fix(runtime): indexed writes and the generic array engine honour a custom prototype chain

changelog.d/9220-array-prototype-index-paths.md

@@ -0,0 +1,25 @@
+### fix(runtime): honor inherited array indices in writes and borrowed methods
+
+Indexed assignment on an array with a recorded custom prototype now performs
+the inherited descriptor walk before creating an own element. Prototype
+setters therefore run with the array as their receiver, inherited non-writable
+data properties reject the assignment, and inherited writable data properties
+still allow the normal own-property creation.
+
+The generic array-like engine used by `Array.prototype.<method>.call(array)`
+now uses the same recorded-prototype classification for `Get` and
+`HasProperty`. Prototype-filled holes are consequently visible to `join`,
+`indexOf`, `map`, `forEach`, and the other generic methods. Default-chain
+arrays retain their existing fast paths, while Proxy prototypes keep their
+dedicated trap handling. Fixes #9220 and #9221.
+
+The `[[Set]]` owner walk takes the same chain hops the `[[Get]]` walk takes:
+`Object.create(p)` models its link with a synthetic class id rather than a
+recorded prototype (#809), so without that hop an inherited accessor two links
+up was still silently replaced by an own element.
+
+Every one of the three new gates leads with the existing `array_static_proto_recorded`
+process latch, so a program that never retargets an array keeps the previous
+code path exactly — the strict store's number lane does not even read the slot
+it is about to write, and the cold store tail performs no prototype-registry
+probe.

crates/perry-runtime/src/array/generic.rs

@@ -430,6 +430,13 @@ pub(super) fn al_get(recv: f64, k: i64) -> f64 {
         if k < 0 {
             return undef();
         }
+        // #9221: explicit Array.prototype.<method>.call(array, ...) must use
+        // the same recorded-prototype Get as a direct `array[k]`. Default-chain
+        // arrays retain the old `js_array_get_f64` lane, and Proxy prototypes
+        // remain on their dedicated path (the classification returns None).
+        if real_array_uses_recorded_spec_path(arr) {
+            return crate::array::array_spec_get(arr, k as u32);
+        }
         return js_array_get_f64(arr, k as u32);
     }
     let b = recv.to_bits();
@@ -535,6 +542,17 @@ fn object_get_property_chain(obj_ptr: usize, k: i64) -> f64 {
     undef()
 }
 
+/// Whether a genuine Array receiver must use the #9219 recorded-prototype
+/// classification for indexed Get/HasProperty. The process latch keeps the
+/// per-array side-table probe out of programs that never retarget an array;
+/// the classification itself excludes Proxy prototypes so their existing
+/// dedicated trap path is not invoked twice.
+#[inline]
+fn real_array_uses_recorded_spec_path(arr: *const ArrayHeader) -> bool {
+    crate::object::prototype_chain::array_static_proto_recorded()
+        && unsafe { crate::array::array_custom_prototype(arr).is_some() }
+}
+
 /// `HasProperty(ToObject(recv), k)`.
 pub(super) fn al_has(recv: f64, k: i64) -> bool {
     if k < 0 {
@@ -548,8 +566,17 @@ pub(super) fn al_has(recv: f64, k: i64) -> bool {
             }
             let el = *((arr as *const u8).add(std::mem::size_of::<ArrayHeader>()) as *const f64)
                 .add(k as usize);
-            return el.to_bits() != TAG_HOLE;
+            if el.to_bits() != TAG_HOLE {
+                return true;
+            }
         }
+        // #9221: a hole is absent only from the receiver. On a retargeted
+        // array, HasProperty must walk the recorded chain; this is exactly the
+        // `ArrayCustomProto::{Null, Array, Other}` policy used by direct reads.
+        if real_array_uses_recorded_spec_path(arr) {
+            return crate::array::array_spec_has_index(arr, k as u32);
+        }
+        return false;
     }
     let b = recv.to_bits();
     if is_string_value(b) {