fix(runtime): #9192 — an array with a non-array [[Prototype]] inherited nothing (47 divergences from node → 19)

changelog.d/9192-array-object-prototype.md

@@ -0,0 +1,19 @@
+### fix(runtime): an array retargeted to a non-array prototype inherits from it
+
+`Object.setPrototypeOf(arr, someObject)` recorded the new `[[Prototype]]` —
+and paid the process-wide array-index deoptimisation for it — but the lookup
+paths then declined to consult it: the index probe accepted a recorded
+prototype only when the prototype was itself an array, and the named-property
+fallback hardcoded `Array.prototype`. A retargeted array therefore inherited
+nothing from its new prototype while still inheriting everything from the old
+one, with no error: `a[7]` and `a.foo` were `undefined`, `7 in a` was `false`,
+and `typeof a.map` was still `"function"`.
+
+Index reads/`in`/writes, named reads, `in` on a name, `arr.constructor`,
+`arr.__proto__`, symbol-keyed reads, and method dispatch (`arr.first()`, the
+ES5 `MyList.prototype = Object.create(Array.prototype)` idiom) now all resolve
+through the recorded chain, with the array bound as the receiver so a
+prototype accessor observes the right `this`. `Object.setPrototypeOf(arr,
+null)` correctly inherits nothing at all. Named properties on an *array*
+prototype, which never resolved either, are fixed by the same change. Arrays
+with the default prototype are untouched. Fixes #9192.

crates/perry-runtime/src/array/keys_len_cap_tests.rs

@@ -0,0 +1,55 @@
+//! Test-only bounds and receiver checks split out of `indexing.rs` to keep
+//! it under the 2000-line cap. The modules are unchanged; only their home
+//! file moved.
+
+#[cfg(test)]
+mod keys_len_cap_tests {
+    use crate::array::js_array_length;
+    use crate::array::keys_array_len_capped_to_capacity;
+
+    #[test]
+    fn keys_len_capped_bounds_bogus_length_to_capacity() {
+        // Freshly-allocated array: well-formed (length 0 <= capacity), so the
+        // cap is a no-op and returns the real length.
+        let arr = crate::array::js_array_alloc(8);
+        let capacity = unsafe { (*arr).capacity } as usize;
+        assert!(capacity >= 8);
+        assert_eq!(unsafe { keys_array_len_capped_to_capacity(arr) }, 0);
+
+        // Simulate a malformed keys array whose length field reports a bogus,
+        // pointer-sized value — the pathology the object property walks guard
+        // against. Un-capped, callers would iterate/allocate ~645M slots.
+        unsafe {
+            (*arr).length = 645_115_168;
+        }
+        assert_eq!(
+            js_array_length(arr) as usize,
+            645_115_168,
+            "sanity: js_array_length reflects the forged length"
+        );
+        assert_eq!(
+            unsafe { keys_array_len_capped_to_capacity(arr) },
+            capacity,
+            "cap must bound a bogus oversized length to the array's capacity"
+        );
+    }
+}
+
+#[cfg(test)]
+mod claimed_array_string_receiver_tests {
+    use crate::array::indexing::array_get_property_by_key;
+
+    #[test]
+    fn numeric_string_key_reads_a_heap_string_before_by_name_fallback() {
+        let receiver = crate::string::js_string_from_bytes(b"ss".as_ptr(), 2);
+        let zero = crate::string::js_string_from_bytes(b"0".as_ptr(), 1);
+        let indexed = array_get_property_by_key(receiver.cast(), zero);
+        assert_eq!(
+            crate::builtins::jsvalue_string_content(indexed).as_deref(),
+            Some("s")
+        );
+
+        let length = crate::string::js_string_from_bytes(b"length".as_ptr(), 6);
+        assert_eq!(array_get_property_by_key(receiver.cast(), length), 2.0);
+    }
+}

crates/perry-runtime/src/array/mod.rs

@@ -13,6 +13,14 @@ mod header;
 mod header_gc_slots;
 mod immutable;
 mod indexing;
+/// Keys-array length-cap bounds tests, split out of `indexing.rs` for the
+/// 2000-line cap.
+#[cfg(test)]
+mod keys_len_cap_tests;
+/// Test-only strict-dense store helpers, split out of `indexing.rs` for the
+/// 2000-line cap.
+#[cfg(test)]
+mod strict_dense_test_helpers;
 #[cfg(test)]
 pub(crate) use indexing::test_element_accessor_calls;
 mod indexing_support;

