (*inner).iter().map(|k| k.0).collect() };
+    for e in entries {
+        let in_other = match vm.call_function_sync(rec_has, rec_set, &[e]) {
+            Ok(v) => v,
+            Err(err) => return NativeResult::Err(crate::iterator::engine_error(vm, &err)),
+        };
+        if !oxide_runtime_api::to_boolean(in_other) {
+            return NativeResult::Ok(JsValue::bool(false));
+        }
+    }
+    NativeResult::Ok(JsValue::bool(true))
+}
+
+/// `Set.prototype.isSupersetOf(other)`：other 的每个元素都在 this 中。
+/// this 元素数 < other 的 size 时直接返回 false；否则经 other 的 `keys()` 逐元素
+/// 检查，提前发现不在时终止并 IteratorClose。
+pub fn set_is_superset_of<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let inner = native_try!(get_set_inner(vm, this_val));
+    let other = vm.reg(if args.len() > 1 { args[1] } else { 0 });
+    let (rec_set, rec_size, _has, rec_keys) = match get_set_record(vm, other) {
+        Ok(r) => r,
+        Err(err) => return NativeResult::Err(err),
+    };
+    if ((unsafe { (*inner).len() }) as f64) < rec_size {
+        return NativeResult::Ok(JsValue::bool(false));
+    }
+    let flow = match iterate_record_keys(vm, rec_set, rec_keys, |_vm, value| {
+        if !unsafe { (*inner).contains(&SetKey(normalize_neg_zero(value))) } {
+            Ok(KeysFlow::Stop)
+        } else {
+            Ok(KeysFlow::Continue)
+        }
+    }) {
+        Ok(f) => f,
+        Err(err) => return NativeResult::Err(err),
+    };
+    NativeResult::Ok(JsValue::bool(matches!(flow, KeysFlow::Continue)))
+}
+
+/// `Set.prototype.isDisjointFrom(other)`：this 与 other 无公共元素。
+/// this 元素数 ≤ other 时遍历 this 调 other 的 `has`；否则遍历 other 的 `keys()`。
+pub fn set_is_disjoint_from<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
+    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let inner = native_try!(get_set_inner(vm, this_val));
+    let other = vm.reg(if args.len() > 1 { args[1] } else { 0 });
+    let (rec_set, rec_size, rec_has, rec_keys) = match get_set_record(vm, other) {
+        Ok(r) => r,
+        Err(err) => return NativeResult::Err(err),
+    };
+    let this_size = unsafe { (*inner).len() } as f64;
+    let disjoint = if this_size <= rec_size {
+        let entries: Vec<JsValue> = unsafe { (*inner).iter().map(|k| k.0).collect() };
+        let mut disjoint = true;
+        for e in entries {
+            let in_other = match vm.call_function_sync(rec_has, rec_set, &[e]) {
+                Ok(v) => v,
+                Err(err) => return NativeResult::Err(crate::iterator::engine_error(vm, &err)),
+            };
+            if oxide_runtime_api::to_boolean(in_other) {
+                disjoint = false;
+                break;
+            }
+        }
+        disjoint
+    } else {
+        match iterate_record_keys(vm, rec_set, rec_keys, |_vm, value| {
+            if unsafe { (*inner).contains(&SetKey(normalize_neg_zero(value))) } {
+                Ok(KeysFlow::Stop)
+            } else {
+                Ok(KeysFlow::Continue)
+            }
+        }) {
+            Ok(KeysFlow::Continue) => true,
+            Ok(KeysFlow::Stop) => false,
+            Err(err) => return NativeResult::Err(err),
+        }
+    };
+    NativeResult::Ok(JsValue::bool(disjoint))
+}
diff --git a/crates/oxide_vm/src/bindings/bind_map.rs b/crates/oxide_vm/src/bindings/bind_map.rs
index bd4acff7..93e29dae 100644
--- a/crates/oxide_vm/src/bindings/bind_map.rs
+++ b/crates/oxide_vm/src/bindings/bind_map.rs
@@ -1,7 +1,7 @@
 use std::sync::Arc;
 
 use crate::bind_constructor;
-use crate::bindings::{apply_binding_table, configure_native_constructor};
+use crate::bindings::{apply_binding_table, bind_accessor_getter, bind_method_alias, configure_native_constructor};
 use oxide_kernel::kernel::{KernelCore, KernelSession};
 use oxide_types::object::JsObject;
 
