fix(runtime): #5844 — Proxy trap dispatch fixes across getOwnPropertyDescriptor, has, set, and setPrototypeOf

Fixes 12 of 33 test262 built-ins/Proxy failures, zero regressions
(verified against built-ins/Proxy, built-ins/Object, built-ins/Reflect,
language/expressions/in — 219/219/3132/101/15 pass respectively).

Root causes, all variations on "a Proxy is a small registered id, not a
real heap pointer, and several generic object-machinery code paths
either mis-treated it as one or never checked for it at all":

- js_reflect_get_own_property_descriptor: the missing-trap fallback read
  the target's descriptor via the raw ObjectHeader path even when the
  target was itself a Proxy; now recurses through the Reflect entry
  point so a chain of trap-less proxies forwards correctly.

- ordinary_has_property (the `in` operator's prototype-chain walk) and
  its array-fast-path counterpart didn't recognize a Proxy sitting in
  the recorded `[[Prototype]]` chain, silently returning false (or
  reading garbage) instead of dispatching the proxy's `has` trap.

- ordinary_set_with_receiver's prototype-chain walk had the same gap on
  the write side, and `js_proxy_set`/`Reflect.set` didn't thread a
  distinct `receiver` through to the trap when a Proxy was reached via
  a prototype hop rather than as the direct assignment target.

- Object.create(proto) and Object.setPrototypeOf(obj, proto) rejected a
  Proxy `proto` argument outright (their "is this an object" checks
  don't recognize the small registered id), and Object.create had no
  path to record a Proxy prototype at all — it can't be modeled via the
  synthetic-class-id machinery used for real prototype objects, so route
  it through the same static-prototype side table setPrototypeOf uses.

- Object.setPrototypeOf's cycle-detection walk called
  `[[GetPrototypeOf]]` unconditionally while probing the candidate
  prototype's chain, including on a Proxy — invoking its trap as an
  unrelated side effect of cycle-safety bookkeeping (OrdinarySetPrototypeOf
  step 7.b.ii.1 says to stop the walk there instead).

Also fixed, found while debugging the above with a fresh (Proxy-free)
repro: the cycle-detection loop's Floyd's tortoise-and-hare walk only
guarded `tortoise` against an already-null position before advancing;
`hare` (which steps twice per iteration) had no equivalent guard, so a
2-hop-to-null prototype chain re-advanced an already-null `hare` and
threw "Cannot convert undefined or null to object" on a plain, entirely
ordinary `Object.setPrototypeOf({}, {foo: 1})`.

Refs #5844.

Author: Ralph

crates/perry-runtime/src/object/descriptors.rs

@@ -1368,6 +1368,7 @@ pub extern "C" fn js_object_create_with_props(proto_value: f64, props_value: f64
     let proto_jv = crate::value::JSValue::from_bits(proto_value.to_bits());
     let proto_is_symbol = unsafe { crate::symbol::js_is_symbol(proto_value) != 0 };
     let proto_ok = proto_jv.is_null()
+        || crate::proxy::js_proxy_is_proxy(proto_value) != 0
         || (!proto_is_symbol
             && (unsafe { value_is_object_like(proto_value) }
                 || super::class_ref_id(proto_value).is_some()));

