feat: SuppressedError 内置错误实现（三字段属性序 + 构造器接线）

crates/oxide_builtins/src/error.rs

@@ -1,7 +1,7 @@
 use std::sync::Arc;
 
 use oxide_kernel::shape_forge::EMPTY_SHAPE_ID;
-use oxide_runtime_api::{to_string, NativeResult, VmHost};
+use oxide_runtime_api::{to_string, to_string_full, NativeResult, VmHost};
 use oxide_types::mem::P;
 use oxide_types::object::{JsObject, PropAttributes};
 use oxide_types::value::JsValue;
@@ -142,6 +142,82 @@ error_ctor!(syntax_error_constructor, syntax_error_proto);
 error_ctor!(uri_error_constructor, uri_error_proto);
 error_ctor!(eval_error_constructor, eval_error_proto);
 
+/// 在对象上追加一个非枚举数据属性（writable/configurable=true，enumerable=false），
+/// 与 `CreateNonEnumerableDataPropertyOrThrow` 语义一致。
+fn set_own_data_prop<H: VmHost>(host: &mut H, obj: *mut JsObject, key: &str, val: JsValue) {
+    let sf = Arc::clone(host.kernel_core().perm_interner());
+    let sh = Arc::clone(host.kernel_core().shape_forge());
+    let si = sf.intern(key).0;
+    let new_shape = sh.make_shape(unsafe { (*obj).shape_id() }, si);
+    unsafe {
+        (*obj).set_shape_id(new_shape);
+        let pos = (*obj).push_prop(val);
+        (*obj).set_data_meta(pos, PropAttributes::new(true, false, true));
+    }
+}
+
+/// `SuppressedError(error, suppressed, message)` 构造器：三参，length=3。
+///
+/// 以规范 CreateSuppressedError 语义建对象，三字段属性创建顺序为
+/// message → error → suppressed（order-of-args-evaluation 严格断言），
+/// message 为 undefined 时省略；三者均非枚举数据属性。
+///
+/// # 边界与前提
+/// - args[0]=this 被忽略：普通调用（无 new）同样新建对象，与既有 Error 子类型一致；
+/// - args[1]=error、args[2]=suppressed 原样存储不转换；
+/// - args[3]=message 走完整 ToString 强制转换：对象经 ToPrimitive（string hint），
+///   Symbol 抛 TypeError；用户 toString 抛出的异常原样传播。
+pub fn suppressed_error_constructor<H: VmHost>(host: &mut H, args: &[u8]) -> NativeResult {
+    let proto_ptr = P::as_ptr(&host.session().builtin_world().suppressed_error_proto) as *mut JsObject;
+    let obj = host.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto_ptr)));
+
+    // message（args[3]）非 undefined 时做完整 ToString 转换并先写属性。
+    if args.len() > 3 && !host.reg(args[3]).is_undefined() {
+        let msg_str = match to_string_full(host.reg(args[3]), host) {
+            Ok(s) => s,
+            Err(_) => {
+                // 对象 toString 抛出的用户异常经 last_uncaught_value 恢复后原样重新抛出；
+                // Symbol 等不可转换场景由调用方构造 TypeError。
+                if let Some(exc) = host.take_uncaught_value() {
+                    return NativeResult::Err(exc);
+                }
+                return NativeResult::Err(create_type_error(host, "Cannot convert value to a string"));
+            }
+        };
+        let msg_val = host.new_string(&msg_str);
+        set_own_data_prop(host, obj, "message", msg_val);
+    }
+
+    // error / suppressed 依次写非枚举数据属性（原值，不转换）。
+    if args.len() > 1 {
+        set_own_data_prop(host, obj, "error", host.reg(args[1]));
+    }
+    if args.len() > 2 {
+        set_own_data_prop(host, obj, "suppressed", host.reg(args[2]));
+    }
+    unsafe {
+        (*obj).type_tag = JsObject::OBJ_TYPE_ERROR;
+    }
+    NativeResult::Ok(JsValue::from_js_object(obj))
+}
+
+/// dispose 合并路径用：仅 error/suppressed 两个非枚举自有属性（无 message，
+/// 对应规范 DisposeResources 分支的 CreateSuppressedError 调用）。
+///
+/// # 边界与前提
+/// - 错误值/suppressed 值原样存储，不做任何转换；
+/// - 返回对象 proto = suppressed_error_proto，标记 OBJ_TYPE_ERROR。
+pub fn create_suppressed_error<H: VmHost>(host: &mut H, error_val: JsValue, suppressed_val: JsValue) -> JsValue {
+    let proto_ptr = P::as_ptr(&host.session().builtin_world().suppressed_error_proto) as *mut JsObject;
+    let obj = host.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto_ptr)));
+    set_own_data_prop(host, obj, "error", error_val);
+    set_own_data_prop(host, obj, "suppressed", suppressed_val);
+    unsafe {
+        (*obj).type_tag = JsObject::OBJ_TYPE_ERROR;
+    }
+    JsValue::from_js_object(obj)
+}
+
 /// `Error.prototype.toString`：按 `name: message` 拼接字符串；
 /// 缺少 name/message 时按规范回退到 `"Error"` 或空串。
 pub fn error_to_string<H: VmHost>(host: &mut H, args: &[u8]) -> NativeResult {

