fix(codegen): scalar replacement ignored own-method writes and prototype mutation (#5872) (#6324)

* fix(codegen): scalar replacement ignored own-method writes and prototype mutation (#5872)

#5466 taught codegen's escape check to keep a `new C()` receiver
scalar-replaced across a method call when `simple_scalar_method_summary`
proves the method body is a numeric read of `this.<field>`. That summary
proves the method *body* is safe to inline; it does not prove that
`obj.method` still RESOLVES to that class method at the call site.

JS lets user code break the lookup after construction, and both shapes
reached the fast path:

  * own-property shadow — `(obj as any).getValue = () => 99` writes an own
    property that wins over the prototype method. The escape check treats a
    literal-key property write on a candidate as a plain field store, so the
    receiver stayed scalar-replaced and `obj.getValue()` folded to the field
    value: 14 instead of 99.
  * prototype mutation — `C.prototype.getValue = fn`,
    `Object.defineProperty(C.prototype, …)`, `C.prototype[key] = fn`, or a
    helper/constructor/field-initializer that does any of those. None of it
    touches the receiver local, so a per-function walk cannot see it.

Before #5466 every method call escaped its receiver, so the only layer that
folded `obj.m()` into a field read was perry-transform's exact-receiver
inliner — which invalidates its facts on exactly these mutations.

Restores the missing half with two narrow fact sets:

  * `ModuleDispatchFacts` (module-scoped): every class whose prototype is
    *named* anywhere in the module — top-level init, any function body, any
    constructor / field initializer / method / accessor / computed member.
    Naming is enough, because a named prototype can be aliased and written
    through later. A prototype named through an expression that can't be
    pinned to a declared class marks the whole module opaque. Function-classic
    prototypes (`function F(){}; F.prototype.m = …`) are keyed by a synthetic
    class id and cannot rewrite a declared class's table, so they don't count.
  * per-candidate own-property writes (function-scoped): the literal property
    names written directly on each scalar-replacement candidate.

A summarized method call keeps its receiver off the heap only when the
receiver's class chain has a stable prototype and no own write shadows the
called method; otherwise the receiver escapes and takes the ordinary
heap-allocate + dispatch path, which observes the shadow exactly like Node.
Only receivers of summarized method calls are affected — plain field scalar
replacement is untouched.

Also repairs the IR guard itself, which has been failing on main since #5294
independently of this bug: it asserted the unsafe receivers allocate by
grepping for `js_inline_arena_state`, but #5294 outlined the per-new-site
inline bump allocator, so class instances now allocate via
`js_object_alloc_class_inline_keys`. The guard therefore reported "scalarized
instead of allocated" even for correctly heap-allocated receivers. It now
accepts the whole allocation-helper family — and still fails on unfixed main,
where `ownMethodWrite()` genuinely emits no allocation at all.

test-files/test_issue_945_scalar_method_guards.ts is byte-identical to
`node --experimental-strip-types` again (own method write 99, computed method
write 101, loop mutation receiver 132).

* test(codegen): unit-cover the #5872 scalar-method dispatch guard

compile-smoke (the IR guard) and parity only run on tag pushes / labeled PRs,
which is why #5466 could land this regression green. These run in cargo-test,
the PR gate:

  * an own-property write shadowing the called method escapes the receiver
    (the #5872 repro), including when the write is nested in a loop;
  * a write to a different property name does not;
  * a prototype mutation anywhere in the module — including from an unrelated
    function — escapes the receiver, while an unrelated class's mutation does
    not;
  * merely naming a class prototype marks it unstable, an unattributable
    prototype access marks the whole module opaque, and a default fact set is
    conservative.

Also fixes the two existing hir_facts tests for the new fact-graph arity.