crates/perry-runtime/src/array/strict_dense_test_helpers.rs

@@ -0,0 +1,24 @@
+//! Test-only strict-dense store helpers, split out of `indexing.rs` to keep
+//! it under the 2000-line cap. `#![cfg(test)]` at module level, so the
+//! per-item `#[cfg(test)]` attributes the originals carried are dropped.
+
+#![cfg(test)]
+
+use super::indexing::{try_strict_dense_number_store, try_strict_dense_pointer_overwrite};
+use super::*;
+
+pub(crate) fn test_strict_dense_pointer_overwrite(
+    arr: *mut ArrayHeader,
+    index: u32,
+    value: f64,
+) -> bool {
+    unsafe { try_strict_dense_pointer_overwrite(arr, index, value) }.is_some()
+}
+
+pub(crate) fn test_strict_dense_number_store(
+    arr: *mut ArrayHeader,
+    index: u32,
+    value: f64,
+) -> bool {
+    unsafe { try_strict_dense_number_store(arr, index, value) }.is_some()
+}

crates/perry-runtime/src/object/field_get_set.rs

@@ -197,6 +197,9 @@ pub(crate) fn is_fetch_subclass_body_method(name: &[u8]) -> bool {
 // ── Topical sub-modules (issue #1103: keep every file < 2000 lines) ──
 mod accessors;
 pub(crate) use accessors::scan_accessor_receiver_override_root_mut;
+/// #9192 array prototype/constructor slots, split out of
+/// `get_field_by_name_tail.rs` for the 2000-line cap.
+mod array_retargeted_proto;
 mod buffer_own_prop;
 mod class_object_props;
 mod crypto_key;
@@ -277,8 +280,8 @@ pub(crate) use get_field_by_name_async::async_resource_property;
 pub(crate) use get_field_by_name_tail::get_field_by_name_object_tail;
 pub(super) use has_property::native_module_own_field_by_key;
 pub(crate) use has_property::{
-    closure_dynamic_prop_by_key, reified_function_method_name, wide_key_index_lookup,
-    wide_key_index_note_hit, WIDE_KEY_INDEX_MIN_KEYS,
+    closure_dynamic_prop_by_key, prototype_value_has_property, reified_function_method_name,
+    wide_key_index_lookup, wide_key_index_note_hit, WIDE_KEY_INDEX_MIN_KEYS,
 };
 pub use has_property::{js_in_operator, js_object_has_property};
 #[cfg(test)]

crates/perry-runtime/src/object/field_get_set/accessors.rs

@@ -687,6 +687,42 @@ pub(crate) unsafe fn array_prototype_property_value(
     let name_copy = super::HeapKeyBytes::copy_of(name.as_bytes());
     let name: &str = std::str::from_utf8_unchecked(name_copy.as_bytes());
 
+    // #9192: an explicit `Object.setPrototypeOf(arr, p)` REPLACES the implicit
+    // `Array.prototype` chain this function otherwise hardcodes. Before the fix
+    // a retargeted array both failed to inherit `p`'s named properties AND kept
+    // inheriting `Array.prototype`'s — `Object.setPrototypeOf(a, {foo:1})` left
+    // `a.foo` undefined while `typeof a.map` stayed `"function"` (node: `1` and
+    // `"undefined"`). `null` inherits nothing at all.
+    //
+    // The two callers that pass a NON-array receiver here
+    // (`array_subclass_prototype_field` and the `fill` fallback in
+    // `native_call_method`) already require the absence of a recorded
+    // prototype, so this branch is reachable only for a retargeted array.
+    if let Some(proto_bits) = super::super::prototype_chain::object_static_prototype(receiver_addr)
+    {
+        if proto_bits == crate::value::TAG_NULL {
+            return None;
+        }
+        let scope = crate::gc::RuntimeHandleScope::new();
+        let receiver_h =
+            scope.root_nanbox_f64(crate::value::js_nanbox_pointer(receiver_addr as i64));
+        let proto_h = scope.root_heap_word_u64(proto_bits);
+        let key = crate::string::js_string_from_bytes(name.as_ptr(), name.len() as u32);
+        if key.is_null() {
+            return None;
+        }
+        let key_h = scope.root_nanbox_f64(crate::value::nanbox_string_key(key));
+        let receiver_addr =
+            crate::value::js_nanbox_get_pointer(receiver_h.get_nanbox_f64()) as usize;
+        let key = crate::value::js_nanbox_get_pointer(key_h.get_nanbox_f64())
+            as *const crate::StringHeader;
+        return super::super::prototype_chain::resolve_inherited_field_from_prototype(
+            receiver_addr,
+            proto_h.get_heap_word_u64(),
+            key,
+        );
+    }
+
     let scope = crate::gc::RuntimeHandleScope::new();
     let receiver_h = scope.root_nanbox_f64(crate::value::js_nanbox_pointer(receiver_addr as i64));
     let ctor = super::super::js_get_global_this_builtin_value(b"Array".as_ptr(), 5);

