fix(runtime): SIGPIPE, non-UTF-8 argv, and sloppy-mode array store strictness (#9402, #9401, #9394)

.gitignore

@@ -65,6 +65,14 @@ test-files/test-*
 !test-files/test_*.tsx
 !test-files/test-*.ts
 !test-files/test-*.tsx
+# A fixture that must be CommonJS in BOTH runtimes is a `.cts` (this repo's
+# package is `"type": "module"`, so a `.ts` is strict-mode ESM for Node and for
+# Perry alike). Without these it would be an ignored file — a DARK TEST, the
+# exact failure mode `scripts/check_test_registration.py` exists to prevent.
+!test-files/test_*.cts
+!test-files/test_*.mts
+!test-files/test-*.cts
+!test-files/test-*.mts
 !test-files/*/
 tests/test_*
 tests/test-*

changelog.d/9394-sloppy-array-element-store.md

@@ -0,0 +1,89 @@
+### Fixed
+
+- **A rejected array element write no longer throws in sloppy code.**
+
+  ```js
+  const a = [1]; Object.freeze(a); a[0] = 9;               // node: silent   Perry: TypeError
+  const a2 = [1]; Object.freeze(a2); a2[5] = 9;            // node: silent   Perry: TypeError
+  Object.defineProperty(a3, 0, {writable:false}); a3[0]=9; // node: silent   Perry: TypeError
+  Object.preventExtensions(a4); a4[5] = 9;                 // node: silent   Perry: TypeError
+  const o = {x:1}; Object.freeze(o); o.x = 9;              // node: silent   Perry: silent (correct)
+  ```
+
+  ES2024 §6.2.5.7 (`PutValue`) calls `Set(O, P, V, Throw)` with
+  `Throw = IsStrictReference`, so a failed `[[Set]]` throws **only in strict
+  mode** — for an Array exactly as for the ordinary object that was already
+  right. A CommonJS bundle is sloppy code from top to bottom, which is where
+  this surfaced.
+
+  Introduced by #9326 (the merge of #9297, live again on `main` via #9370).
+  That change is right about what it set out to fix — an inherited accessor
+  must run, an inherited non-writable index must reject — but it reached the
+  rejection by routing the cold element-store continuation through the STRICT
+  runtime entry unconditionally. The inline store guard declines exactly the
+  receivers whose write can be rejected (frozen, sealed, non-extensible,
+  descriptor-bearing, prototype-sensitive), so every one of those shapes
+  arrived at that continuation and threw.
+
+  The fix carries the assignment's own `Throw` flag, which codegen already had
+  and already passes to the ordinary-object `[[Set]]` and to
+  `js_dyn_index_set_strict`. Finding the target is unchanged in both modes —
+  the #9220 inherited-descriptor walk still runs, so a prototype setter still
+  fires on a sloppy assignment; only the rejection differs.
+
+  - `crates/perry-codegen/src/expr/index.rs`,
+    `crates/perry-codegen/src/expr/index_set.rs`,
+    `crates/perry-codegen/src/runtime_decls/objects.rs` — pass the site's
+    `assignment_strict` to `js_typed_feedback_array_index_set_fallback_boxed`
+    and `js_typed_feedback_array_set_index_or_string` (one new trailing `i32`
+    each).
+  - `crates/perry-runtime/src/typed_feedback.rs` — both helpers take that flag
