fix(intl): #5835 — new.target requirement + Reflect.construct prototype for Intl service ctors (#5850)

Intl.ListFormat/RelativeTimeFormat/Segmenter/PluralRules/Locale must throw a
TypeError when NewTarget is undefined (ECMA-402 step 1) instead of silently
constructing like the legacy factory-pattern NumberFormat/DateTimeFormat/
Collator. And OrdinaryCreateFromConstructor means the shared make_instance()
tail (plus Locale's own constructor) must install new.target's own prototype
when it's an object, not always the invoked closure's default prototype —
otherwise Reflect.construct(Intl.X, args, Custom) silently drops the custom
prototype.

Fixes 7 of the 108 test262 intl402 cases from #5835 (newtarget-undefined x5,
ctor-custom-prototype x2); zero regressions across the scoped Collator/
DisplayNames/ListFormat/PluralRules/RelativeTimeFormat/Segmenter/Locale
subset. `class extends Intl.X { super(...) }` subclassing remains open — a
separate, deeper fix in the native-parent super() dispatch path (discards
make_instance's returned object), out of scope here per the issue's
"pick a coherent subcluster" guidance.

Co-authored-by: Ralph <ralph@skelpo.com>

Author: proggeramlug

crates/perry-runtime/src/intl.rs

@@ -17,6 +17,8 @@ use crate::StringHeader;
 #[cfg(feature = "intl-segmenter")]
 use unicode_segmentation::UnicodeSegmentation;
 
+mod ctor_guard;
+use ctor_guard::{constructor_target_prototype, require_new_target};
 mod display_names;
 mod duration_format;
 mod locale;
@@ -1600,7 +1602,7 @@ fn make_instance(closure: *const ClosureHeader, kind: &str, locales: f64, option
         _ => {}
     }
 
-    let proto = crate::closure::closure_get_dynamic_prop(closure as usize, "prototype");
+    let proto = constructor_target_prototype(closure);
     if JSValue::from_bits(proto.to_bits()).is_pointer() {
         crate::object::prototype_chain::object_set_static_prototype(obj as usize, proto.to_bits());
     }
@@ -1654,6 +1656,7 @@ extern "C" fn collator_constructor_thunk(closure: *const ClosureHeader, rest: f6
 }
 
 extern "C" fn segmenter_constructor_thunk(closure: *const ClosureHeader, rest: f64) -> f64 {
+    require_new_target("Segmenter");
     make_instance(
         closure,
         KIND_SEGMENTER,
@@ -1663,6 +1666,7 @@ extern "C" fn segmenter_constructor_thunk(closure: *const ClosureHeader, rest: f
 }
 
 extern "C" fn list_format_constructor_thunk(closure: *const ClosureHeader, rest: f64) -> f64 {
+    require_new_target("ListFormat");
     make_instance(
         closure,
         KIND_LIST_FORMAT,
@@ -1675,6 +1679,7 @@ extern "C" fn relative_time_format_constructor_thunk(
     closure: *const ClosureHeader,
     rest: f64,
 ) -> f64 {
+    require_new_target("RelativeTimeFormat");
     make_instance(
         closure,
         KIND_RELATIVE_TIME,
@@ -1684,6 +1689,7 @@ extern "C" fn relative_time_format_constructor_thunk(
 }
 
 extern "C" fn plural_rules_constructor_thunk(closure: *const ClosureHeader, rest: f64) -> f64 {
+    require_new_target("PluralRules");
     make_instance(
         closure,
         KIND_PLURAL_RULES,

crates/perry-runtime/src/intl/ctor_guard.rs

@@ -0,0 +1,40 @@
+//! Shared `[[Construct]]`-only checks and `new.target`-aware prototype
+//! resolution used by the Intl service constructors (#5835). Split out of
+//! `intl.rs` to keep that file under the repository's 2,000-line gate.
+
+use crate::closure::ClosureHeader;
+use crate::object::{js_object_get_field_by_name_f64, ObjectHeader};
+use crate::string::js_string_from_bytes;
+use crate::value::JSValue;
+
+/// `GetPrototypeFromConstructor(new.target, "%<Ctor>Prototype%")`: a
+/// `Reflect.construct(Intl.X, args, CustomCtor)` call should install
+/// `CustomCtor.prototype` on the result (test262 `ctor-custom-prototype.js`),
+/// falling back to the invoked closure's own `"prototype"` when `new.target`
+/// is absent (a bare `new Intl.X()`) or its `prototype` isn't an object.
+pub(super) fn constructor_target_prototype(closure: *const ClosureHeader) -> f64 {
+    const POINTER_TAG: u64 = 0x7FFD_0000_0000_0000;
+    const POINTER_MASK: u64 = 0x0000_FFFF_FFFF_FFFF;
+    let new_target = crate::object::js_new_target_get();
+    let bits = new_target.to_bits();
+    if (bits & !POINTER_MASK) == POINTER_TAG {
+        let raw = (bits & POINTER_MASK) as usize;
+        if raw != 0 {
+            let key = js_string_from_bytes(b"prototype".as_ptr(), b"prototype".len() as u32);
+            let proto = js_object_get_field_by_name_f64(raw as *const ObjectHeader, key);
+            if JSValue::from_bits(proto.to_bits()).is_pointer() {
+                return proto;
+            }
+        }
+    }
+    crate::closure::closure_get_dynamic_prop(closure as usize, "prototype")
+}
+
+/// `Intl.<X>` is `[[Construct]]`-only per ECMA-402 (unlike the legacy
+/// factory-pattern `NumberFormat`/`DateTimeFormat`/`Collator`): a bare call
+/// or `.call(obj)` must throw a `TypeError` rather than silently `new`-ing.
+pub(super) fn require_new_target(name: &str) {
+    if crate::object::js_new_target_get().to_bits() == crate::value::TAG_UNDEFINED {
+        super::throw_type_error(&format!("Constructor Intl.{name} requires 'new'"));
+    }
+}