crates/oxide_emit/src/emit.rs

@@ -83,6 +83,9 @@ const BUILTIN_GLOBALS: &[&str] = &[
     "SyntaxError",
     "URIError",
     "EvalError",
+    "SuppressedError",
+    "DisposableStack",
+    "AsyncDisposableStack",
     "Math",
     "JSON",
     "Promise",

crates/oxide_kernel/src/builtin.rs

@@ -120,6 +120,7 @@ pub struct ErrorMethods {
     pub syntax_error: *const (),
     pub uri_error: *const (),
     pub eval_error: *const (),
+    pub suppressed_error: *const (),
     pub to_string: *const (),
     pub stack: *const (),
 }
@@ -205,6 +206,7 @@ pub struct BuiltinWorld {
     pub syntax_error_proto: P<JsObject>,
     pub uri_error_proto: P<JsObject>,
     pub eval_error_proto: P<JsObject>,
+    pub suppressed_error_proto: P<JsObject>,
     pub math_object: P<JsObject>,
     pub json_object: P<JsObject>,
     pub date_constructor: P<JsObject>,
@@ -362,6 +364,7 @@ fn make_error_subtypes(error_proto: &P<JsObject>) -> ErrorSubtypeProtos {
         syntax_error_proto: P::new(JsObject::new_empty(EMPTY_SHAPE_ID, error_proto_val)),
         uri_error_proto: P::new(JsObject::new_empty(EMPTY_SHAPE_ID, error_proto_val)),
         eval_error_proto: P::new(JsObject::new_empty(EMPTY_SHAPE_ID, error_proto_val)),
+        suppressed_error_proto: P::new(JsObject::new_empty(EMPTY_SHAPE_ID, error_proto_val)),
     }
 }
 
@@ -372,6 +375,7 @@ struct ErrorSubtypeProtos {
     syntax_error_proto: P<JsObject>,
     uri_error_proto: P<JsObject>,
     eval_error_proto: P<JsObject>,
+    suppressed_error_proto: P<JsObject>,
 }
 
