feat(runtime): serialize DOMException per Web IDL [Serializable] - #453

Stacked on #452. Implements the [Serializable] slot that PR deliberately left out, so DOMException survives structuredClone and worker postMessage instead of degrading like a custom Error subclass.

Mechanism (Node's JSTransferable protocol, reduced to one class)

• Branding. The dom-exception builtin gains a native half: binding.markCloneable stamps every instance with a per-isolate v8::Private (stored via Caches::StateFor), unforgeable and invisible from JS. All three GetExports call sites for the builtin now share one binding factory (serialization::DomExceptionBinding) — GetExports consults the factory only on the run that populates the cache, so a site passing a different one would win or lose by init order.
• Claiming. The serializer delegate turns on HasCustomHostObject and answers IsHostObject with a private-symbol check, V8's escape hatch for treating a plain JS object as a host object. Cost: one private-symbol lookup per plain JS object in a serialized graph — the same price Node pays.
• Two-phase payload. V8 forbids JS execution while a value is being read (calling the constructor inside ReadHostObject is a V8_Fatal, found the hard way), so this mirrors Node's host_objects_ design: WriteHostObject pushes {name, message, stack} onto an out-of-band list on the SerializedValue and writes only a tag + index into the stream; Deserialize constructs every instance through the real constructor before ReadValue starts, and ReadHostObject hands them out by index. Construction re-brands the instance, so a forwarded exception serializes again on the next hop — and on a worker isolate that never touched DOMException, the pre-construction step runs the builtin on demand.
• Wire format. Host objects now start with a uint32 tag (0 = degraded native wrapper, unchanged empty-object semantics; 1 = DOMException index). The bytes never outlive the process, so the format is free to evolve with the file.
• Policies. DOMException serializes under both kReject (structuredClone) and kDegrade (worker postMessage): the reject policy exists to refuse objects whose native half would be left behind, and a DOMException has none. Graph identity is preserved by V8's object-id machinery — one payload per distinct instance.

Tests

• Shared suites (common-runtime-tests-app@67da5fc, submodule bumped): structuredClone round-trip (name/message/code/instanceof, stack where stacks exist), identity within a graph, nesting, and worker postMessage in both directions — main→worker exercises the on-demand builtin run in a fresh isolate.
• Unguarded serialization canary in RuntimeImplementedAPIs.js.
• Full suite: 1499 specs, 0 failures.

Benchmarks

structuredClone medians on an iPad Pro simulator (temporary in-suite benchmarks, not committed). The object-heavy row was re-measured in round three in a fresh worker isolate, 15 runs after warmup, with the brand cached per serializer: "claim off" is the isolate before its first DOMException, "claim on" after one exists.

Claiming is now unconditional. The earlier gate that kept a DOMException-free isolate on the pre-claim path saved ~4ms on this pathological clone, and only until the isolate's first DOMException (any AbortController abort creates one), while V8 samples HasCustomHostObject once per serializer and never re-checks it, so the first DOMException born inside a getter during the clone that carried it lost its type. That case is now pinned by a spec that runs in a fresh worker isolate.

Review round (2026-09-11)

• Claiming custom host objects replaces V8's embedder-field detection instead of adding to it. IsHostObject now claims any object with internal fields first, so ObjC instances made with new, URL, Worker and interop pointers keep raising DataCloneError once a DOMException exists in the isolate, instead of cloning as {}. Pinned by a new spec in RuntimeImplementedAPIs.js that clones new NSObject() and a URL after constructing a DOMException.
• markCloneable reuses the state it already checked instead of dereferencing a second lookup.

Suite: 1551 / 0.

Review round two (2026-09-11)

• The serializer delegate resolves the DOMException brand once at construction instead of per object.
• Deserialize throws a DataCloneError instead of returning empty with nothing pending when the builtin cannot load, so structuredClone never yields undefined silently.
• The worker-side message read runs under a TryCatch, so a failed read is logged rather than left pending on the isolate.

Suite: 1551 / 0.

Review round three (2026-09-11)

• HasCustomHostObject returns true unconditionally; the per-isolate "any instances" flag and its gate are gone (see Benchmarks for the measured cost and why). New spec: a worker whose first DOMException is created by a getter during structuredClone still receives a DOMException.

Summary by CodeRabbit

• New Features

  • DOMException objects can now be transferred with structuredClone and worker postMessage.
  • Their name, message, and stack properties are preserved, including object identity within cloned graphs.

• Bug Fixes

  • Worker message deserialization failures are now handled safely without leaving pending exceptions.

• Documentation

  • Updated structured-cloning documentation to list DOMException as a supported cloneable type.

• Tests

  • Added coverage confirming cloned DOMException objects retain their type and error details.