@@ -14,6 +14,7 @@ pub fn bind_map(core: &Arc<KernelCore>, session: &KernelSession, global: &mut Js
     configure_native_constructor(ctor, oxide_builtins::map::map_constructor::<crate::vm::Vm> as *const (), 1);
     let proto = unsafe { &mut *proto_ptr };
 
+    // size 是访问器 getter，不进 apply_binding_table。
     apply_binding_table(
         session.builtin_world(),
         proto,
@@ -24,12 +25,16 @@ pub fn bind_map(core: &Arc<KernelCore>, session: &KernelSession, global: &mut Js
             ("has", oxide_builtins::map::map_has::<crate::vm::Vm> as *const (), 1),
             ("delete", oxide_builtins::map::map_delete::<crate::vm::Vm> as *const (), 1),
             ("clear", oxide_builtins::map::map_clear::<crate::vm::Vm> as *const (), 0),
-            ("size", oxide_builtins::map::map_size::<crate::vm::Vm> as *const (), 0),
+            ("forEach", oxide_builtins::map::map_for_each::<crate::vm::Vm> as *const (), 1),
             ("entries", oxide_builtins::map::map_entries::<crate::vm::Vm> as *const (), 0),
             ("values", oxide_builtins::map::map_values::<crate::vm::Vm> as *const (), 0),
             ("keys", oxide_builtins::map::map_keys::<crate::vm::Vm> as *const (), 0),
         ],
     );
 
+    // Map 的 @@iterator 是 entries 的同一函数对象。
+    bind_method_alias(core, proto, "entries", "@@iterator");
+    bind_accessor_getter(core, session, proto, "size", oxide_builtins::map::map_size::<crate::vm::Vm> as *const ());
+
     bind_constructor!(core, global, "Map", ctor_ptr, oxide_builtins::map::map_constructor::<crate::vm::Vm>, 1, hash: true);
 }
diff --git a/crates/oxide_vm/src/bindings/bind_set.rs b/crates/oxide_vm/src/bindings/bind_set.rs
index ebe74021..4094823f 100644
--- a/crates/oxide_vm/src/bindings/bind_set.rs
+++ b/crates/oxide_vm/src/bindings/bind_set.rs
@@ -1,7 +1,7 @@
 use std::sync::Arc;
 
 use crate::bind_constructor;
-use crate::bindings::{apply_binding_table, configure_native_constructor};
+use crate::bindings::{apply_binding_table, bind_accessor_getter, bind_method_alias, configure_native_constructor};
 use oxide_kernel::kernel::{KernelCore, KernelSession};
 use oxide_types::object::JsObject;
 
@@ -14,6 +14,7 @@ pub fn bind_set(core: &Arc<KernelCore>, session: &KernelSession, global: &mut Js
     configure_native_constructor(ctor, oxide_builtins::set::set_constructor::<crate::vm::Vm> as *const (), 1);
     let proto = unsafe { &mut *proto_ptr };
 