 struct TypedArrayFamily {
@@ -690,6 +694,7 @@ impl BuiltinWorld {
             BuiltinId::SyntaxErrorProto => &self.syntax_error_proto,
             BuiltinId::UriErrorProto => &self.uri_error_proto,
             BuiltinId::EvalErrorProto => &self.eval_error_proto,
+            BuiltinId::SuppressedErrorProto => &self.suppressed_error_proto,
             BuiltinId::MathObject => &self.math_object,
             BuiltinId::JsonObject => &self.json_object,
             BuiltinId::DateConstructor => &self.date_constructor,
@@ -849,6 +854,7 @@ impl BuiltinWorld {
             syntax_error_proto: error_subtypes.syntax_error_proto,
             uri_error_proto: error_subtypes.uri_error_proto,
             eval_error_proto: error_subtypes.eval_error_proto,
+            suppressed_error_proto: error_subtypes.suppressed_error_proto,
             math_object,
             json_object,
             date_constructor,
@@ -993,6 +999,7 @@ impl BuiltinWorld {
                     syntax_error_proto: current.syntax_error_proto.clone(),
                     uri_error_proto: current.uri_error_proto.clone(),
                     eval_error_proto: current.eval_error_proto.clone(),
+                    suppressed_error_proto: current.suppressed_error_proto.clone(),
                 },
             )
         };
@@ -1243,6 +1250,7 @@ impl BuiltinWorld {
             syntax_error_proto: error_subtypes.syntax_error_proto,
             uri_error_proto: error_subtypes.uri_error_proto,
             eval_error_proto: error_subtypes.eval_error_proto,
+            suppressed_error_proto: error_subtypes.suppressed_error_proto,
             math_object,
             json_object,
             date_constructor,
@@ -1464,6 +1472,7 @@ impl BuiltinWorld {
             ("SyntaxError", methods.syntax_error, 1),
             ("URIError", methods.uri_error, 1),
             ("EvalError", methods.eval_error, 1),
+            ("SuppressedError", methods.suppressed_error, 3),
         );
 
         let proto_ptr = P::as_ptr(&self.error_proto) as *mut JsObject;
@@ -1500,6 +1509,13 @@ impl BuiltinWorld {
         self.set_subtype_proto_name(string_forge, shape_forge, &self.syntax_error_proto, "SyntaxError", si_name);
         self.set_subtype_proto_name(string_forge, shape_forge, &self.uri_error_proto, "URIError", si_name);
         self.set_subtype_proto_name(string_forge, shape_forge, &self.eval_error_proto, "EvalError", si_name);
+        self.set_subtype_proto_name(
+            string_forge,
+            shape_forge,
+            &self.suppressed_error_proto,
+            "SuppressedError",
+            si_name,
+        );
     }
 
     fn set_subtype_proto_name(

crates/oxide_kernel/src/kernel.rs

@@ -225,12 +225,13 @@ pub struct KernelSession {
 /// 维护注意：每个新增的 `BuiltinWorld` 对象字段都必须加到这里以及
 /// `KernelSession::dirty_since_snapshot()`，以便选择性重置重建正确的
 /// builtin 家族。
-pub const NUM_BUILTINS: usize = 88;
+pub const NUM_BUILTINS: usize = 89;
 
 /// 内置对象枚举 id，与 `BuiltinWorld` 中的存储槽一一对应。
 ///
-/// 覆盖各构造器/原型、Error 家族、集合类型、TypedArray 家族与 well-known symbols；
+/// 覆盖各构造器/原型、Error 家族（含 SuppressedError 原型）、集合类型、
-/// `repr(u8)` 使其可直接作为数组下标（`u8` 值即下标）。
+/// TypedArray 家族与 well-known symbols；`repr(u8)` 使其可直接作为数组下标
+/// （`u8` 值即下标）。
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 #[repr(u8)]
 pub enum BuiltinId {
@@ -322,10 +323,11 @@ pub enum BuiltinId {
     PlainDateTimeProto = 84,
     SymAsyncDispose = 86,
     SymDispose = 87,
+    SuppressedErrorProto = 88,
 }
 
 impl BuiltinId {
-    /// 全部 86 个内置对象的 id 常量表，供快照/脏检查按序遍历。
+    /// 全部内置对象的 id 常量表，供快照/脏检查按序遍历。
     /// 顺序必须与枚举判别值一致（`ALL[i]` 的 `u8` 值 == `i`）：
     /// 快照数组按下标填充，脏检查按下标回读，错位会误判 builtin 家族永久脏。
     pub const ALL: [BuiltinId; NUM_BUILTINS] = [
@@ -417,6 +419,7 @@ impl BuiltinId {
         BuiltinId::SymSpecies,
         BuiltinId::SymAsyncDispose,
         BuiltinId::SymDispose,
+        BuiltinId::SuppressedErrorProto,
     ];
 }
 