crates/perry-runtime/src/intl/locale.rs

@@ -650,6 +650,7 @@ fn transform_instance(obj: *const ObjectHeader, transform: fn(&mut ParsedLocale)
 }
 
 extern "C" fn locale_constructor_thunk(closure: *const ClosureHeader, rest: f64) -> f64 {
+    super::require_new_target("Locale");
     let tag_value = super::rest_arg(rest, 0);
     let options_value = super::rest_arg(rest, 1);
     let tag_js = JSValue::from_bits(tag_value.to_bits());
@@ -682,7 +683,7 @@ extern "C" fn locale_constructor_thunk(closure: *const ClosureHeader, rest: f64)
     }
     apply_options(&mut parsed, options);
 
-    let proto = crate::closure::closure_get_dynamic_prop(closure as usize, "prototype");
+    let proto = super::constructor_target_prototype(closure);
     make_locale_instance(proto.to_bits(), &parsed)
 }
 

test-files/test_gap_intl_ctor_mechanics_5835.ts

@@ -0,0 +1,51 @@
+// #5835 — Intl service constructor mechanics: `new.target` requirement and
+// `Reflect.construct`-driven prototype selection.
+//
+// ECMA-402 step 1 for ListFormat/RelativeTimeFormat/Segmenter/PluralRules/
+// Locale is "If NewTarget is undefined, throw a TypeError exception" — unlike
+// the legacy factory-pattern NumberFormat/DateTimeFormat/Collator, which
+// silently `new`-ed on a bare call. And OrdinaryCreateFromConstructor means
+// `Reflect.construct(Intl.X, args, Custom)` must install `Custom.prototype`
+// on the result, not `Intl.X.prototype`. Both must match
+// `node --experimental-strip-types` byte-for-byte.
+function probe(name: string, fn: () => unknown): string {
+  try {
+    fn();
+    return "no throw";
+  } catch (e) {
+    return (e as Error).constructor.name;
+  }
+}
+
+const I: any = (globalThis as any).Intl;
+
+console.log("ListFormat()", probe("ListFormat", () => I.ListFormat()));
+console.log("RelativeTimeFormat()", probe("RelativeTimeFormat", () => I.RelativeTimeFormat()));
+console.log("Segmenter()", probe("Segmenter", () => I.Segmenter()));
+console.log("PluralRules()", probe("PluralRules", () => I.PluralRules()));
+console.log("PluralRules.call(undefined)", probe("PluralRules.call", () => I.PluralRules.call(undefined)));
+console.log("Locale()", probe("Locale", () => I.Locale()));
+console.log("Locale('en')", probe("Locale('en')", () => I.Locale("en")));
+
+// Legacy factory-pattern constructors still allow a bare call (no `new`).
+console.log("NumberFormat bare call", probe("NumberFormat", () => I.NumberFormat("en")));
+console.log("DateTimeFormat bare call", probe("DateTimeFormat", () => I.DateTimeFormat("en")));
+console.log("Collator bare call", probe("Collator", () => I.Collator("en")));
+
+// `Reflect.construct(Intl.X, args, Custom)` installs `Custom.prototype`.
+{
+  const custom: any = new Function();
+  custom.prototype = {};
+  const obj = Reflect.construct(I.DisplayNames, [undefined, { type: "language" }], custom);
+  console.log("DisplayNames custom prototype", Object.getPrototypeOf(obj) === custom.prototype);
+}
+{
+  const custom: any = new Function();
+  custom.prototype = {};
+  const obj = Reflect.construct(I.Segmenter, [], custom);
+  console.log("Segmenter custom prototype", Object.getPrototypeOf(obj) === custom.prototype);
+}
+
+// Ordinary (non-Reflect.construct) instances still resolve the default prototype.
+console.log("plain ListFormat prototype", Object.getPrototypeOf(new I.ListFormat("en")) === I.ListFormat.prototype);
+console.log("plain Locale prototype", Object.getPrototypeOf(new I.Locale("en")) === I.Locale.prototype);