edgegoat: edge case test inputs for JavaScript

Timestamp 0 is falsy, so `if (!time)` treats a valid date as missing, and west of UTC it is still 1969 locally.

Negative timestamps: `ms % 1000` is -1, not 999, so splitting seconds and milliseconds with % and Math.floor disagree.

Truncating -1.5 s toward zero gives 23:59:59 instead of 23:59:58; Math.trunc vs Math.floor and integer division bugs live here.

Negative timestamp with milliseconds: serializers that build "seconds.millis" from a negative value print a wrong or doubly negative fraction.

Before standard time, zones used local mean time with second level offsets (Sao Paulo was -03:06:28); getTimezoneOffset() reports whole minutes, so local arithmetic drifts by seconds.

Date.UTC(0, 0, 1) and new Date(0, 0, 1) map years 0 to 99 to 1900 to 1999, and toISOString() yields "0000", which "1 BC" formatting must handle.

toISOString() produces an expanded, signed year "-000001"; regexes that expect four digits reject it.

Last second representable as a signed 32 bit Unix time; anything that stores seconds in an int32 (or uses `| 0`) is fine here.

One second past the int32 limit: `(ms / 1000) | 0` wraps to 1901-12-13, and so do 32 bit database columns.

Largest instant with a four digit year; one millisecond later toISOString() switches to "+010000".

toISOString() returns a six digit signed year; parsers, databases and YYYY format strings break.

Largest valid Date. Adding 1 ms produces Invalid Date, so "end of time" sentinels overflow.

Smallest valid Date. Subtracting anything produces Invalid Date, and local offsets west of UTC push the local wall clock out of range.

getTime() is NaN, toISOString() throws RangeError, JSON.stringify gives null and every comparison is false.

Date-only ISO strings are UTC midnight, while date-time strings without Z are local; west of UTC this date displays as February 28.

Adding a year with setFullYear(y + 1) lands on 2025-03-01 because Feb 29 2025 does not exist; birthdays and anniversaries drift.

2000 is a leap year because it is divisible by 400, unlike 1900 and 2100; a "divisible by 100 means not leap" rule rejects it.

2100 is not a leap year; `year % 4 === 0` claims Feb 29 2100 exists and the day after this is computed wrong.

setMonth(month + 1) on January 31 overflows to March 3, because February 31 does not exist.

Adding one month to March 31 gives May 1, since April has 30 days; "same day next month" needs clamping.

Range queries ending at 23:59:59 miss this millisecond; month index 11 plus one must roll over into the next year.

ISO week years differ from calendar years: this Friday belongs to week 53 of 2026, so `getFullYear()` plus week number is wrong.

A Monday in December that belongs to week 1 of the next ISO year; "yyyy-ww" built from the calendar year shows 2024-01.

ISO weeks start on Monday, US weeks on Sunday: this day is week 52 of 2022 in ISO but week 1 of 2023 in US numbering.

Last instant before clocks jump from 02:00 to 03:00 (UTC-05:00 to UTC-04:00); adding 60 minutes of wall time here is not 60 minutes of real time.

Clocks jump from 02:00 to 03:00; local times in between do not exist, so building a Date from local fields shifts it and that local day is 23 hours long.

Clocks fall back from 02:00 to 01:00, so 01:30 happens twice; this is the first one (UTC-04:00). Parsing the local time picks one of the two.

Same wall clock reading as the first 01:30, 60 minutes later (UTC-05:00); sorting or deduplicating by local time breaks and that local day is 25 hours long.

Local time is 2025-12-31 23:59:59.999 (UTC-05:00) but the UTC year is already 2026; a year check with getUTCFullYear() is off by one. real bug

Clocks fall back from 00:00 to 23:00, so 23:30 happens twice; this is the first one (UTC-02:00). Parsing the local time picks one of the two.

Same wall clock reading as the first 23:30, 60 minutes later (UTC-03:00); sorting or deduplicating by local time breaks and that local day is 25 hours long.

Last instant before clocks jump from 00:00 to 01:00 (UTC-03:00 to UTC-02:00); adding 60 minutes of wall time here is not 60 minutes of real time.

Clocks jump from 00:00 to 01:00; local times in between do not exist, so building a Date from local fields shifts it and that local day is 23 hours long. Midnight does not exist that day, so new Date(2018, 10, 4) returns 01:00.