@@ -607,7 +610,8 @@ impl KernelSession {
                 || gen(BuiltinId::RangeErrorProto) != snap(BuiltinId::RangeErrorProto)
                 || gen(BuiltinId::SyntaxErrorProto) != snap(BuiltinId::SyntaxErrorProto)
                 || gen(BuiltinId::UriErrorProto) != snap(BuiltinId::UriErrorProto)
-                || gen(BuiltinId::EvalErrorProto) != snap(BuiltinId::EvalErrorProto),
+                || gen(BuiltinId::EvalErrorProto) != snap(BuiltinId::EvalErrorProto)
+                || gen(BuiltinId::SuppressedErrorProto) != snap(BuiltinId::SuppressedErrorProto),
             symbol_family: gen(BuiltinId::SymbolProto) != snap(BuiltinId::SymbolProto)
                 || gen(BuiltinId::SymbolConstructor) != snap(BuiltinId::SymbolConstructor)
                 || gen(BuiltinId::SymMatch) != snap(BuiltinId::SymMatch)

crates/oxide_vm/src/bindings/bind_error.rs

@@ -8,7 +8,7 @@ use oxide_types::value::JsValue;
 
 fn bind_error_subtype_constructor(
     core: &Arc<KernelCore>, session: &KernelSession, global: &mut JsObject, name: &str, proto_ptr: *mut JsObject,
-    ctor_fn: *const (),
+    ctor_fn: *const (), arg_count: u8,
 ) {
     let sf = core.perm_interner().as_ref();
     let sh = core.shape_forge().as_ref();
@@ -20,7 +20,7 @@ fn bind_error_subtype_constructor(
     ctor.type_tag = JsObject::OBJ_TYPE_CONSTRUCTOR;
     // SAFETY: ctor_fn 是调用方转成 *const () 的 NativeFn 函数项指针。
     ctor.set_native_fn(Some(unsafe { NativeFnPtr::from_raw(ctor_fn) }));
-    ctor.set_native_arg_count(1);
+    ctor.set_native_arg_count(arg_count);
 
     let si_prototype = sf.intern("prototype").0;
     let si_name = sf.intern("name").0;
@@ -33,7 +33,7 @@ fn bind_error_subtype_constructor(
     ctor.set_shape_id(ctor_shape3);
     ctor.ensure_hash_props().push(JsValue::from_js_object(proto_ptr));
     ctor.ensure_hash_props().push(JsValue::perm_string(sf.string_ptr(name_si)));
-    ctor.ensure_hash_props().push(JsValue::int(1));
+    ctor.ensure_hash_props().push(JsValue::int(arg_count as i32));
     // 构造器 length 按规范为不可写不可枚举（Function.length 属性描述符约定）。
     ctor.set_data_meta(2u32, PropAttributes::new(false, false, true));
 
@@ -66,6 +66,7 @@ pub fn bind_error(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         syntax_error: oxide_builtins::error::syntax_error_constructor::<crate::vm::Vm> as *const (),
         uri_error: oxide_builtins::error::uri_error_constructor::<crate::vm::Vm> as *const (),
         eval_error: oxide_builtins::error::eval_error_constructor::<crate::vm::Vm> as *const (),
+        suppressed_error: oxide_builtins::error::suppressed_error_constructor::<crate::vm::Vm> as *const (),
         to_string: oxide_builtins::error::error_to_string::<crate::vm::Vm> as *const (),
         stack: oxide_builtins::error::error_stack_getter::<crate::vm::Vm> as *const (),
     };
@@ -92,6 +93,7 @@ pub fn bind_error(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         "TypeError",
         session.builtin_world().type_error_proto.as_ptr() as *mut JsObject,
         oxide_builtins::error::type_error_constructor::<crate::vm::Vm> as *const (),
+        1,
     );
     bind_error_subtype_constructor(
         core,
@@ -100,6 +102,7 @@ pub fn bind_error(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         "ReferenceError",
         session.builtin_world().reference_error_proto.as_ptr() as *mut JsObject,
         oxide_builtins::error::reference_error_constructor::<crate::vm::Vm> as *const (),
+        1,
     );
     bind_error_subtype_constructor(
         core,
@@ -108,6 +111,7 @@ pub fn bind_error(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         "RangeError",
         session.builtin_world().range_error_proto.as_ptr() as *mut JsObject,
         oxide_builtins::error::range_error_constructor::<crate::vm::Vm> as *const (),
+        1,
     );
     bind_error_subtype_constructor(
         core,
@@ -116,6 +120,7 @@ pub fn bind_error(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         "SyntaxError",
         session.builtin_world().syntax_error_proto.as_ptr() as *mut JsObject,
         oxide_builtins::error::syntax_error_constructor::<crate::vm::Vm> as *const (),
+        1,
     );
     bind_error_subtype_constructor(
         core,
@@ -124,6 +129,7 @@ pub fn bind_error(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         "URIError",
         session.builtin_world().uri_error_proto.as_ptr() as *mut JsObject,
         oxide_builtins::error::uri_error_constructor::<crate::vm::Vm> as *const (),
+        1,
     );
     bind_error_subtype_constructor(
         core,
@@ -132,6 +138,18 @@ pub fn bind_error(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         "EvalError",
         session.builtin_world().eval_error_proto.as_ptr() as *mut JsObject,
         oxide_builtins::error::eval_error_constructor::<crate::vm::Vm> as *const (),
+        1,
+    );
+
+    // SuppressedError 为三参构造器（error, suppressed, message），length=3。
+    bind_error_subtype_constructor(
+        core,
+        session,
+        global,
+        "SuppressedError",
+        session.builtin_world().suppressed_error_proto.as_ptr() as *mut JsObject,
+        oxide_builtins::error::suppressed_error_constructor::<crate::vm::Vm> as *const (),
+        3,
     );
 