crates/perry-runtime/src/object/field_get_set/array_retargeted_proto.rs

@@ -0,0 +1,41 @@
+//! #9192: array property slots that a retargeted `[[Prototype]]` changes.
+//!
+//! Split out of `get_field_by_name_tail.rs`, which is at the 2000-line cap.
+//! Both slots answer off the static-prototype side table rather than the
+//! implicit array chain, because a recorded custom `[[Prototype]]` replaces
+//! that chain entirely.
+
+use super::accessors::array_prototype_property_value;
+use crate::value::JSValue;
+
+/// `arr.__proto__` IS the array's `[[Prototype]]` — the spec models it as an
+/// `Object.prototype` accessor returning `[[GetPrototypeOf]](this)`. Without
+/// this a retargeted array reported the WRONG object while
+/// `Object.getPrototypeOf(arr)` reported the right one.
+pub(super) fn array_proto_slot(obj: *const crate::object::ObjectHeader) -> JSValue {
+    // `__proto__` itself lives on `Object.prototype`, so an array whose chain
+    // no longer reaches it (an explicit null prototype) has no such property.
+    if crate::object::prototype_chain::object_static_prototype(obj as usize)
+        == Some(crate::value::TAG_NULL)
+    {
+        return JSValue::undefined();
+    }
+    let receiver = crate::value::js_nanbox_pointer(obj as i64);
+    let proto =
+        crate::object::object_ops::js_object_get_prototype_of(f64::from_bits(receiver.to_bits()));
+    JSValue::from_bits(proto.to_bits())
+}
+
+/// A recorded custom `[[Prototype]]` replaces the whole implicit chain, so
+/// `constructor` must resolve through it — a plain `{}` prototype answers
+/// `Object`, not `Array` — rather than short-circuiting to the global `Array`.
+/// `None` means no retarget was recorded and the caller keeps its fast path.
+pub(super) fn array_constructor_slot(obj: *const crate::object::ObjectHeader) -> Option<JSValue> {
+    crate::object::prototype_chain::object_static_prototype(obj as usize)?;
+    // SAFETY: the caller has already established `obj` as a live array
+    // header; this reads the recorded prototype's own properties.
+    Some(
+        unsafe { array_prototype_property_value("constructor", obj as usize) }
+            .unwrap_or_else(JSValue::undefined),
+    )
+}