+    and dispatch on it.
+  - `crates/perry-runtime/src/array/indexing.rs` — the strict entry's body
+    becomes strictness-parameterised (`js_array_set_f64_extend_sloppy` is the
+    sloppy twin); `array_spec_set` takes `Throw` and returns the receiver
+    unchanged instead of throwing when it is false. Array mutators keep
+    `Throw = true`: their own algorithms specify it regardless of the calling
+    code.
+  - `crates/perry-runtime/src/array/indexing_keyed.rs` — the same for the
+    numeric/string-key dispatcher.
+  - `crates/perry-runtime/src/value/dyn_index.rs` — `js_dyn_index_set_strict`
+    already carried the flag and its array arm forced `true`; it now uses it.
+
+  The realloc arm in `expr/index.rs` deliberately keeps the strict entry: it
+  runs only for a receiver the guard already accepted, which cannot reject.
+
+  Validation: `test-files/test_gap_9394_array_element_store_strictness.cts`
+  — a `.cts` file, so it is a CommonJS script in **both** runtimes, with a
+  sloppy arm and a `"use strict"` arm. **Both arms are asserted.** Asserting
+  only the throw is precisely what let this through: #9326 shipped with a
+  64-check differential and a 205-line gap fixture, all green, none of it
+  sloppy code. Byte-compared against node 26.5.1; Perry built from unfixed
+  `origin/main` reports `TypeError` for six sloppy cases where node is silent,
+  and with this change is identical to node. The #9326 fixture
+  (`test_gap_9220_9221_array_proto_paths.ts`, an ES module and therefore
+  strict) is unchanged and still byte-identical to node.
+
+  Unit tests, both arms: `array/strict_store_tests.rs`
+  `element_store_rejection_throws_only_in_strict_mode`, and #9326's own
+  `typed_feedback_array_set_guards_reject_frozen_arrays`, which now asserts the
+  silent sloppy call alongside the strict throw.
+
+  Three pieces of test infrastructure had to admit a `.cts` fixture at all —
+  each of which would have made it a **dark test**, green because it never ran:
+
+  - `run_parity_tests.sh` discovered the suite with `find … -name '*.ts'`,
+    which does **not** match `foo.cts` (the suffix is `.cts`). The fixture was
+    invisible to the harness — confirmed empirically: `--filter test_gap_9394`
+    selected 0 tests before the change and reports
+    `PASS test_gap_9394_array_element_store_strictness` after it.
+  - the same script derived a test's name with `basename … .ts`, which left
+    such a file called `…strictness.c`.
+  - `.gitignore` ignores `test-files/test_*` (compiled test binaries) and
+    re-included only `.ts` / `.tsx`, so the fixture could not be committed.
+
+  Not addressed here, found while writing the fixture: Perry emits
+  `js_put_value_set(..., strict = 0)` at **every** property-set site, so a
+  rejected *strict* ordinary-object write (`"use strict"; Object.freeze(o);
+  o.x = 9`) is silent where node throws. That is the mirror-image gap on the
+  object path and is out of scope for #9394.

