Root cause of many Number/String/Object.hasOwnProperty false-negatives:
global dicts like Number/String/Object carry a :__callable__ slot so
they can be invoked (Number(5) coerces, Array(3) makes length-3 list).
That makes js-function? return true for them, so js-invoke-method
dispatched hasOwnProperty/isPrototypeOf/propertyIsEnumerable through
js-invoke-function-objproto (whose name/length/prototype-only check
returns false for real dict keys like MAX_VALUE).
Fix: in the invoke-method cond, exclude dicts from the function-proto
branch. Callable dicts fall through to js-invoke-object-method, which
walks (keys recv) properly.
One line in a compound `and` — minimal surface, easy to revert.
Unit: 521/522 unchanged.
Conformance: 148/148 unchanged.
Number scoreboard: 46/100 → 52/100 (+6).
Impacted sample: Number.hasOwnProperty("MAX_VALUE") → true (was false),
plus S15.7.3_A2..A8 family (MAX_VALUE/MIN_VALUE/POSITIVE_INFINITY/
NEGATIVE_INFINITY existence checks) and S15.7.2.1_A2..A4.
giles
05aef11bf5