url: href setter converts its value before validating the receiver #67344

This issue was drafted with the help of LLMs (Claude and Codex); I reviewed it and verified the reproductions.

Version

v26.13.0. Also reproduced on v20.20.2, v22.23.4 and v24.22.2.

Platform

macOS 26.7, Darwin 25.6.0, arm64

Subsystem

url / WHATWG URL

What steps will reproduce the bug?

Run this directly with Node.js; no dependencies or polyfills are involved:

const setHref = Object.getOwnPropertyDescriptor(URL.prototype, 'href').set;
let calls = 0;

try {
  setHref.call({}, {
    toString() {
      calls++;
      return 'https://example.com/';
    },
  });
} catch (error) {
  console.log(error.name);
}

console.log(calls);

How often does it reproduce? Is there a required condition?

Always, when calling the href setter with an incompatible receiver and a value whose string conversion has an observable side effect.

What is the expected behavior? Why is that the expected behavior?

TypeError
0

The Web IDL attribute setter algorithm rejects a receiver that does not implement the interface before converting the assigned value to the attribute's IDL type. Therefore, the toString() method must not be called here.

What do you see instead?

TypeError
1

The setter invokes toString() and only then rejects the receiver.

Additional information

Tested regression boundary:

The conversion was moved before the private-state access in #47339. The same order is still present in this main-branch source snapshot: the href setter converts the value before accessing this.#context, which rejects an incompatible receiver. The runtime results above are from the listed Node.js releases; the main snapshot was inspected separately.

This regresses the receiver-before-conversion behavior present after #39752.

The same snippet produces the expected output in Chromium 156.0.8078.4, Firefox 157.0 and WebKit 27.2 (Playwright builds), as well as Bun 1.4.4 and Deno 2.9.7.