[Bug]: Tree-shaking drops new ArrayBuffer(-1) and malformed decodeURIComponent / encodeURI calls that throw #11550

Reproduction link or steps

https://gist.github.com/trackoor/04c59457a8f7df159782d5d8c8d69810

// m.js
try { const x = new ArrayBuffer(-1); console.log('no throw'); } catch (e) { console.log(e.constructor.name); }
try { const x = decodeURIComponent('%'); console.log('no throw'); } catch (e) { console.log(e.constructor.name); }
try { const x = encodeURI('\uD800'); console.log('no throw'); } catch (e) { console.log(e.constructor.name); }

// main.js
import './m.js';

Run:

npx rolldown main.js -o out.mjs && node out.mjs

What is expected?

Tree-shaking preserves the throwing new ArrayBuffer(-1), decodeURIComponent('%'), and encodeURI('\uD800') calls (as Node, Rollup, esbuild, and webpack do, and as Rolldown does for new Int8Array(-1)), printing:

RangeError
URIError
URIError

What is actually happening?

Rolldown strips all three unused const x = ... declarations and prints:

no throw
no throw
no throw

System Info

  System:
    OS: macOS 26.3
    CPU: (14) arm64 Apple M3 Max
    Memory: 861.34 MB / 36.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 24.14.1 - /Users/hanzhi/.nvm/versions/node/v24.14.1/bin/node
    Yarn: 1.22.22 - /opt/homebrew/bin/yarn
    npm: 11.11.0 - /Users/hanzhi/.nvm/versions/node/v24.14.1/bin/npm
    pnpm: 11.24.0 - /opt/homebrew/bin/pnpm
  Browsers:
    Chrome: 156.0.8078.80
    Safari: 26.3
  npmPackages:
    rolldown: ^1.3.0 => 1.3.0

Any additional comments?

new ArrayBuffer(-1) throws RangeError on negative indices, and decodeURIComponent('%') / encodeURI('\uD800') throw URIError on malformed percent-escapes or unpaired surrogates, but side-effect detection only checks new ArrayBuffer(arg) for Symbol/BigInt arguments and treats decodeURI/decodeURIComponent/encodeURI/encodeURIComponent as unconditionally pure regardless of literal arguments.

Credit: https://ucsbplse.github.io/