Local time is 2017-12-31 23:59:59.999 (UTC-02:00) but the UTC year is already 2018; a year check with getUTCFullYear() is off by one. real bug

Last instant before clocks jump from 01:00 to 02:00 (UTC+00:00 to UTC+01:00); adding 60 minutes of wall time here is not 60 minutes of real time.

Clocks jump from 01:00 to 02:00; local times in between do not exist, so building a Date from local fields shifts it and that local day is 23 hours long.

Clocks fall back from 02:00 to 01:00, so 01:30 happens twice; this is the first one (UTC+01:00). Parsing the local time picks one of the two.

Same wall clock reading as the first 01:30, 60 minutes later (UTC+00:00); sorting or deduplicating by local time breaks and that local day is 25 hours long.

Clocks fall back from 02:00 to 01:30, so 01:45 happens twice; this is the first one (UTC+11:00). Parsing the local time picks one of the two.

Same wall clock reading as the first 01:45, 30 minutes later (UTC+10:30); sorting or deduplicating by local time breaks and that local day is 24.5 hours long.

Last instant before clocks jump from 02:00 to 02:30 (UTC+10:30 to UTC+11:00); adding 30 minutes of wall time here is not 30 minutes of real time.

Clocks jump from 02:00 to 02:30; local times in between do not exist, so building a Date from local fields shifts it and that local day is 23.5 hours long.

Local time is 2026-01-01 00:00 (UTC+11:00) but the UTC year is still 2025; a year check with getUTCFullYear() is off by one. real bug

Local time is 2026-01-01 00:00 (UTC+05:45) but the UTC year is still 2025; a year check with getUTCFullYear() is off by one. real bug

Local time is 2026-01-01 00:00 (UTC+14:00) but the UTC year is still 2025; a year check with getUTCFullYear() is off by one. This zone is among the first places on Earth to enter the new year. real bug

Local time is 2025-12-31 23:59:59.999 (UTC-11:00) but the UTC year is already 2026; a year check with getUTCFullYear() is off by one. This zone is among the last places on Earth to leave the old year. real bug

The control zone: offset 0 all year. Bugs that only show up away from UTC hide here, which is why CI should not run only in UTC.

UTC-05:00 with US DST rules: the classic negative offset where UTC midnight is the previous local day.

UTC-08:00: late enough that evening events land on the next UTC day.

UTC-03:00; used DST with midnight transitions until 2019, so historical dates have days without 00:00.

UTC-03:30: a half hour offset with DST in the Americas; code that assumes whole hours breaks.

UTC+00:00 in winter but +01:00 in summer: tests that pass in January fail in July.

The tz database models Irish time with a negative DST save (standard time in summer), which trips code that reads the isDST flag of tz libraries.

UTC+01:00 that drops to +00:00 during Ramadan each year, so transitions move with the lunar calendar.

UTC+05:30, no DST: the most populous half hour offset.

UTC+05:45: a quarter hour offset that breaks `offset / 60` rounding and hour only offset pickers.

UTC+03:30; abolished DST in 2022, so historical and current rules differ.

UTC+09:30 / +10:30: southern hemisphere DST plus a half hour offset.

UTC+10:30 / +11:00: DST shifts by only 30 minutes, so "DST adds one hour" is false.

UTC+12:45 / +13:45: quarter hour offset with DST, far east of the date line.

UTC+14:00, the largest offset: local dates are a full day ahead of most of the Americas and the first to reach New Year.

Samoa skipped 2011-12-30 entirely when it moved across the date line; day counting across that date is off by one.

UTC-11:00, among the last places to leave a year; local dates lag a day behind most of Asia.

UTC+00:00 in winter and +02:00 in summer: a two hour DST jump.

Falsy, length 0: `if (!name)` and `str[0].toUpperCase()` both misbehave.

Truthy but blank: passes `if (str)` checks and fails after trim().

Every ASCII whitespace character; trim() returns an empty string but `str.length > 0` validators accept it.

Arrives from HTML   and copy paste; \s and trim() treat it as whitespace but split(" ") and many tokenizers do not.

Full width space used in CJK text; trim() removes it, byte based or ASCII only trimming does not.

Invisible and not whitespace for trim() or \s, so it looks identical to "foobar" but is not equal to it.

Left by Windows editors at the start of files: CSV headers become "\uFEFFid" and JSON.parse of BOM prefixed text throws.

Invisible unless a line breaks there, so search and equality fail on text that looks the same.

Exceeds column and header limits, overflows layouts and exposes quadratic algorithms and backtracking regexes.