crates/perry-runtime/src/object/field_get_set/has_property.rs

@@ -295,6 +295,18 @@ pub extern "C" fn js_object_has_property(obj: f64, key: f64) -> f64 {
                 // / `arr.hasOwnProperty(i)` stay correct after `arr.length = N`.
                 let arr = crate::array::clean_arr_ptr(obj_ptr as *const crate::array::ArrayHeader);
                 let length = (*arr).length;
+                // A Proxy installed as the array's `[[Prototype]]`
+                // (`Object.setPrototypeOf(arr, proxy)`) — `array_spec_has_index`
+                // only recognizes a *real array* custom prototype, so a Proxy
+                // hop is silently treated as absent. Recover it here so the
+                // idx/string-key misses below can fall back to the proxy's
+                // `[[HasProperty]]` instead of a bare `false` (ECMA-262 10.1.7.1
+                // step 5).
+                let proxy_proto =
+                    super::super::prototype_chain::object_static_prototype(obj_ptr as usize)
+                        .filter(|&b| (b >> 48) == 0x7FFD)
+                        .map(f64::from_bits)
+                        .filter(|&v| crate::proxy::js_proxy_is_proxy(v) != 0);
                 // Numeric key: extract the index. Accept both NaN-boxed i32
                 // and plain f64 (e.g. literal `1`) provided it's a
                 // non-negative integer in range.
@@ -329,6 +341,24 @@ pub extern "C" fn js_object_has_property(obj: f64, key: f64) -> f64 {
                     if crate::array::object_prototype_has_index_prop(idx) {
                         return nanbox_true;
                     }
+                    if let Some(proxy) = proxy_proto {
+                        let idx_str = idx.to_string();
+                        let key_ptr = crate::string::js_string_from_bytes(
+                            idx_str.as_ptr(),
+                            idx_str.len() as u32,
+                        );
+                        let key_val = f64::from_bits(
+                            crate::value::js_nanbox_string(key_ptr as i64).to_bits(),
+                        );
+                        return if crate::value::js_is_truthy(crate::proxy::js_proxy_has(
+                            proxy, key_val,
+                        )) != 0
+                        {
+                            nanbox_true
+                        } else {
+                            nanbox_false
+                        };
+                    }
                     return nanbox_false;
                 }
                 if key_val.is_any_string() {
@@ -353,12 +383,21 @@ pub extern "C" fn js_object_has_property(obj: f64, key: f64) -> f64 {
                                 {
                                     return nanbox_true;
                                 }
-                                return nanbox_false;
-                            }
-                            if array_prototype_property_value(key_name, obj_ptr as usize).is_some()
+                            } else if array_prototype_property_value(key_name, obj_ptr as usize)
+                                .is_some()
                             {
                                 return nanbox_true;
                             }
+                            if let Some(proxy) = proxy_proto {
+                                return if crate::value::js_is_truthy(crate::proxy::js_proxy_has(
+                                    proxy, key,
+                                )) != 0
+                                {
+                                    nanbox_true
+                                } else {
+                                    nanbox_false
+                                };
+                            }
                         }
                     }
                 }
@@ -497,6 +536,23 @@ unsafe fn ordinary_has_property(
             Some(b) if b == TAG_NULL => return false,
             Some(b) => {
                 let top16 = b >> 48;
+                // A Proxy prototype hop (ECMA-262 10.1.7.1 step 5: `Return ?
+                // parent.[[HasProperty]](P)`) — the small registered proxy id is
+                // NOT a real heap pointer, so continuing the raw-pointer walk
+                // below would misread garbage (or crash). Dispatch through the
+                // proxy's own `[[HasProperty]]` (trap, or its trap-less forward
+                // through further proxy targets / the eventual real target) and
+                // use its boolean result directly — that call already resolves
+                // the rest of the chain.
+                if top16 == 0x7FFD {
+                    let proto_val = f64::from_bits(b);
+                    if crate::proxy::js_proxy_is_proxy(proto_val) != 0 {
+                        let key_val =
+                            f64::from_bits(crate::value::js_nanbox_string(key as i64).to_bits());
+                        let result = crate::proxy::js_proxy_has(proto_val, key_val);
+                        return crate::value::js_is_truthy(result) != 0;
+                    }
+                }
                 let p = if top16 == 0x7FFD {
                     (b & crate::value::POINTER_MASK) as usize
                 } else if top16 == 0 && b > 0x10000 {