+    // size 是访问器 getter，不进 apply_binding_table。
     apply_binding_table(
         session.builtin_world(),
         proto,
@@ -23,12 +24,31 @@ pub fn bind_set(core: &Arc<KernelCore>, session: &KernelSession, global: &mut Js
             ("has", oxide_builtins::set::set_has::<crate::vm::Vm> as *const (), 1),
             ("delete", oxide_builtins::set::set_delete::<crate::vm::Vm> as *const (), 1),
             ("clear", oxide_builtins::set::set_clear::<crate::vm::Vm> as *const (), 0),
-            ("size", oxide_builtins::set::set_size::<crate::vm::Vm> as *const (), 0),
+            ("forEach", oxide_builtins::set::set_for_each::<crate::vm::Vm> as *const (), 1),
             ("entries", oxide_builtins::set::set_entries::<crate::vm::Vm> as *const (), 0),
             ("values", oxide_builtins::set::set_values::<crate::vm::Vm> as *const (), 0),
-            ("keys", oxide_builtins::set::set_keys::<crate::vm::Vm> as *const (), 0),
+            ("union", oxide_builtins::set::set_union::<crate::vm::Vm> as *const (), 1),
+            ("intersection", oxide_builtins::set::set_intersection::<crate::vm::Vm> as *const (), 1),
+            ("difference", oxide_builtins::set::set_difference::<crate::vm::Vm> as *const (), 1),
+            (
+                "symmetricDifference",
+                oxide_builtins::set::set_symmetric_difference::<crate::vm::Vm> as *const (),
+                1,
+            ),
+            ("isSubsetOf", oxide_builtins::set::set_is_subset_of::<crate::vm::Vm> as *const (), 1),
+            ("isSupersetOf", oxide_builtins::set::set_is_superset_of::<crate::vm::Vm> as *const (), 1),
+            (
+                "isDisjointFrom",
+                oxide_builtins::set::set_is_disjoint_from::<crate::vm::Vm> as *const (),
+                1,
+            ),
         ],
     );
 
+    // keys 与 @@iterator 是 values 的同一函数对象。
+    bind_method_alias(core, proto, "values", "keys");
+    bind_method_alias(core, proto, "values", "@@iterator");
+    bind_accessor_getter(core, session, proto, "size", oxide_builtins::set::set_size::<crate::vm::Vm> as *const ());
+
     bind_constructor!(core, global, "Set", ctor_ptr, oxide_builtins::set::set_constructor::<crate::vm::Vm>, 1, hash: true);
 }
diff --git a/crates/oxide_vm/src/bindings/mod.rs b/crates/oxide_vm/src/bindings/mod.rs
index ae990172..65e4e5a6 100644
--- a/crates/oxide_vm/src/bindings/mod.rs
+++ b/crates/oxide_vm/src/bindings/mod.rs
@@ -51,7 +51,7 @@ use oxide_kernel::builtin::BuiltinWorld;
 use oxide_kernel::kernel::{BuiltinDirtySet, KernelCore, KernelSession};
 use oxide_kernel::shape_forge::EMPTY_SHAPE_ID;
 use oxide_types::mem::P;
-use oxide_types::object::{JsObject, NativeFnPtr};
+use oxide_types::object::{JsObject, NativeFnPtr, PropAttributes};
 use oxide_types::value::JsValue;
 
 #[macro_export]
@@ -108,6 +108,74 @@ pub(crate) fn apply_binding_table(
     }
 }
 