One visible character but length 2 (a surrogate pair); charAt(0) and str[0] return half of it.

Seven code points joined by zero width joiners render as one glyph with length 11; splitting by code point shows four people.

A flag is two regional indicator letters; cutting between them leaves letters and reversing them names another country or none.

Base emoji plus a modifier: one grapheme, two code points, four code units; truncating after the base drops the tone.

U+2764 plus U+FE0F: removing "invisible" characters changes emoji presentation, and the base alone is in the BMP.

Starts with an ASCII digit, so /^\d/ matches what renders as a single keycap symbol.

The emoji starts at index 9, so slice(0, 10) keeps only its high surrogate and produces malformed UTF-16. real bug

Truncating "to N code units" from the end lands inside the pair; output ends in a lone surrogate that renders as U+FFFD. real bug

Malformed UTF-16: encodeURIComponent throws URIError, TextEncoder writes U+FFFD and isWellFormed() is false.

A trailing surrogate with no lead: string comparison works but encoding, hashing and JSON round trips through UTF-8 change it.

Length 4. Compare with the decomposed form: same rendering, different code points.

Length 5 and !== the NFC form; macOS file names and some keyboards produce this form. Use normalize() before comparing.

One base letter with ten combining marks: one grapheme, eleven code units, and rendering that escapes its line box.

A combining mark with nothing to attach to; it combines with whatever precedes the string after concatenation.

Korean syllable blocks. NFD splits each into two or three jamo, so lengths change after normalization.

Three jamo that render as one syllable and equal the first syllable of the previous case only after NFC normalization.

Hebrew mixed with Latin and numbers: visual order differs from memory order, which breaks cursor math and naive truncation with ellipsis.

Right to left script with contextual letter shapes; per code point styling or splitting breaks the joining.

Displays as "invoiceexe.txt": the Trojan Source trick (CVE-2021-42574) for file names and code review.

Invisible directional isolates change display order; strip or escape them in identifiers and logs.

Capital dotted I lowercases to i plus U+0307 (length grows), and toLocaleLowerCase("tr") maps I to dotless i; case insensitive keys break.

toUpperCase() gives "STRASSE" (length 6 to 7), so upper and lower case comparisons disagree and length based layouts shift.

Lowercasing the whole word yields a final sigma at the end; lowercasing letter by letter does not, so results differ.

Terminates C strings, is rejected by PostgreSQL text columns and disappears in some loggers.

split("\n") leaves a trailing "\r" on each line; Windows files and HTTP headers use this form.

Classic Mac line ending: code that only looks for \n sees one line.

A JavaScript line terminator: `.` in a regex does not match it, and it broke inline scripts and JSONP before ES2019.

Another JavaScript line terminator that most text editors render as nothing; line counting tools disagree about it.

Rarely seen whitespace that XML 1.0 forbids and some JSON encoders escape inconsistently.

Must render as literal text; any innerHTML or template without escaping executes it.

Escaping twice shows "<" to users; unescaping on input then escaping on output corrupts it.

A quote ends a string literal in hand built SQL; also tests that names with apostrophes survive a round trip.

Passing user text to new RegExp() throws on "(" or matches everything with ".*"; escape it first.

Text that looks like template or printf syntax; any second pass through a formatter changes it.

Used as an object key it sets the prototype instead of a property; use Map or Object.create(null) for user keys.

A real surname and a common placeholder: systems that treat "null" as missing lose data.

Unicode digits: Number() and parseInt return NaN and \d only matches ASCII 0 to 9, yet users type these.

Typed by CJK input methods; look like 123 but fail /^\d+$/ and Number().

Thai writes words without spaces and uses combining vowels; word wrapping and counting need Intl.Segmenter.

Each character takes two terminal columns, so padEnd based tables and fixed width output misalign.

Falsy: `if (!count)` and `value || defaultValue` replace a legitimate 0.

-0 === 0 is true, but Object.is(-0, 0) is false, 1 / -0 is -Infinity and String(-0) is "0", so the sign silently disappears.

NaN !== NaN, indexOf cannot find it, JSON.stringify writes null and every comparison is false, so sorting with it is unstable.

JSON.stringify writes null, toFixed returns "Infinity" and a max-age or timeout of Infinity can mean "never" or overflow a timer. real bug

Math.max() of an empty list; a common reducer seed that leaks into output as "-Infinity".

2^53 - 1, the largest integer where n + 1 is exact; IDs and counters past it stop being unique.