crates/perry-runtime/src/object/field_get_set/get_field_by_name_tail.rs

@@ -889,6 +889,15 @@ pub(crate) fn get_field_by_name_object_tail(
                 if key_bytes == b"length" {
                     return JSValue::number(crate::array::js_array_length(arr) as f64);
                 }
+                // #9192: `arr.__proto__` IS the array's `[[Prototype]]` (the
+                // spec models it as an `Object.prototype` accessor returning
+                // `[[GetPrototypeOf]](this)`) — the same shape the closure arm
+                // above resolves off the static-prototype side table. Without
+                // it a retargeted array reported the WRONG object here while
+                // `Object.getPrototypeOf(arr)` reported the right one.
+                if key_bytes == b"__proto__" {
+                    return super::array_retargeted_proto::array_proto_slot(obj);
+                }
                 // date-fns / drizzle / lodash duck-typing path:
                 // `arr.constructor === Array`, `new arr.constructor(...)`,
                 // etc. expect a non-undefined function-typed value that
@@ -906,6 +915,13 @@ pub(crate) fn get_field_by_name_object_tail(
                     if let Some(v) = crate::array::array_named_property_get(arr, key) {
                         return JSValue::from_bits(v.to_bits());
                     }
+                    // A recorded custom `[[Prototype]]` replaces the whole
+                    // implicit chain, so `constructor` must be resolved through
+                    // it (a plain `{}` prototype answers `Object`, not `Array`)
+                    // rather than short-circuiting to the global `Array`. #9192.
+                    if let Some(v) = super::array_retargeted_proto::array_constructor_slot(obj) {
+                        return v;
+                    }
                     let v = js_get_global_this_builtin_value(b"Array".as_ptr(), 5);
                     return JSValue::from_bits(v.to_bits());
                 }

crates/perry-runtime/src/object/field_get_set/has_property.rs

@@ -1251,6 +1251,49 @@ unsafe fn ordinary_has_property(
     ordinary_object_prototype_property_value(last_valid, key).is_some()
 }
 
+/// #9192: ECMA-262 `[[HasProperty]]` on a value that is serving as some other
+/// object's recorded `[[Prototype]]`.
+///
+/// The array index / named-key `in` arms need this: their receiver is an
+/// `ArrayHeader`, so they cannot enter [`ordinary_has_property`]'s object walk
+/// on the receiver itself, but the recorded prototype they must consult is an
+/// ordinary object (or another array — the walk handles both). `TAG_NULL`
+/// answers `false`: `Object.setPrototypeOf(arr, null)` inherits nothing.
+pub(crate) unsafe fn prototype_value_has_property(
+    proto_bits: u64,
+    key: *const crate::StringHeader,
+) -> bool {
+    const TAG_NULL: u64 = 0x7FFC_0000_0000_0002;
+    if proto_bits == TAG_NULL || key.is_null() {
+        return false;
+    }
+    let proto_val = f64::from_bits(proto_bits);
+    if crate::proxy::js_proxy_is_proxy(proto_val) != 0 {
+        let key_val = f64::from_bits(crate::value::js_nanbox_string(key as i64).to_bits());
+        return crate::value::js_is_truthy(crate::proxy::js_proxy_has(proto_val, key_val)) != 0;
+    }
+    let top16 = proto_bits >> 48;
+    let proto_ptr = if top16 == 0x7FFD {
+        (proto_bits & crate::value::POINTER_MASK) as usize
+    } else if top16 == 0 && crate::value::addr_class::is_above_handle_band(proto_bits as usize) {
+        // The literal floor here was 0x10000, an order of magnitude BELOW
+        // HANDLE_BAND_MAX (0x100000), so this raw-pointer branch admitted
+        // handle-band values and handed them to a dereference.
+        proto_bits as usize
+    } else {
+        return false;
+    };
+    // Band predicate before the validity check (#6279): a handle value is
+    // below HANDLE_BAND_MAX and must not reach a dereference.
+    if proto_ptr == 0
+        || !crate::value::addr_class::is_above_handle_band(proto_ptr as usize)
+        || !super::super::is_valid_obj_ptr(proto_ptr as *const u8)
+    {
+        return false;
+    }
+    ordinary_has_property(proto_ptr as *const ObjectHeader, key)
+}
+
 /// Get a field by its string key name
 /// Returns the field value or undefined if the key is not found
 pub(crate) unsafe fn closure_dynamic_prop_by_key(