+/// 在原型上绑定一个原生访问器 getter（如 Set/Map 的 `size`），set 恒为 undefined。
+///
+/// # 步骤
+/// 1. 构造一个 native getter 函数对象（name 为 `get <prop>`，length 0）。
+/// 2. 为属性名开 shape 槽位并写入访问器 meta。
+///
+/// # 注意事项
+/// getter 函数对象经 `Box::into_raw` 持有，与 `bind_method` 的方法 wrapper 同一生命周期约定
+/// （内置对象在 session 生命周期内不被回收）。
+pub(crate) fn bind_accessor_getter(
+    core: &Arc<KernelCore>, session: &KernelSession, proto: &mut JsObject, name: &str, getter_fn: *const (),
+) {
+    let shape_forge = core.shape_forge().as_ref();
+    let string_forge = core.perm_interner().as_ref();
+    let fn_proto_val = JsValue::from_js_object(session.builtin_world().function_proto.as_ptr() as *mut JsObject);
+
+    let getter_name = format!("get {name}");
+    let mut getter = Box::new(JsObject::new_empty(EMPTY_SHAPE_ID, fn_proto_val));
+    getter.set_function(true);
+    // SAFETY: getter_fn 是转成 *const () 的 NativeFn 函数项指针。
+    getter.set_native_fn(Some(unsafe { oxide_types::object::NativeFnPtr::from_raw(getter_fn) }));
+    getter.set_native_arg_count(0);
+
+    let si_name = string_forge.intern("name").0;
+    let name_shape = shape_forge.make_shape(getter.shape_id(), si_name);
+    getter.set_shape_id(name_shape);
+    getter
+        .ensure_hash_props()
+        .push(JsValue::perm_string(string_forge.string_ptr(string_forge.intern(&getter_name).0)));
+    let name_pos = getter.hash_props_vec().map_or(0, |v| v.len() as u32).saturating_sub(1);
+    getter.set_data_meta(name_pos, PropAttributes::new(false, false, true));
+
+    let si_length = string_forge.intern("length").0;
+    let length_shape = shape_forge.make_shape(getter.shape_id(), si_length);
+    getter.set_shape_id(length_shape);
+    getter.ensure_hash_props().push(JsValue::int(0));
+    let length_pos = getter.hash_props_vec().map_or(0, |v| v.len() as u32).saturating_sub(1);
+    getter.set_data_meta(length_pos, PropAttributes::new(false, false, true));
+
+    let getter_val = JsValue::from_js_object(Box::into_raw(getter));
+
+    let si = string_forge.intern(name).0;
+    let new_shape = shape_forge.make_shape(proto.shape_id(), si);
+    proto.set_shape_id(new_shape);
+    let pos = proto.push_prop(JsValue::undefined());
+    proto.set_accessor_meta(pos, getter_val, JsValue::undefined(), PropAttributes::new(true, false, true));
+    proto.bump_generation();
+}
+
+/// 把原型上 `source` 属性已绑定的函数值复制到 `alias` 名下（共享同一函数对象）。
+///
+/// 用于规范要求的方法别名（如 Set 的 `keys`/`@@iterator` 与 `values` 同一函数对象）。
+pub(crate) fn bind_method_alias(core: &Arc<KernelCore>, proto: &mut JsObject, source: &str, alias: &str) {
+    let shape_forge = core.shape_forge().as_ref();
+    let string_forge = core.perm_interner().as_ref();
+    let src_si = string_forge.intern(source).0;
+    let Some(pos) = shape_forge.lookup_position(proto.shape_id(), src_si) else {
+        return;
+    };
+    let value = proto.get_prop_at(pos);
+    let alias_si = string_forge.intern(alias).0;
+    let new_shape = shape_forge.make_shape(proto.shape_id(), alias_si);
+    proto.set_shape_id(new_shape);
+    let alias_pos = proto.push_prop(value);
+    proto.set_data_meta(alias_pos, PropAttributes::new(true, false, true));
+    proto.bump_generation();
+}
+
 pub(crate) fn bind_global_value(core: &Arc<KernelCore>, global: &mut JsObject, name: &str, value: JsValue) {
     let si = core.perm_interner().intern(name).0;
     let shape = core.shape_forge().make_shape(global.shape_id(), si);
diff --git a/crates/oxide_vm/src/session_gc.rs b/crates/oxide_vm/src/session_gc.rs
index 54c5e887..23ae0f77 100644
--- a/crates/oxide_vm/src/session_gc.rs
+++ b/crates/oxide_vm/src/session_gc.rs
@@ -710,6 +710,30 @@ mod tests {
         }
     }
 
+    /// 分配一个原型指向 Map.prototype 的占位对象并写入寄存器，作为构造器调用的 `this`。
+    fn map_this(vm: &mut Vm, reg: u8) -> JsValue {
+        let proto = vm.session.builtin_world().map_proto.as_ptr() as *mut JsObject;
+        let obj = vm.epoch.alloc(JsObject::new_empty(
+            oxide_kernel::shape_forge::EMPTY_SHAPE_ID,
+            JsValue::from_js_object(proto),
+        ));
+        let val = JsValue::from_js_object(obj);
+        vm.regs[reg as usize] = val;
+        val
+    }
+
+    /// 分配一个原型指向 Set.prototype 的占位对象并写入寄存器，作为构造器调用的 `this`。
+    fn set_this(vm: &mut Vm, reg: u8) -> JsValue {
+        let proto = vm.session.builtin_world().set_proto.as_ptr() as *mut JsObject;
+        let obj = vm.epoch.alloc(JsObject::new_empty(
+            oxide_kernel::shape_forge::EMPTY_SHAPE_ID,
+            JsValue::from_js_object(proto),
+        ));
+        let val = JsValue::from_js_object(obj);
+        vm.regs[reg as usize] = val;
+        val
+    }
+
     #[test]
     fn reset_maybe_collect_collects_after_threshold() {
         let mut vm = vm_with_low_threshold();
@@ -770,7 +794,8 @@ mod tests {
     #[test]
     fn map_native_storage_is_not_a_normal_object_edge() {
         let mut vm = Vm::new();
-        let map_value = native_ok(map::map_constructor(&mut vm, &[]));
+        map_this(&mut vm, 1);
+        let map_value = native_ok(map::map_constructor(&mut vm, &[1]));
         let map_obj = unsafe { &*map_value.as_js_object_ptr() };
         let native_ptr = map_obj.native_data() as *mut JsObject;
 