2^53: here n + 1 === n, so loops never advance and 64 bit IDs from JSON collide.

Is not representable: the literal 9007199254740993 rounds to 9007199254740992 before your code ever sees it.

-(2^53 - 1), the negative safe integer limit; mirrors the positive overflow bugs.

First unsafe negative integer: Number.isSafeInteger is false and decrementing it is not exact.

Largest finite double; doubling it or adding a large value gives Infinity.

Smallest positive double (5e-324), not the most negative number; code that uses it as "minus infinity" is wrong.

Gap between 1 and the next double; only meaningful as a tolerance near 1, not for large or tiny values.

Breaks `x | 0` and `x >>> 0` truncation, array index limits and 32 bit counters.

Overflows signed 32 bit math: `(2 ** 31) | 0` is -2147483648.

Between -1 and 0: Math.trunc gives -0, Math.round gives -0, and code that formats the integer part then the fraction drops the minus sign. real bug

A small negative between -1 and 0: formatting with toFixed(2) gives "-0.00", and splitting into integer and fraction parts loses the sign. real bug

Very small negative: String() gives "-1e-7", so string based number formatting and regexes for digits fail.

Smallest magnitude where String() switches to exponent notation ("1e-7"), while 0.000001 still prints in full.

0.30000000000000004, not 0.3: exact equality on money and percentages fails; compare with a tolerance or use integers.

Stored as 1.00499999999999989..., so (1.005).toFixed(2) is "1.00" and Math.round(1.005 * 100) / 100 is 1.

Math.round(0.5) is 1 but Math.round(-0.5) is -0 and toFixed uses a different rule: half rounding is not symmetric.

First integer where String() uses exponent notation ("1e+21"); toFixed also falls back to exponent form, breaking digit only checks.

Largest round number below 1e21 that still prints all its digits; one step up the format changes.

Modulo keeps the sign (-42 % 5 is -2), so "positive modulo" wraparound for indexes and calendars is wrong.

arr[1.5] is undefined and creates a string property on write; Number.isInteger guards are often missing.

Number("") is 0, not NaN, so empty form fields become zero.

Number(" ") is 0 as well; parseFloat returns NaN, so the two parsers disagree.

Number trims whitespace and accepts it; strict validators and parseInt with a regex may not.

Number("-0") is -0, which then prints as "0"; round trips lose the sign.

Decimal 7 for Number and parseInt, but octal in some legacy parsers and a string ID that must keep its zeros.

Number("0x1A") is 26 and parseInt("0x1A") is 26, but parseFloat("0x1A") is 0.

Number("0b101") is 5 while parseInt("0b101") is 0; prefixes are accepted by one parser only.

Number gives 1000 but parseInt gives 1, so "digits only" assumptions break.

parseInt and parseFloat return 12, Number returns NaN; lenient parsing hides bad input.

Decimal comma used in most of Europe and Brazil: parseFloat gives 1 and Number gives NaN.

Grouped digits from formatted output; parseFloat stops at the first comma and returns 1.

Valid in JavaScript source but Number("1_000") is NaN.

Number("Infinity") is Infinity, so numeric validation accepts a word; JSON cannot represent it.

Number("NaN") is NaN, which passes typeof === "number" checks after conversion.

Parses to 9007199254740992: IDs from JSON or databases silently change; parse as BigInt or keep as string.

Accepted by Number but rejected by many /^\d+$/ validators, and vice versa for UI masks.

Real digits for many users, but Number returns NaN; normalize with Intl or a digit map first.

Falsy like 0, and -0n is just 0n (BigInt has no negative zero), so sign preserving code paths diverge from Number.

BigInt division truncates toward zero (-1n / 2n is 0n) and % keeps the sign.

Number(2n ** 53n + 1n) rounds to 2^53; converting back to Number for math or JSON loses it.

Largest signed 64 bit integer (PostgreSQL bigint, Java long); one more overflows the column.

Smallest signed 64 bit integer; its absolute value does not fit in int64.

Largest unsigned 64 bit integer; BigInt.asIntN(64, n) turns it into -1n.

Wraps to 0n with BigInt.asUintN(64, n); database drivers reject it.

Far beyond any Number integer: JSON.stringify throws TypeError for any BigInt, and mixing with Number in + throws.

No dot in the host: "must contain a TLD" validators reject development URLs.

Userinfo with an encoded @; naive parsers split on the first @ and leak or mangle the password.

hostname is "[::1]" with brackets; splitting host and port on ":" breaks.