changelog.d/9401-non-utf8-argv.md

@@ -0,0 +1,61 @@
+### Fixed
+
+- **A non-UTF-8 byte in `argv` no longer aborts the process.**
+  `claude -p $'\xff\xfe\x80abc\xc3\x28'` died with **SIGABRT** and a raw Rust
+  backtrace —
+
+  ```
+  panicked at library/std/src/env.rs:878:51:
+  called `Result::unwrap()` on an `Err` value: "\xFF\xFE\x80abc\xC3("
+  ```
+
+  — where node prints the program's own output. `std::env::args()` panics on an
+  argument that is not valid Unicode, and non-UTF-8 filenames are ordinary on
+  Linux, so this was trivially reachable by anything that passes a path
+  through.
+
+  Node decodes `argv` leniently: every invalid byte becomes U+FFFD. Verified
+  against node 26.5.1 — `$'\xff\xfe\x80abc\xc3\x28'` arrives as the eight code
+  points `fffd fffd fffd 61 62 63 fffd 28`, which is byte-for-byte
+  `String::from_utf8_lossy`.
+
+  - `crates/perry-runtime/src/process.rs` — one `process_args_lossy()` over
+    `std::env::args_os()`, so a single bad byte cannot resurrect the abort in
+    a path nobody thought to check.
+
+  Every `std::env::args()` reader in the runtime now goes through it. There
+  were **nine**, all reachable, and the panic was not confined to
+  `process.argv`:
+
+  - `os.rs` `js_process_argv` — `process.argv`;
+  - `node_submodules/trace_events.rs` — reads `argv` from **`js_gc_init`**, so
+    the process died before a line of JavaScript ran, whatever the program did;
+  - `process/permission.rs` (×3) — the permission-model flag scan;
+  - `process/report.rs` (×2) — `process.report`;
+  - `process/attributes.rs` — `process.title`;
+  - `cluster.rs` (×2) — `cluster` exec-path defaulting;
+  - `child_process/options.rs` — self-launch detection in `spawn`;
+  - `process.rs` `process_argv0_string` — `process.argv0` / `execPath`.
+
+  Three more outside the runtime, same shape, same fix:
+
+  - `crates/perry-stdlib/src/commander.rs` and
+    `crates/perry-ext-commander/src/lib.rs` — `program.parse()` with no
+    explicit argv;
+  - `crates/perry/src/main.rs` and `crates/perry/src/update_policy.rs` — the
+    compiler CLI's own arguments, so `perry compile` on a non-UTF-8 path
+    reports a diagnostic instead of a backtrace.
+
+  Not touched (UI crates, out of this change's scope): `perry-ui-gtk4`
+  `src/tray.rs`, `perry-ui-macos` `src/app.rs`, `perry-ui` `src/bin/styling-matrix.rs`.
+
+  `std::env::var()` needs no equivalent change: it *returns* `Err` for a
+  non-Unicode value rather than panicking, and the runtime has no
+  `env::var(..).unwrap()`.
+
+  Validation: `test-files/test_gap_9401_non_utf8_argv.ts` re-runs itself
+  through `sh` (which is byte-oriented, so it can build an argument the source
+  file cannot contain) and prints the decoded length, code points and UTF-8
+  bytes. Byte-compared against node 26.5.1; Perry built from unfixed
+  `origin/main` reports `child-status: null / child-signal: SIGABRT`, and with
+  this change is identical to node.

changelog.d/9402-sigpipe-ignored.md

@@ -0,0 +1,45 @@
+### Fixed
+
+- **A truncating consumer no longer kills a compiled program.**
+  `claude auto-mode defaults | head -2` exited **141** (128 + SIGPIPE) under
+  Perry and 0 under node — deterministically, 3 runs out of 3. Every pipeline
+  that stops reading early hit it: `| head`, `| grep -q`, `| less` followed by
+  `q`, a client that closed its socket.
+
+  The cause is structural rather than a mistake in any one function. A Perry
+  program has its **own C `main`**, emitted by codegen, so it never runs Rust's
+  `std::rt` startup — and that startup is where an ordinary Rust binary gets
+  `SIGPIPE` set to `SIG_IGN`. A compiled program therefore inherited the
+  signal's default disposition and died mid-write, with no JavaScript-visible
+  event and nothing to catch. Node (through libuv) ignores the signal and lets
+  the failing `write(2)` return `EPIPE` to the writer instead.
+
+  - `crates/perry-runtime/src/os/signal.rs` — `ignore_sigpipe_at_startup()`
+    installs `SIG_IGN`, once per process, and only over `SIG_DFL`, so an
+    embedder's own disposition and a later `process.on('SIGPIPE', …)` are both
+    left alone. Unix only: Windows has no `SIGPIPE`.
+  - `crates/perry-runtime/src/gc/mod.rs` — called from `js_gc_init`, which is
+    the first runtime call of every `main` / `perry_module_init`, so every
+    compiled program gets it before a byte can be written.
+
+  Ignoring the signal alone would have traded exit 141 for exit **134**:
+  `std`'s `println!` turns the resulting `EPIPE` into a panic, and Perry builds
+  with `panic = "abort"`. Node's console is specified never to throw
+  (`node -e 'for(;;) console.log(1)' | head -2` exits 0), so:
+
+  - `crates/perry-runtime/src/builtins/mod.rs` — the `console.*` family's
+    `println!` / `print!` / `eprintln!` are shadowed with writers that drop the
+    write error, which is exactly that contract. The shadowing is confined to
+    the `builtins` tree, alongside the pre-existing harmonyos hilog override;
+    diagnostics elsewhere in the runtime keep `std`'s macros.
+
+  Validation: `test-files/test_gap_9402_sigpipe_truncating_consumer.ts`
+  re-runs itself through `bash`, pipes 50 000 lines into `head -2`, and reports
+  the **writer's** status. Byte-compared against node 26.5.1: node
+  `writer-status=0`, Perry built from unfixed `origin/main` `writer-status=141`,
+  Perry with this change `writer-status=0`.
+
+  Known remaining gap, not addressed here: `process.stdout.write` **swallows**
+  the `EPIPE` (`os_process_streams.rs` has always discarded the write result),
+  where node emits an `'error'` event on the stream and exits 1 if it is
+  unhandled. That is a stream-plumbing change, not a signal one.