---------

Co-authored-by: Ralph Küpper <ralph@skelpo.com>

Author: proggeramlug

crates/perry-codegen/src/codegen/closure.rs

@@ -738,6 +738,7 @@ pub(super) fn compile_closure(
         module_globals,
         classes,
         &cross_module.compile_time_constants,
+        &cross_module.module_dispatch,
     );
 
     let mut ctx = FnCtx {

crates/perry-codegen/src/codegen/entry.rs

@@ -552,6 +552,7 @@ pub(super) fn compile_module_entry(
             module_globals,
             classes,
             &cross_module.compile_time_constants,
+            &cross_module.module_dispatch,
         );
         let mut init_local_types: HashMap<u32, perry_types::Type> = HashMap::new();
         crate::boxed_vars::collect_let_types_in_stmts(&hir.init, &mut init_local_types);
@@ -1112,6 +1113,7 @@ pub(super) fn compile_module_entry(
             module_globals,
             classes,
             &cross_module.compile_time_constants,
+            &cross_module.module_dispatch,
         );
         let mut ctx = FnCtx {
             func: init_fn,

crates/perry-codegen/src/codegen/function.rs

@@ -456,6 +456,7 @@ pub(super) fn compile_function(
         module_globals,
         classes,
         &cross_module.compile_time_constants,
+        &cross_module.module_dispatch,
     );
 
     let mut ctx = FnCtx {

crates/perry-codegen/src/codegen/method.rs

@@ -371,6 +371,7 @@ pub(super) fn compile_method(
         module_globals,
         classes,
         &cross_module.compile_time_constants,
+        &cross_module.module_dispatch,
     );
 
     let mut ctx = FnCtx {
@@ -1295,6 +1296,7 @@ pub(super) fn compile_static_method(
         module_globals,
         classes,
         &cross_module.compile_time_constants,
+        &cross_module.module_dispatch,
     );
 
     let mut ctx = FnCtx {

crates/perry-codegen/src/codegen/mod.rs

@@ -1535,6 +1535,7 @@ pub fn compile_module(hir: &HirModule, opts: CompileOptions) -> Result<Vec<u8>>
         compile_time_constants,
         target_triple: triple.clone(),
         app_metadata: opts.app_metadata.clone(),
+        module_dispatch: crate::collectors::collect_module_dispatch_facts(hir),
         clamp3_functions: hir
             .functions
             .iter()

crates/perry-codegen/src/codegen/opts.rs

@@ -728,6 +728,12 @@ pub(crate) struct CrossModuleCtx {
     pub target_triple: String,
     /// App metadata backing compile-time `perry/system` introspection APIs.
     pub app_metadata: AppMetadata,
+    /// Issue #5872: module-wide record of the prototype mutations that can
+    /// change what `obj.method` resolves to. Scalar replacement consults this
+    /// before it lets a summarized method call keep its receiver off the heap —
+    /// the mutation usually lives in a *different* function (or a constructor,
+    /// or a field initializer) than the `new`, so a per-function walk misses it.
+    pub module_dispatch: crate::collectors::ModuleDispatchFacts,
     /// Functions with a 3-param clamp pattern: fid → true. Call sites
     /// emit `@llvm.smax.i32` + `@llvm.smin.i32` instead of a function call.
     pub clamp3_functions: std::collections::HashSet<u32>,

crates/perry-codegen/src/collectors/escape_news.rs

@@ -7,6 +7,7 @@ pub fn collect_non_escaping_news(
     boxed_vars: &HashSet<u32>,
     module_globals: &std::collections::HashMap<u32, String>,
     classes: &std::collections::HashMap<String, &perry_hir::Class>,
+    module_dispatch: &super::ModuleDispatchFacts,
 ) -> std::collections::HashMap<u32, String> {
     // Pass 1: find candidates — Let bindings of New that aren't boxed/global.
     let mut candidates: std::collections::HashMap<u32, String> = std::collections::HashMap::new();
@@ -51,6 +52,24 @@ pub fn collect_non_escaping_news(
         }
     }
 
