ECMA-262 changed the signature of the CreateBuiltinFunction abstract op last year. Perhaps there were changes on both sides around the same time or something, though, since the PR says it “preserves compatibility for WebIDL,” but it seems all 30 usages in Web IDL are incorrect now.

PREVIOUS SIGNATURE: ( steps, internalSlotsList [ , realm [ , prototype ] ] )
CURRENT SIGNATURE:  ( behaviour, length, name, additionalInternalSlotsList [ , realm [ , prototype [ , prefix ] ] ] )

Web IDL usages all look like one of these:

CreateBuiltinFunction(steps, « [[Unforgeables]] », realm, constructorProto).
CreateBuiltinFunction(steps, « », realm)
CreateBuiltinFunction(steps, « »)

Explicit names and lengths are required. In cases where Web IDL is already setting them afterwards, it’d just become a single call:

// ...where it’s currently like this:
Let F be ! CreateBuiltinFunction(steps, « », realm).
Perform ! SetFunctionName(F, id).
Perform ! SetFunctionLength(F, 0).

// ...it should be like this:
Let F be ! CreateBuiltinFunction(steps, 0, id, « », realm).

Web IDL doesn’t always set a name or length, though. I’m not certain what’s right for those cases, but it looks like they’re all Promise-related and mirror patterns in ECMA-262. Since the ES versions already use the new signature, it’s likely their values (e.g. empty string for name) are what’s wanted here, too.

• Let onFulfilled be ! {...web idl...} (at step 4)
• Let onFulfilled be ! {...es...} (at step 8)

(Possibly of interest to @ExE-Boss, the boss of ExEs.)