crates/perry-codegen/src/expr/index.rs

@@ -134,6 +134,12 @@ pub(crate) fn lower_index_set_fast(
     // `expr_produces_canonical_raw_f64` — the slot store may skip the
     // `js_array_numeric_value_to_raw_f64` canonicalization call entirely.
     value_is_canonical_raw_f64: bool,
+    // #9394: the assignment's own `Throw` flag (ES2024 §6.2.5.7). The guard
+    // declines exactly the receivers whose element write can be REJECTED
+    // (frozen, sealed, descriptor-bearing, prototype-sensitive), so this is
+    // the flag the fallback continuation needs to decide between a TypeError
+    // and a silent no-op.
+    assignment_strict: bool,
     feedback_site_id: &str,
 ) -> Result<()> {
     // #8583-followup: if evaluating an operand diverged — a throwing
@@ -389,6 +395,7 @@ pub(crate) fn lower_index_set_fast(
 
     ctx.current_block = guard_fallback_idx;
     {
+        let strict_flag = if assignment_strict { "1" } else { "0" };
         let fallback_box = ctx.block().call(
             DOUBLE,
             "js_typed_feedback_array_index_set_fallback_boxed",
@@ -397,6 +404,7 @@ pub(crate) fn lower_index_set_fast(
                 (DOUBLE, arr_box),
                 (DOUBLE, idx_double),
                 (DOUBLE, val_double),
+                (I32, strict_flag),
             ],
         );
         ctx.block().store(DOUBLE, &fallback_box, &slot);
@@ -754,11 +762,14 @@ pub(crate) fn lower_index_set_fast(
             "js_typed_feedback_record_fallback_call",
             &[(I64, feedback_site_id)],
         );
-        // Strict `arr[i] = v`: a frozen array's element is non-writable and a
-        // non-extensible array rejects a new index, so route to the throwing
-        // variant. (The inline fast/medium paths above are only reached for
-        // arrays with a proven dense-numeric layout, which excludes frozen /
-        // sealed / non-extensible arrays — those always fall to this call.)
+        // Growth for a receiver the guard already ACCEPTED. That guard
+        // (`plain_array_index_set_guard`) declines frozen, sealed and
+        // non-extensible arrays, descriptor-bearing arrays, and every
+        // prototype-sensitive shape — all of which take the `fallback` edge
+        // above instead — so no store reaching here can be rejected and the
+        // entry's `Throw` argument is unobservable. The strict entry is kept
+        // because it is the one that carries the fused key/policy/store
+        // path (#9394 left this arm alone deliberately).
         let new_handle = blk.call(
             I64,
             "js_array_set_f64_extend_strict",