@@ -784,7 +809,8 @@ mod tests {
     #[test]
     fn session_gc_traces_map_object_key_and_value() {
         let mut vm = vm_with_low_threshold();
-        let map_value = native_ok(map::map_constructor(&mut vm, &[]));
+        map_this(&mut vm, 3);
+        let map_value = native_ok(map::map_constructor(&mut vm, &[3]));
         let key = JsValue::from_js_object(plain_object(&mut vm));
         let value = JsValue::from_js_object(plain_object(&mut vm));
         vm.regs[0] = map_value;
@@ -809,7 +835,8 @@ mod tests {
     #[test]
     fn session_gc_traces_set_object_key() {
         let mut vm = vm_with_low_threshold();
-        let set_value = native_ok(set::set_constructor(&mut vm, &[]));
+        set_this(&mut vm, 2);
+        let set_value = native_ok(set::set_constructor(&mut vm, &[2]));
         let key = JsValue::from_js_object(plain_object(&mut vm));
         vm.regs[0] = set_value;
         vm.regs[1] = key;
diff --git a/crates/oxide_vm/tests/builtins_map_tests.rs b/crates/oxide_vm/tests/builtins_map_tests.rs
index 36db6a4a..bffb3830 100644
--- a/crates/oxide_vm/tests/builtins_map_tests.rs
+++ b/crates/oxide_vm/tests/builtins_map_tests.rs
@@ -1,5 +1,7 @@
 use oxide_builtins::map::{map_clear, map_constructor as new_map, map_delete, map_get, map_has, map_set, map_size};
 use oxide_compiler::compiler::Compiler;
+use oxide_kernel::shape_forge::EMPTY_SHAPE_ID;
+use oxide_types::object::JsObject;
 use oxide_types::value::JsValue;
 use oxide_vm::vm::Vm;
 
@@ -14,11 +16,23 @@ fn str_val(vm: &Vm, val: JsValue) -> String {
     vm.lookup_str(val).unwrap_or_default()
 }
 
+/// 分配一个原型指向 Map.prototype 的占位对象并写入 reg 0，作为构造器调用的 `this`。
+fn map_this(vm: &mut Vm) -> JsValue {
+    let proto = vm.session().builtin_world().map_proto.as_ptr() as *mut JsObject;
+    let obj = vm
+        .epoch()
+        .alloc(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto)));
+    let val = JsValue::from_js_object(obj);
+    vm.set_reg(0, val);
+    val
+}
+
 // -- direct native fn tests --
 