     {

crates/oxide_vm/src/bindings/mod.rs

@@ -577,7 +577,7 @@ fn bind_existing_global(core: &Arc<KernelCore>, global: &mut JsObject, name: &st
 
 fn bind_error_subtype_global(
     core: &Arc<KernelCore>, session: &KernelSession, global: &mut JsObject, name: &str, proto: &P<JsObject>,
-    ctor_fn: *const (),
+    ctor_fn: *const (), arg_count: u8,
 ) {
     let constructor_si = core.perm_interner().intern("constructor").0;
     if let Some(pos) = core.shape_forge().lookup_position(proto.shape_id(), constructor_si) {
@@ -591,7 +591,7 @@ fn bind_error_subtype_global(
     let function_proto_ptr = session.builtin_world().function_proto.as_ptr() as *mut JsObject;
     let mut ctor = Box::new(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(function_proto_ptr)));
     ctor.set_function(true);
-    configure_native_constructor(&mut ctor, ctor_fn, 1);
+    configure_native_constructor(&mut ctor, ctor_fn, arg_count);
 
     let sf = core.perm_interner().as_ref();
     let sh = core.shape_forge().as_ref();
@@ -905,6 +905,7 @@ pub fn bind_global_builtin_slots(core: &Arc<KernelCore>, session: &KernelSession
         "TypeError",
         &world.type_error_proto,
         oxide_builtins::error::type_error_constructor::<crate::vm::Vm> as *const (),
+        1,
     );
     bind_error_subtype_global(
         core,
@@ -913,6 +914,7 @@ pub fn bind_global_builtin_slots(core: &Arc<KernelCore>, session: &KernelSession
         "ReferenceError",
         &world.reference_error_proto,
         oxide_builtins::error::reference_error_constructor::<crate::vm::Vm> as *const (),
+        1,
     );
     bind_error_subtype_global(
         core,
@@ -921,6 +923,7 @@ pub fn bind_global_builtin_slots(core: &Arc<KernelCore>, session: &KernelSession
         "RangeError",
         &world.range_error_proto,
         oxide_builtins::error::range_error_constructor::<crate::vm::Vm> as *const (),
+        1,
     );
     bind_error_subtype_global(
         core,
@@ -929,6 +932,7 @@ pub fn bind_global_builtin_slots(core: &Arc<KernelCore>, session: &KernelSession
         "SyntaxError",
         &world.syntax_error_proto,
         oxide_builtins::error::syntax_error_constructor::<crate::vm::Vm> as *const (),
+        1,
     );
     bind_error_subtype_global(
         core,
@@ -937,6 +941,7 @@ pub fn bind_global_builtin_slots(core: &Arc<KernelCore>, session: &KernelSession
         "URIError",
         &world.uri_error_proto,
         oxide_builtins::error::uri_error_constructor::<crate::vm::Vm> as *const (),
+        1,
     );
     bind_error_subtype_global(
         core,
@@ -945,6 +950,19 @@ pub fn bind_global_builtin_slots(core: &Arc<KernelCore>, session: &KernelSession
         "EvalError",
         &world.eval_error_proto,
         oxide_builtins::error::eval_error_constructor::<crate::vm::Vm> as *const (),
+        1,
+    );
+
+    // SuppressedError 为三参构造器（error, suppressed, message），length=3；
+    // 与 bind_error 的 Box 自建路径参数一致，保证 reset 重建后 length 不回落。
+    bind_error_subtype_global(
+        core,
+        session,
+        global,
+        "SuppressedError",
+        &world.suppressed_error_proto,
+        oxide_builtins::error::suppressed_error_constructor::<crate::vm::Vm> as *const (),
+        3,
     );
 