crates/perry-codegen/src/expr/index_set.rs

@@ -284,6 +284,9 @@ fn lower_array_index_set_via_runtime_key(
     index: &Expr,
     value: &Expr,
     source_label: &str,
+    // #9394: the assignment's own `Throw` flag, carried to the runtime helper
+    // so a rejected element write is a TypeError only in strict code.
+    assignment_strict: bool,
 ) -> Result<String> {
     // #7341, same hazard as the packed path: the receiver is live across both
     // `index` and `value` lowering, and an allocating RHS is a collection
@@ -321,6 +324,7 @@ fn lower_array_index_set_via_runtime_key(
                 source_label,
                 TypedFeedbackContract::array_set_index_or_string(),
             );
+            let strict_flag = if assignment_strict { "1" } else { "0" };
             let new_handle = ctx.block().call(
                 I64,
                 "js_typed_feedback_array_set_index_or_string",
@@ -329,6 +333,7 @@ fn lower_array_index_set_via_runtime_key(
                     (I64, &arr_handle),
                     (DOUBLE, &idx_double),
                     (DOUBLE, &val_double),
+                    (I32, strict_flag),
                 ],
             );
             if let Expr::LocalGet(id) = object {
@@ -778,6 +783,7 @@ pub(crate) fn lower(
                     index.as_ref(),
                     value.as_ref(),
                     "array[dynamic_numeric_index]",
+                    assignment_strict,
                 );
             }
             // Same dispatch tree as IndexGet: known array → fast inline,
@@ -880,6 +886,7 @@ pub(crate) fn lower(
                                 index.as_ref(),
                                 value.as_ref(),
                                 "array[dynamic_numeric_index]",
+                                assignment_strict,
                             );
                         };
                         let layout_note_needed = array_store_needs_layout_note(ctx, object, value);
@@ -944,6 +951,8 @@ pub(crate) fn lower(
 
                                 ctx.current_block = fallback_idx;
                                 {
+                                    let strict_flag =
+                                        if assignment_strict { "1" } else { "0" };
                                     let fallback_box = ctx.block().call(
                                         DOUBLE,
                                         "js_typed_feedback_array_index_set_fallback_boxed",
@@ -952,6 +961,7 @@ pub(crate) fn lower(
                                             (DOUBLE, &arr_box),
                                             (DOUBLE, &idx_double),
                                             (DOUBLE, &val_double),
+                                            (I32, strict_flag),
                                         ],
                                     );
                                     if let Some(slot) = ctx.locals.get(arr_id).cloned() {
@@ -1180,6 +1190,7 @@ pub(crate) fn lower(
                                 value_is_numeric,
                                 require_numeric_layout,
                                 value_is_canonical_raw_f64,
+                                assignment_strict,
                                 &feedback_site_id,
                             )?;
                         } else if let Some(global_name) = ctx.module_globals.get(&id).cloned() {

crates/perry-codegen/src/runtime_decls/objects.rs

@@ -462,10 +462,11 @@ pub fn declare_phase_b_objects(module: &mut LlModule) {
         I32,
         &[I64, DOUBLE, DOUBLE],
     );
+    // Trailing I32: the assignment's own strict/`Throw` flag (#9394).
     module.declare_function(
         "js_typed_feedback_array_index_set_fallback_boxed",
         DOUBLE,
-        &[I64, DOUBLE, DOUBLE, DOUBLE],
+        &[I64, DOUBLE, DOUBLE, DOUBLE, I32],
     );
     module.declare_function(
         "js_typed_feedback_observe_array_element",
@@ -477,10 +478,11 @@ pub fn declare_phase_b_objects(module: &mut LlModule) {
         I64,
         &[I64, I64, I64, DOUBLE],
     );
+    // Trailing I32: the assignment's own strict/`Throw` flag (#9394).
     module.declare_function(
         "js_typed_feedback_array_set_index_or_string",
         I64,
-        &[I64, I64, DOUBLE, DOUBLE],
+        &[I64, I64, DOUBLE, DOUBLE, I32],
     );
     module.declare_function(
         "js_typed_feedback_object_set_index_polymorphic",

crates/perry-ext-commander/src/lib.rs

@@ -290,7 +290,12 @@ fn resolve_parse_args(argv: f64) -> Vec<String> {
             return out.into_iter().skip(2).collect();
         }
     }
-    std::env::args().skip(1).collect()
+    // #9401: `std::env::args()` panics on a non-UTF-8 argument; Node decodes
+    // argv leniently (every invalid byte becomes U+FFFD) and so must this.
+    std::env::args_os()
+        .skip(1)
+        .map(|arg| arg.to_string_lossy().into_owned())
+        .collect()
 }
 
 /// Top-level parse entry. The second arg is the user's `parse(argv)`