diff --git a/Cargo.lock b/Cargo.lock
index 95c09f4d..21df30a5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1160,7 +1160,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_builtins"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "chrono",
  "fast-float",
@@ -1185,7 +1185,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_bytecode"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "num-bigint",
  "oxide_log",
@@ -1193,7 +1193,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_cfg"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "oxide_bytecode",
  "oxide_emit",
@@ -1204,7 +1204,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_cli"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "ansi_term",
  "bumpalo",
@@ -1228,7 +1228,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_code_cache"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "lru",
  "oxide_bytecode",
@@ -1237,7 +1237,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_compiler"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1258,7 +1258,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_dce"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1272,7 +1272,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_emit"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "num-bigint",
  "oxc_allocator",
@@ -1288,7 +1288,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_engine"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "oxide_bytecode",
  "oxide_compiler",
@@ -1300,7 +1300,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_fold"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "num-bigint",
  "oxide_bytecode",
@@ -1312,7 +1312,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_ir"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "oxide_bytecode",
  "oxide_log",
@@ -1321,7 +1321,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_kernel"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "bumpalo",
  "dashmap",
@@ -1335,7 +1335,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_liveness"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1347,7 +1347,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_log"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "tracing",
  "tracing-appender",
@@ -1356,11 +1356,11 @@ dependencies = [
 
 [[package]]
 name = "oxide_net"
-version = "0.19.3"
+version = "0.19.4"
 
 [[package]]
 name = "oxide_parser"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "oxc_allocator",
  "oxc_ast",
@@ -1375,7 +1375,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_regalloc"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1391,7 +1391,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_runtime_api"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "num-bigint",
  "num-traits",
@@ -1404,7 +1404,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_test262"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "oxide_bytecode",
  "oxide_compiler",
@@ -1424,7 +1424,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_types"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "bumpalo",
  "dashmap",
@@ -1437,7 +1437,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_vm"
-version = "0.19.3"
+version = "0.19.4"
 dependencies = [
  "bumpalo",
  "chrono",
diff --git a/Cargo.toml b/Cargo.toml
index dab1b13b..5bf76730 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -25,7 +25,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.19.3"
+version = "0.19.4"
 edition = "2021"
 license = "MIT"
 rust-version = "1.80"
diff --git a/crates/oxide_vm/src/vm_dispatch_misc.rs b/crates/oxide_vm/src/vm_dispatch_misc.rs
index cf69dd47..5fc79108 100644
--- a/crates/oxide_vm/src/vm_dispatch_misc.rs
+++ b/crates/oxide_vm/src/vm_dispatch_misc.rs
@@ -416,9 +416,9 @@ impl Vm {
             Ok(_) => return Ok(()),
             Err(e) => return self.raise_call_error(&e).map(|_| ()),
         };
-        // GetMethod 语义：null/undefined 均视为无 handler。handler 在场须可调用，
-        // 否则 Call(null) 抛 TypeError；调用异常原值上抛（外围 try/catch 可捕获）。
-        if !has_instance_val.is_undefined() && !has_instance_val.is_null() {
+        // 仅 undefined 视为无 handler；null 非 undefined，须调用，Call(null) 抛
+        // TypeError。handler 在场须可调用；调用异常原值上抛（外围 try/catch 可捕获）。
+        if !has_instance_val.is_undefined() {
             if !is_callable(has_instance_val) {
                 return self.raise_type_error("instanceof: @@hasInstance handler is not callable");
             }
diff --git a/crates/oxide_vm/tests/builtins_symbol_tests.rs b/crates/oxide_vm/tests/builtins_symbol_tests.rs
index 811b4a45..2d69ea30 100644
--- a/crates/oxide_vm/tests/builtins_symbol_tests.rs
+++ b/crates/oxide_vm/tests/builtins_symbol_tests.rs
@@ -194,6 +194,21 @@ fn has_instance_non_callable_handler_throws() {
     assert!(result.as_bool());
 }
 
+#[test]
+fn has_instance_null_handler_throws_type_error() {
+    let mut vm = Vm::new();
+    // null 非 undefined，规范仍须调用 handler，Call(null) 抛 TypeError。
+    let source = r#"
+        class D {}
+        D[Symbol.hasInstance] = null;
+        var threw = false;
+        try { ({} ) instanceof D; } catch (e) { threw = e instanceof TypeError; }
+        threw
+    "#;
+    let result = eval(&mut vm, source).unwrap();
+    assert!(result.as_bool());
+}
+
 #[test]
 fn has_instance_coerces_return_to_boolean() {
     let mut vm = Vm::new();