     bind_reflect_global(core, session, global);

crates/oxide_vm/tests/builtins_error_tests.rs

@@ -449,3 +449,129 @@ fn error_stack_frame_format() {
     let s = vm.lookup_str(result).unwrap();
     assert!(s.contains("    at "), "stack should have 4-space indent, got: {}", s);
 }
+
+// ── SuppressedError 测试 ──
+
+#[test]
+fn suppressed_error_property_order_message_error_suppressed() {
+    let mut vm = make_vm();
+    // 三字段属性创建顺序：message → error → suppressed（order-of-args-evaluation 断言紧邻）。
+    let r = eval_in(&mut vm, "Object.getOwnPropertyNames(new SuppressedError('e', 's', 'm')).join(',')").unwrap();
+    let names_str = vm.lookup_str(r).unwrap();
+    let names: Vec<&str> = names_str.split(',').collect();
+    let pos = |n: &str| names.iter().position(|x| *x == n).expect(n);
+    assert!(pos("message") < pos("error"), "message 应排在 error 前, got: {:?}", names);
+    assert!(pos("error") < pos("suppressed"), "error 应排在 suppressed 前, got: {:?}", names);
+}
+
+#[test]
+fn suppressed_error_message_undefined_omits_property() {
+    let mut vm = make_vm();
+    // message 缺参时不建 message 自有属性。
+    let r = eval_in(&mut vm, "Object.getOwnPropertyNames(new SuppressedError([])).join(',')").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("error".to_string()));
+    // message 显式 undefined 同样省略。
+    let r = eval_in(&mut vm, "Object.getOwnPropertyNames(new SuppressedError('e', 's', undefined)).join(',')").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("error,suppressed".to_string()));
+}
+
+#[test]
+fn suppressed_error_message_to_string_coercion() {
+    let mut vm = make_vm();
+    // 三参 message 走完整 ToString 强制转换：42 → "42"、false → "false"、null → "null"。
+    let r = eval_in(&mut vm, "new SuppressedError('e','s',42).message").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("42".to_string()));
+    let r = eval_in(&mut vm, "new SuppressedError('e','s',false).message").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("false".to_string()));
+    let r = eval_in(&mut vm, "new SuppressedError('e','s',null).message").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("null".to_string()));
+    // 对象经 ToPrimitive(string hint) 调用 toString。
+    let r = eval_in(&mut vm, "new SuppressedError('e','s',{toString:function(){return 'custom';}}).message").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("custom".to_string()));
+}
+
+#[test]
+fn suppressed_error_message_tostring_abrupt() {
+    let mut vm = make_vm();
+    // Symbol → TypeError（ToString 规范不可转换路径）。
+    let r = eval_in(&mut vm, "try { new SuppressedError('e','s',Symbol('x')); 'no' } catch (e) { e.name }").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("TypeError".to_string()));
+    // 用户 toString 抛出的异常原样传播，不塌缩成 TypeError。
+    let r = eval_in(
+        &mut vm,
+        "try { new SuppressedError('e','s',{toString:function(){throw new RangeError('boom');}}); 'no' } catch (e) { e.name }",
+    )
+    .unwrap();
+    assert_eq!(vm.lookup_str(r), Some("RangeError".to_string()));
+}
+
+#[test]
+fn suppressed_error_call_without_new_creates_object() {
+    let mut vm = make_vm();
+    // 普通调用（newtarget-is-undefined）同样建对象，原型指向 SuppressedError.prototype。