The parser normalizes it to 127.0.0.1, so SSRF block lists that compare strings miss it.

Also loopback after normalization; another SSRF filter bypass.

hostname becomes punycode ("xn--r8jz45g.jp"), so comparing the input string with url.hostname fails.

A fully qualified name that is a different origin from example.com for cookies, CORS and allow lists.

Scheme and host are lowercased but the path keeps its case; string compares of URLs disagree with the parser.

url.port is "" because the default port is dropped; code expecting "443" breaks.

Ports above 65535 make the URL invalid; regex validators accept any digits.

Servers and routers disagree on whether %2F is a path separator; decode once at the right layer.

URLSearchParams decodes "+" as a space but decodeURIComponent does not; the key also repeats.

Decoding twice turns %2520 into a space; decoding once gives "%20" literally.

url.hash is "" even though href ends with "#", so hash based checks see no fragment.

Normalized to /secret by the parser; checks done on the raw string allow traversal.

The parser percent encodes both as UTF-8, so href no longer equals the input.

Exceeds common 2048 character limits and 8 KB request line limits in proxies and servers.

A valid URL that runs code when used as an href; allow list schemes instead of block listing.

The parser removes tabs and newlines, so this is javascript:alert(1); block lists that match the raw string miss it.

Valid and executable in some contexts; never forward user supplied data URLs to href or src.

host is empty and pathname is "/C:/Windows/win.ini" with a leading slash before the drive letter.

No host at all: url.host is "" and url.origin is "null".

The parser strips leading and trailing spaces, so it is valid, but the stored string is not.

Invalid without a base, but resolves to another host with one: "starts with /" open redirect checks pass it.

Browsers treat "\" as "/" in http URLs, so this resolves to //example.com: a classic open redirect.

What users type, but not a URL: new URL throws and links become relative paths.

Forbidden host code point; new URL throws.

new URL("") throws; optional URL fields must be checked before parsing.

Gmail and others deliver it to "user"; validators that reject "+" lose real users.

Valid and common; some providers ignore the dots, so deduplication by string misses duplicates.

Valid; breaks SQL built by concatenation and regexes limited to [a-z0-9._].

A quoted string may contain spaces; nearly every regex rejects it and naive splitting on spaces breaks.

Splitting on the first "@" yields the wrong domain; use the last "@".

Domain literal in brackets; DNS based checks and domain allow lists do not expect it.

Valid syntax used on intranets and in tests, rejected by "needs a TLD" rules.

Domains are case insensitive, local parts technically are not; lowercasing everything can merge different mailboxes, not lowercasing creates duplicates.

Multi label domains and two part public suffixes; "last two labels" logic picks co.uk.

TLDs longer than 4 letters exist; {2,4} quantifiers reject them.

Single character local part and short domain; minimum length rules are often too strict.

The longest local part RFC 5321 allows; storage columns sized at 50 truncate it.

Valid with SMTPUTF8 (RFC 6531) but rejected by ASCII only servers; decide explicitly what you accept.

The domain must be converted to punycode for DNS and SMTP; comparing raw strings fails.

One over the RFC 5321 limit; lenient validators accept it and the SMTP server rejects it later.

No separator at all; code that splits on "@" gets one part and reads undefined.

Empty local part; split("@")[0] is "".

Empty domain; split("@")[1] is "".

Unquoted second "@" is invalid; splitting gives three parts.

A dot may not start the local part.

A dot may not end the local part (some providers accept it anyway).

Consecutive dots are not allowed unquoted.

Empty domain label; DNS lookups fail.

Host labels may not start with a hyphen.

Spaces need quoting; forms that do not trim also produce trailing spaces.

A valid mailbox header, not a bare address; pasted from mail clients into address fields.

Backslash separators: splitting on "/" returns one segment, and on POSIX this is a relative file name containing backslashes.

Windows accepts it, path.win32 understands it, path.posix treats it as relative.

Relative to the current directory of drive C, not the root; path.win32.isAbsolute returns false.

Absolute on the current drive only; the result depends on process.cwd() drive.

Starts with two backslashes; the "root" is \\server\share\, so dirname and parent walking stop there.

Disables normalization: "/" is not a separator and ".." is literal; needed beyond 260 characters.

Exceeds the classic MAX_PATH limit; many Windows tools fail without long path support.

CON, PRN, AUX, NUL, COM1 and LPT1 cannot be file names on Windows, with any extension.

