diff --git a/crates/oxide_builtins/src/array.rs b/crates/oxide_builtins/src/array.rs
index 6f0b67a..5e45b3d 100644
--- a/crates/oxide_builtins/src/array.rs
+++ b/crates/oxide_builtins/src/array.rs
@@ -153,7 +153,10 @@ fn invoke_native_callback<H: VmHost>(
     }
     match vm.call_function_sync(callback_val, this_val, cb_args) {
         Ok(value) => NativeResult::Ok(value),
-        Err(err) => NativeResult::Err(callback_error_from_text(vm, &err)),
+        Err(err) => match vm.take_uncaught_value() {
+            Some(original) => NativeResult::Err(original),
+            None => NativeResult::Err(callback_error_from_text(vm, &err)),
+        },
     }
 }
 
diff --git a/crates/oxide_vm/src/bindings/bind_error.rs b/crates/oxide_vm/src/bindings/bind_error.rs
index 3ac1552..2781a60 100644
--- a/crates/oxide_vm/src/bindings/bind_error.rs
+++ b/crates/oxide_vm/src/bindings/bind_error.rs
@@ -16,6 +16,8 @@ fn bind_error_subtype_constructor(
 
     let mut ctor = Box::new(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(function_proto_ptr)));
     ctor.set_function(true);
+    // Error 子类型须标记可构造：new TypeError(...) 走 NEW_EXPRESSION 校验。
+    ctor.type_tag = JsObject::OBJ_TYPE_CONSTRUCTOR;
     // SAFETY: ctor_fn 是调用方转成 *const () 的 NativeFn 函数项指针。
     ctor.set_native_fn(Some(unsafe { NativeFnPtr::from_raw(ctor_fn) }));
     ctor.set_native_arg_count(1);
@@ -121,6 +123,7 @@ pub fn bind_error(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
     {
         let err_ctor_ptr = session.builtin_world().error_constructor.as_ptr() as *mut JsObject;
         let err_ctor = unsafe { &mut *err_ctor_ptr };
+        err_ctor.type_tag = JsObject::OBJ_TYPE_CONSTRUCTOR;
         // SAFETY: error_constructor 是 NativeFn 函数项。
         err_ctor.set_native_fn(Some(unsafe {
             NativeFnPtr::from_raw(oxide_builtins::error::error_constructor::<crate::vm::Vm> as *const ())