crates/perry-runtime/src/object/native_call_method/handle_methods.rs

@@ -227,6 +227,25 @@ pub(super) unsafe fn dispatch_handle(
                         return Some(result);
                     }
                 }
+                // #9192: `Object.setPrototypeOf(arr, p)` REPLACES the implicit
+                // `Array.prototype` chain, so a method that lives on `p` — the
+                // ES5 subclass idiom `MyList.prototype = Object.create(
+                // Array.prototype); MyList.prototype.first = …` — is the one
+                // `arr.first()` must call. Without this the built-in arms below
+                // never matched the name and the call fell through to the
+                // tower's non-object tail, which answers the null-object stub.
+                // Same walker Wall 10 uses for `Object.setPrototypeOf(handle,
+                // proto)`; it costs one side-table probe that answers `None`
+                // for every array with the default prototype.
+                if let Some(result) = dispatch_handle_proto_method(
+                    crate::array::clean_arr_ptr(arr) as usize,
+                    f64::from_bits(jsval.bits()),
+                    method_name,
+                    args_ptr,
+                    args_len,
+                ) {
+                    return Some(result);
+                }
                 // #6658: an explicit `thisArg` (2nd argument) must bind the
                 // callback's `this`. The dense helpers the arms below dispatch
                 // to deliberately bind `undefined` (spec: absent thisArg) and

crates/perry-runtime/src/symbol/get.rs

@@ -279,6 +279,34 @@ unsafe fn req_handle_symbol_fallback(obj_f64: f64, sym_f64: f64) -> Option<f64>
 }
 
 unsafe fn object_header_ptr_from_value_bits(bits: u64) -> Option<usize> {
+    let (raw, obj_type) = heap_ptr_and_type_from_value_bits(bits)?;
+    if obj_type == crate::gc::GC_TYPE_OBJECT {
+        Some(raw)
+    } else {
+        None
+    }
+}
+
+/// #9192: [`object_header_ptr_from_value_bits`] for the RECEIVER position,
+/// which may be a real array (`Object.setPrototypeOf(arr, {[S]: v})`). Only the
+/// ADDRESS is used here — as the key of the recorded-`[[Prototype]]` lookup —
+/// so an `ArrayHeader` is safe, while the chain HOPS still require a genuine
+/// `GC_TYPE_OBJECT` before anything is dereferenced as one.
+unsafe fn receiver_ptr_from_value_bits(bits: u64) -> Option<usize> {
+    let (raw, obj_type) = heap_ptr_and_type_from_value_bits(bits)?;
+    if obj_type == crate::gc::GC_TYPE_OBJECT
+        || obj_type == crate::gc::GC_TYPE_ARRAY
+        || obj_type == crate::gc::GC_TYPE_LAZY_ARRAY
+    {
+        Some(raw)
+    } else {
+        None
+    }
+}
+
+/// Validate a value's bits as a live tracked heap allocation and report its
+/// address together with its GC type byte.
+unsafe fn heap_ptr_and_type_from_value_bits(bits: u64) -> Option<(usize, u8)> {
     let top16 = bits >> 48;
     let raw = if top16 == 0x7FFD {
         (bits & POINTER_MASK) as usize
@@ -304,11 +332,7 @@ unsafe fn object_header_ptr_from_value_bits(bits: u64) -> Option<usize> {
     if !tracked_malloc && !(arena_payload && arena_header) {
         return None;
     }
-    if (*gc_header).obj_type == crate::gc::GC_TYPE_OBJECT {
-        Some(raw)
-    } else {
-        None
-    }
+    Some((raw, (*gc_header).obj_type))
 }
 
 /// Walk the explicit static prototype chain to find an inherited symbol property.
@@ -320,7 +344,11 @@ pub(crate) unsafe fn inherited_symbol_property(obj_f64: f64, sym_f64: f64) -> Op
 
 unsafe fn resolve_explicit_object_prototype_symbol(obj_f64: f64, sym_f64: f64) -> Option<f64> {
     const TAG_NULL: u64 = 0x7FFC_0000_0000_0002;
-    let mut owner = object_header_ptr_from_value_bits(obj_f64.to_bits())?;
+    // #9192: the receiver may be a real ARRAY with a retargeted `[[Prototype]]`
+    // (`Object.setPrototypeOf(arr, {[S]: v})`). Its address is only a lookup
+    // key here, so accept it; every chain HOP below still demands a real
+    // `GC_TYPE_OBJECT` before dereferencing.
+    let mut owner = receiver_ptr_from_value_bits(obj_f64.to_bits())?;
     let mut visited_buf = [0usize; 16];
     let mut visited_len = 0usize;
     let mut visited_overflow: Option<std::collections::HashSet<usize>> = None;