+    // Pass 4 (issue #5872): a method call only keeps its receiver scalar-
+    // replaced when `simple_scalar_method_summary` accepts it (see the
+    // `Expr::Call` arm of `check_escapes_in_expr`). The summary proves the
+    // method *body* is a numeric read of `this.<field>` — it does NOT prove
+    // that `obj.method` still RESOLVES to that class method. An own-property
+    // write (`(obj as any).getValue = () => 99`) or a prototype mutation
+    // (`C.prototype.getValue = fn`, possibly from another function or from the
+    // constructor) replaces the target, and the inlined field read then returns
+    // the wrong value. Escape those receivers so they take the ordinary
+    // heap-allocate + dispatch path.
+    super::mark_unstable_scalar_method_receivers(
+        stmts,
+        &candidates,
+        classes,
+        module_dispatch,
+        &mut escaped,
+    );
+
     candidates.retain(|id, _| !escaped.contains(id));
     candidates
 }

crates/perry-codegen/src/collectors/hir_facts.rs

@@ -306,6 +306,7 @@ pub(crate) fn collect_type_facts(
     module_globals: &HashMap<u32, String>,
     classes: &HashMap<String, &perry_hir::Class>,
     compile_time_constants: &HashMap<u32, f64>,
+    module_dispatch: &super::ModuleDispatchFacts,
 ) -> TypeFacts {
     let integer_locals = super::integer_locals::collect_integer_locals(
         stmts,
@@ -323,8 +324,13 @@ pub(crate) fn collect_type_facts(
         clamp_fn_ids,
     );
     let known_noalias_buffer_locals = collect_known_noalias_buffer_locals(stmts);
-    let non_escaping_news =
-        super::escape_news::collect_non_escaping_news(stmts, boxed_vars, module_globals, classes);
+    let non_escaping_news = super::escape_news::collect_non_escaping_news(
+        stmts,
+        boxed_vars,
+        module_globals,
+        classes,
+        module_dispatch,
+    );
     let non_escaping_new_used_fields =
         super::escape_news::collect_non_escaping_new_used_fields(stmts, &non_escaping_news);
     let non_escaping_arrays =
@@ -415,6 +421,7 @@ pub(crate) fn collect_native_region_fact_graph(
     module_globals: &HashMap<u32, String>,
     classes: &HashMap<String, &perry_hir::Class>,
     compile_time_constants: &HashMap<u32, f64>,
+    module_dispatch: &super::ModuleDispatchFacts,
 ) -> NativeRegionFactGraph {
     collect_type_facts(
         stmts,
@@ -426,6 +433,7 @@ pub(crate) fn collect_native_region_fact_graph(
         module_globals,
         classes,
         compile_time_constants,
+        module_dispatch,
     )
 }
 
@@ -447,6 +455,9 @@ pub(crate) fn collect_hir_facts(
         &HashMap::new(),
         &HashMap::new(),
         &HashMap::new(),
+        // No class table here, so no scalar-method summary can apply; the
+        // conservative default keeps it that way if one ever could.
+        &super::ModuleDispatchFacts::default(),
     )
 }
 
@@ -1653,6 +1664,7 @@ mod tests {
             &HashMap::new(),
             &HashMap::new(),
             &constants,
+            &crate::collectors::ModuleDispatchFacts::default(),
         );
 
         assert!(graph.known_noalias_buffer_locals().contains(&1));
@@ -1742,6 +1754,7 @@ mod tests {
             &HashMap::new(),
             &HashMap::new(),
             &HashMap::new(),
+            &crate::collectors::ModuleDispatchFacts::default(),
         );
 
         assert!(graph.integer_locals().contains(&1));

crates/perry-codegen/src/collectors/mod.rs

@@ -21,6 +21,7 @@ mod local_refs;
 mod mutation;
 mod pointer_locals;
 mod refs;
+mod scalar_method_dispatch;
 mod scalar_methods;
 mod shadow_slots;
 mod this_as_value;
@@ -75,6 +76,9 @@ pub(crate) use pointer_locals::collect_pointer_typed_locals;
 pub(crate) use refs::{
     collect_let_ids, collect_ref_ids_in_expr, collect_ref_ids_in_stmts, is_clamp_call,
 };
+pub(crate) use scalar_method_dispatch::{
+    collect_module_dispatch_facts, mark_unstable_scalar_method_receivers, ModuleDispatchFacts,
+};
 pub(crate) use scalar_methods::simple_scalar_method_summary;
 pub(crate) use shadow_slots::{
     collect_declared_shadow_slots_in_stmts, collect_shadow_slot_clear_points,