crates/perry-runtime/src/object/object_ops/define_properties.rs

@@ -167,6 +167,7 @@ pub extern "C" fn js_object_set_prototype_of(obj_value: f64, proto: f64) -> f64
     let proto_is_null = proto_bits == TAG_NULL;
     let proto_is_symbol = unsafe { crate::symbol::js_is_symbol(proto) != 0 };
     let proto_ok = proto_is_null
+        || crate::proxy::js_proxy_is_proxy(proto) != 0
         || (!proto_is_symbol
             && (unsafe { value_is_object_like(proto) }
                 || super::super::class_ref_id(proto).is_some()));
@@ -208,6 +209,17 @@ pub extern "C" fn js_object_set_prototype_of(obj_value: f64, proto: f64) -> f64
         const TAG_NULL_U64: u64 = 0x7FFC_0000_0000_0002;
         let advance = |bits: u64| -> u64 {
             let val = f64::from_bits(bits);
+            // OrdinarySetPrototypeOf step 7.b.ii.1: if `p`'s [[GetPrototypeOf]]
+            // is not the ordinary internal method (a Proxy's is exotic — it may
+            // run arbitrary trap code), the walk stops here without invoking it.
+            // Without this guard the cycle-detection walk called the target's
+            // `getPrototypeOf` trap as a side effect of unrelated cycle-safety
+            // bookkeeping (test262 has/call-in-prototype-index.js,
+            // set/call-parameters-prototype-index.js observe a `getPrototypeOf`
+            // trap the test handler never installs).
+            if crate::proxy::js_proxy_is_proxy(val) != 0 {
+                return TAG_NULL_U64;
+            }
             let next = js_object_get_prototype_of(val);
             let nb = next.to_bits();
             if nb == TAG_NULL_U64 {
@@ -227,13 +239,20 @@ pub extern "C" fn js_object_set_prototype_of(obj_value: f64, proto: f64) -> f64
             if tortoise == TAG_NULL_U64 {
                 break;
             }
-            // Advance tortoise one step, hare two steps.  Guard the second
-            // advance: if the first step lands on null, calling advance(null)
-            // would invoke js_object_get_prototype_of(null) which throws
-            // "Cannot convert undefined or null to object" (test262
-            // setPrototypeOf/success.js — plain object proto chain ends at null).
+            // Advance tortoise one step, hare two steps. Guard every advance
+            // against an already-null position: calling `advance(null)` would
+            // invoke `js_object_get_prototype_of(null)`, which throws "Cannot
+            // convert undefined or null to object" (test262
+            // setPrototypeOf/success.js — plain object proto chain ends at
+            // null). `hare` reaches null one loop iteration before `tortoise`
+            // does (it steps twice per iteration) and, unlike `tortoise`, has
+            // no top-of-loop check — so a 2-hop-to-null chain (`proto` → some
+            // object → `Object.prototype` → null) re-advanced an
+            // already-`TAG_NULL_U64` `hare` on the next iteration.
             tortoise = advance(tortoise);
-            hare = {
+            hare = if hare == TAG_NULL_U64 {
+                TAG_NULL_U64
+            } else {
                 let h1 = advance(hare);
                 if h1 == TAG_NULL_U64 {
                     TAG_NULL_U64

crates/perry-runtime/src/object/object_ops/prototype.rs

@@ -51,6 +51,27 @@ pub extern "C" fn js_object_create(proto_value: f64) -> f64 {
     // Set/Map/Regex source Perry can't model as a prototype) falls back
     // to the original behavior: a plain prototype-less object.
     const POINTER_TAG: u64 = 0x7FFD_0000_0000_0000;
+
+    // `Object.create(proxy)` — a Proxy is a small registered id, not a real
+    // heap pointer, so the synthetic-class-id modeling below (which stores a
+    // REAL prototype pointer) can't represent it, and the `is_valid_obj_ptr`
+    // check would reject it outright (falling back to a plain, prototype-less
+    // object — wrong: reads/writes/`in` on the result must still route through
+    // the proxy). Record it in the SAME observable `[[Prototype]]` side table
+    // `Object.setPrototypeOf` uses instead: a plain (class_id 0, non-null-proto)
+    // object whose prototype hop the generic chain walks (`ordinary_has_property`,
+    // `own_set_descriptor`'s `prototype_of_for_set`, field-get) already resolve
+    // through the proxy's traps. (test262 has/call-in-prototype.js,
+    // has/call-object-create.js, set/call-parameters-prototype.js.)
+    if crate::proxy::js_proxy_is_proxy(proto_value) != 0 {
+        let obj = js_object_alloc(0, 0);
+        crate::object::prototype_chain::object_set_static_prototype(
+            obj as usize,
+            proto_value.to_bits(),
+        );
+        return f64::from_bits((obj as u64) | POINTER_TAG);
+    }
+
     let mut class_id: u32 = 0;
     let proto_bits = proto_value.to_bits();
     if (proto_bits & 0xFFFF_0000_0000_0000) == POINTER_TAG {

