Parent: #475 Discovered by: #1061
Two pinned Date.toISOString cases fail before any constructor-lookup change: prototype/toISOString/15.9.5.43-0-9.js and 15.9.5.43-0-10.js, both with RangeError: Invalid Date.
Executed reproduction uses the process timezone (America/Los_Angeles):
let offset = -new Date(0).getTimezoneOffset();
let a = new Date(1970, 0, -99999999, 0, offset + 60, 0, 0);
let b = new Date(1970, 0, -99999999, 0, offset + 60, 0, 1);
[offset, Number.isNaN(a.getTime()), Number.isNaN(b.getTime())].join(",");Node: -480,false,false. Saved engine binary in tree and required-bytecode modes: -480,true,true.
The local component builder applies TimeClip before timezone conversion, and the local-to-UTC helper also rejects inputs outside the final UTC range. UTC conversion must precede TimeClip; valid boundary instants can have local wall-clock values outside that range. See ECMA-262 UTC(t), 21.4.1.26, and the Date constructor algorithm.
Acceptance:
- Compute local component time without clipping, convert to UTC, then apply TimeClip.
- Preserve Date.UTC/direct numerical Date clipping and reject unrepresentable/extreme inputs safely.
- Pin both range boundaries, milliseconds, constructors and local setters, fixed offsets of both signs, and ordinary/DST behavior.
- Normal/unsuppressed TSan and tree/required-bytecode witnesses pass.
- Full pinned Date corpus improves from 592 pass / 2 fail to 594 pass / 0 fail with exact failure-path accounting.