 #[test]
 fn tmap_constructor_returns_object() {
     let mut vm = Vm::new();
+    map_this(&mut vm);
     let r = new_map(&mut vm, &[0]).unwrap();
     assert!(r.is_object());
 }
@@ -26,6 +40,7 @@ fn tmap_constructor_returns_object() {
 #[test]
 fn tmap_set_get() {
     let mut vm = Vm::new();
+    map_this(&mut vm);
     let m = new_map(&mut vm, &[0]).unwrap();
     vm.set_reg(0, m);
     vm.set_reg(1, JsValue::float(42.0));
@@ -38,6 +53,7 @@ fn tmap_set_get() {
 #[test]
 fn tmap_has_and_delete() {
     let mut vm = Vm::new();
+    map_this(&mut vm);
     let m = new_map(&mut vm, &[0]).unwrap();
     vm.set_reg(0, m);
     vm.set_reg(1, JsValue::float(7.0));
@@ -51,6 +67,7 @@ fn tmap_has_and_delete() {
 #[test]
 fn tmap_size_and_clear() {
     let mut vm = Vm::new();
+    map_this(&mut vm);
     let m = new_map(&mut vm, &[0]).unwrap();
     vm.set_reg(0, m);
     assert_eq!(map_size(&mut vm, &[0]).unwrap().as_double(), 0.0);
diff --git a/crates/oxide_vm/tests/builtins_set_tests.rs b/crates/oxide_vm/tests/builtins_set_tests.rs
index 8c6a2101..e1b8bb9e 100644
--- a/crates/oxide_vm/tests/builtins_set_tests.rs
+++ b/crates/oxide_vm/tests/builtins_set_tests.rs
@@ -1,5 +1,7 @@
 use oxide_builtins::set::{set_add, set_clear, set_constructor as new_set, set_delete, set_has, set_size};
 use oxide_compiler::compiler::Compiler;
+use oxide_kernel::shape_forge::EMPTY_SHAPE_ID;
+use oxide_types::object::JsObject;
 use oxide_types::value::JsValue;
 use oxide_vm::vm::Vm;
 
@@ -10,11 +12,23 @@ fn eval(vm: &mut Vm, source: &str) -> Result<JsValue, String> {
     vm.run(&module)
 }
 
+/// 分配一个原型指向 Set.prototype 的占位对象并写入 reg 0，作为构造器调用的 `this`。
+fn set_this(vm: &mut Vm) -> JsValue {
+    let proto = vm.session().builtin_world().set_proto.as_ptr() as *mut JsObject;
+    let obj = vm
+        .epoch()
+        .alloc(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto)));
+    let val = JsValue::from_js_object(obj);
+    vm.set_reg(0, val);
+    val
+}
+
 // -- direct native fn tests --
 
 #[test]
 fn tset_constructor_returns_object() {
     let mut vm = Vm::new();
+    set_this(&mut vm);
     let r = new_set(&mut vm, &[0]).unwrap();
     assert!(r.is_object());
 }
@@ -22,6 +36,7 @@ fn tset_constructor_returns_object() {
 #[test]
 fn tset_add_has() {
     let mut vm = Vm::new();
+    set_this(&mut vm);
     let s = new_set(&mut vm, &[0]).unwrap();
     vm.set_reg(0, s);
     vm.set_reg(1, JsValue::float(42.0));
@@ -32,6 +47,7 @@ fn tset_add_has() {
 #[test]
 fn tset_has_missing() {
     let mut vm = Vm::new();
+    set_this(&mut vm);
     let s = new_set(&mut vm, &[0]).unwrap();
     vm.set_reg(0, s);
     vm.set_reg(1, JsValue::float(99.0));
@@ -41,6 +57,7 @@ fn tset_has_missing() {
 #[test]
 fn tset_delete_works() {
     let mut vm = Vm::new();
+    set_this(&mut vm);
     let s = new_set(&mut vm, &[0]).unwrap();
     vm.set_reg(0, s);
     vm.set_reg(1, JsValue::float(7.0));
@@ -52,6 +69,7 @@ fn tset_delete_works() {
 #[test]
 fn tset_size_and_clear() {
     let mut vm = Vm::new();
+    set_this(&mut vm);
     let s = new_set(&mut vm, &[0]).unwrap();
     vm.set_reg(0, s);
     assert_eq!(set_size(&mut vm, &[0]).unwrap().as_double(), 0.0);
@@ -67,6 +85,7 @@ fn tset_size_and_clear() {
 #[test]
 fn tset_nan_equality() {
     let mut vm = Vm::new();
+    set_this(&mut vm);
     let s = new_set(&mut vm, &[0]).unwrap();
     vm.set_reg(0, s);
     vm.set_reg(1, JsValue::float(f64::NAN));
@@ -79,6 +98,7 @@ fn tset_nan_equality() {
 #[test]
 fn tset_signed_zero() {
     let mut vm = Vm::new();
+    set_this(&mut vm);
     let s = new_set(&mut vm, &[0]).unwrap();
     vm.set_reg(0, s);
     vm.set_reg(1, JsValue::float(0.0));