Still the AUX device on Windows; repositories with this file cannot be checked out there.

Windows strips trailing dots, so "file." and "file" are the same file there but different on POSIX.

Windows strips trailing spaces as well; invisible in most UIs.

Case insensitive on default Windows and macOS file systems, so readme.md and README.md collide.

Absolute on POSIX; on Windows path.win32 treats it as root relative on the current drive.

basename("dir/sub/") is "sub", but split("/").pop() is ""; joining adds a double slash.

Equivalent to /a/b/c after normalization; string comparisons and cache keys disagree.

dirname("/") is "/" and basename is ""; loops that walk up until dirname changes must stop here.

path.join("", "") is "." and path.resolve("") is the cwd; empty is not "no path".

A path that refers to the cwd; extname(".") is "" and basename is ".".

Escapes the base directory after join; validate with path.relative after resolving.

Looks rooted in uploads/ but normalizes outside it.

Checks that only look for "../" miss backslash traversal on Windows.

extname(".env") is "", not ".env"; hidden on POSIX and easy to leak in static servers.

extname gives ".gz"; type detection and "strip the extension" give "archive.tar".

Breaks unquoted shell commands and URL building without encoding.

A legal single file name on Linux that becomes two segments on Windows.

Precomposed form, as typed on Windows and Linux.

Decomposed form produced by older macOS file systems; looks the same as the NFC name but does not match it.

Surrogate pairs in a path: byte limits, truncation and some archive tools mishandle them.

Interpreted as an option by command line tools unless passed after "--".

Legal on Linux; breaks line based tools such as `find | xargs` and log parsing.

Valid JSON that overflows the stack of recursive walkers, deep equality checks and schema validators.

Same as nested arrays for code that recurses into object values, such as deep merge and clone helpers.

Allowed by JSON.parse, which keeps the last value; other parsers keep the first or reject it, so validators and consumers disagree.

Parses to 9007199254740992: IDs silently change. Send large IDs as strings.

Valid JSON that parses to Infinity, which JSON.stringify then writes as null.

Parses to -0, but JSON.stringify(-0) is "0", so round trips lose the sign.

Parses to 1 and stringifies as "1": signatures and hashes over JSON text change after a round trip.

JSON.parse creates an own property, but merging the result into another object with assignment pollutes its prototype.

Valid; path based libraries (a.b.c syntax) cannot address it.

Valid JSON that decodes to malformed UTF-16; re-encoding to UTF-8 or a database fails.

Valid JSON that was invalid in JavaScript string literals before ES2019, which broke JSONP and inline script tags.

Valid JSON since RFC 7159; code that assumes an object reads properties of a string.

Valid JSON that parses to null; `const { a } = JSON.parse(text)` throws.

Valid; byte or regex based detectors that check the first character for "{" fail.

Windows tools write a BOM; JSON.parse throws on it, so strip it when reading files.

Accepted by JavaScript and JSON5, rejected by JSON.parse.

Common in config files (JSONC) but invalid JSON.

JavaScript object syntax, not JSON.

Python json.dumps writes NaN by default, and JSON.parse rejects it.

JavaScript object literal syntax that JSON does not allow.

An empty response body is not JSON; JSON.parse("") throws "Unexpected end of JSON input".

Unescaped tab inside a string is invalid JSON even though it looks harmless.

Truthy even though empty; reduce without a seed throws and Math.max(...[]) is -Infinity.

forEach, map and filter skip the hole but for...of and spread yield undefined, so the two styles disagree.

Looks like the hole case when printed, but every iteration method visits it and `1 in arr` is true.

new Array(5) has five holes: map returns holes, not values, and JSON.stringify writes nulls.

The maximum array length: cheap to create, but any loop to length or Array.from runs four billion times.

indexOf(NaN) is -1 while includes(NaN) is true; Set and Map treat NaN as equal to itself.

Set collapses them into one value and includes(-0) finds 0; Object.is tells them apart.

Default sort() compares strings, giving [1, 10, 100, 9]; always pass a comparator.

sort() moves undefined to the end without calling the comparator, so comparators never see it.

includes("1") and Set treat them as different, while == and loose lookups do not.

flat() and recursive flatten helpers must handle empty levels; String([[[]]]) is "".

for...in visits "extra" and Object.keys includes it, but length and JSON.stringify ignore it.

push and in place sort throw TypeError in strict mode; libraries that mutate input break.

Math.max(...arr) and fn.apply(null, arr) exceed the argument limit and throw RangeError.