+    let r = eval_in(&mut vm, "Object.getPrototypeOf(SuppressedError()) === SuppressedError.prototype").unwrap();
+    assert_eq!(format!("{}", r), "true");
+}
+
+#[test]
+fn suppressed_error_prototype_chain_and_shape() {
+    let mut vm = make_vm();
+    // 原型仅挂 constructor/name（name 与既有子类型一致排在 constructor 前），无 error/suppressed。
+    let r = eval_in(&mut vm, "Object.getOwnPropertyNames(SuppressedError.prototype).join(',')").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("name,constructor".to_string()));
+    // instanceof Error 走原型链，原型 [[Prototype]] = Error.prototype。
+    assert_eq!(
+        format!("{}", eval_in(&mut vm, "new SuppressedError('e','s') instanceof Error").unwrap()),
+        "true"
+    );
+    let r = eval_in(&mut vm, "Object.getPrototypeOf(SuppressedError.prototype) === Error.prototype").unwrap();
+    assert_eq!(format!("{}", r), "true");
+    // name 为 "SuppressedError"，message 沿 Error.prototype 链为 ""。
+    let r = eval_in(&mut vm, "SuppressedError.prototype.name").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("SuppressedError".to_string()));
+    let r = eval_in(&mut vm, "SuppressedError.prototype.message").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("".to_string()));
+}
+
+#[test]
+fn suppressed_error_constructor_metadata() {
+    let mut vm = make_vm();
+    // 三参构造器 length=3（不可写不可枚举）。
+    assert_eq!(format!("{}", eval_in(&mut vm, "SuppressedError.length").unwrap()), "3");
+    // 构造器 name 属性。
+    let r = eval_in(&mut vm, "SuppressedError.name").unwrap();
+    assert_eq!(vm.lookup_str(r), Some("SuppressedError".to_string()));
+    // 全局槽描述符 { writable:true, enumerable:false, configurable:true }。
+    let r = eval_in(
+        &mut vm,
+        "var d = Object.getOwnPropertyDescriptor(globalThis, 'SuppressedError'); [d.writable, d.enumerable, d.configurable].join(',')",
+    )
+    .unwrap();
+    assert_eq!(vm.lookup_str(r), Some("true,false,true".to_string()));
+}
+
+#[test]
+fn create_suppressed_error_direct_call() {
+    let mut vm = make_vm();
+    // dispose 合并路径直调：仅 error/suppressed 两个自有属性、无 message、原型链到 Error。
+    let err_val = vm.new_string("err");
+    let sup_val = vm.new_string("sup");
+    let result = error::create_suppressed_error(&mut vm, err_val, sup_val);
+    assert!(result.is_object());
+    let obj = unsafe { &*result.as_js_object_ptr() };
+    assert_eq!(obj.prop_count(), 2);
+    let sf = vm.kernel_core().perm_interner();
+    let sh = vm.kernel_core().shape_forge();
+    let si_error = sf.intern("error").0;
+    let si_suppressed = sf.intern("suppressed").0;
+    let si_message = sf.intern("message").0;
+    assert!(sh.lookup_position(obj.shape_id(), si_error).is_some(), "应有 error 槽");
+    assert!(sh.lookup_position(obj.shape_id(), si_suppressed).is_some(), "应有 suppressed 槽");
+    assert!(sh.lookup_position(obj.shape_id(), si_message).is_none(), "不应有 message 槽");
+    // 原型链：suppressed_error_proto → Error.prototype，instanceof Error 成立。
+    assert!(obj.proto().is_object(), "proto 应为 suppressed_error_proto");
+    // 非枚举：属性不进入 Object.keys（与 JS 侧 new 路径同一实现，此处校验 meta）。
+    let err_pos = sh.lookup_position(obj.shape_id(), si_error).unwrap();
+    let meta = obj.prop_meta_at(err_pos).unwrap();
+    assert!(!meta.attributes.enumerable(), "error 槽应非枚举");
+}