crates/perry-runtime/src/proxy.rs

@@ -711,6 +711,21 @@ fn target_get(target: f64, key: f64) -> f64 {
 /// forward to the target directly.
 #[no_mangle]
 pub extern "C" fn js_proxy_set(proxy_boxed: f64, key: f64, value: f64) -> f64 {
+    proxy_set_with_receiver(proxy_boxed, key, value, proxy_boxed)
+}
+
+/// Proxy `[[Set]]` (ECMA-262 §10.5.9) with an explicit `Receiver`, distinct
+/// from `proxy_boxed` itself. Reached when a Proxy sits partway up another
+/// object's `[[Prototype]]` chain: `OrdinarySetWithOwnDescriptor` forwards to
+/// `parent.[[Set]](P, V, Receiver)` with the ORIGINAL receiver, not `parent`
+/// (test262 set/call-parameters-prototype.js — `Object.create(proxy).prop = v`
+/// must call the trap with the heir object as `receiver`, not the proxy).
+pub(crate) fn proxy_set_with_receiver(
+    proxy_boxed: f64,
+    key: f64,
+    value: f64,
+    receiver: f64,
+) -> f64 {
     let id = match lookup(proxy_boxed) {
         Some(id) => id,
         None => return f64::from_bits(TAG_FALSE),
@@ -740,14 +755,15 @@ pub extern "C" fn js_proxy_set(proxy_boxed: f64, key: f64, value: f64) -> f64 {
         let target_h = scope.root_nanbox_f64(target);
         let key_h = scope.root_nanbox_f64(key);
         let value_h = scope.root_nanbox_f64(value);
+        let receiver_h = scope.root_nanbox_f64(receiver);
         let trap_result = call_trap(
             handler,
             trap,
             &[
                 target_h.get_nanbox_f64(),
                 key_h.get_nanbox_f64(),
                 value_h.get_nanbox_f64(),
-                proxy_boxed,
+                receiver_h.get_nanbox_f64(),
             ],
         );
         // A falsy trap result means the assignment failed; no invariant check.
@@ -765,22 +781,21 @@ pub extern "C" fn js_proxy_set(proxy_boxed: f64, key: f64, value: f64) -> f64 {
     // itself a Proxy, recurse through the proxy dispatch (its own trap or
     // target) rather than `ordinary_set`, which would deref the fake pointer.
     if lookup(target).is_some() {
-        return js_proxy_set(target, key, value);
+        return proxy_set_with_receiver(target, key, value, receiver);
     }
-    reflect_ordinary_set(target, key, value)
-}
-
-/// Perform an ordinary (non-proxy) `[[Set]]` and report success as a NaN-boxed
-/// boolean, without throwing on a non-writable / non-extensible target the way
-/// strict-mode assignment does (#2756 / #615). Returns `false` when the write
-/// cannot be applied.
-fn reflect_ordinary_set_property_key(target: f64, property_key: f64, value: f64) -> f64 {
-    nanbox_bool(ordinary_set_with_receiver(
-        target,
-        property_key,
-        value,
-        target,
-    ))
+    let scope = crate::gc::RuntimeHandleScope::new();
+    let target_handle = scope.root_nanbox_f64(target);
+    let key_handle = scope.root_nanbox_f64(key);
+    let value_handle = scope.root_nanbox_f64(value);
+    let receiver_handle = scope.root_nanbox_f64(receiver);
+    let property_key_handle = scope
+        .root_nanbox_f64(unsafe { crate::object::js_to_property_key(key_handle.get_nanbox_f64()) });
+    reflect_ordinary_set_with_receiver(
+        target_handle.get_nanbox_f64(),
+        property_key_handle.get_nanbox_f64(),
+        value_handle.get_nanbox_f64(),
+        receiver_handle.get_nanbox_f64(),
+    )
 }
 
 /// `Reflect.set` with an explicit receiver: OrdinarySet(target, P, V,
@@ -799,20 +814,6 @@ pub(crate) fn reflect_ordinary_set_with_receiver(
     ))
 }
 
-fn reflect_ordinary_set(target: f64, key: f64, value: f64) -> f64 {
-    let scope = crate::gc::RuntimeHandleScope::new();
-    let target_handle = scope.root_nanbox_f64(target);
-    let key_handle = scope.root_nanbox_f64(key);
-    let value_handle = scope.root_nanbox_f64(value);
-    let property_key_handle = scope
-        .root_nanbox_f64(unsafe { crate::object::js_to_property_key(key_handle.get_nanbox_f64()) });
-    reflect_ordinary_set_property_key(
-        target_handle.get_nanbox_f64(),
-        property_key_handle.get_nanbox_f64(),
-        value_handle.get_nanbox_f64(),
-    )
-}
-
 fn target_set(target: f64, key: f64, value: f64) {
     let property_key = unsafe { crate::object::js_to_property_key(key) };
     if unsafe { crate::symbol::js_is_symbol(property_key) } != 0 {
@@ -1331,6 +1332,18 @@ fn ordinary_set_with_receiver(target: f64, key: f64, value: f64, receiver: f64)
 
     let mut current = target;
     for _ in 0..64 {
+        // A Proxy hop in the prototype chain (`OrdinarySetWithOwnDescriptor`
+        // step 2.a-b: `parent = O.[[GetPrototypeOf]](); return
+        // parent.[[Set]](P, V, Receiver)`) — dispatch the FULL `[[Set]]`
+        // algorithm (trap, or its own trap-less forward) on `current` with the
+        // ORIGINAL `receiver`, rather than continuing the manual own-descriptor
+        // walk below, which would misread the small proxy id as a heap pointer
+        // (test262 set/call-parameters-prototype.js).
+        if lookup(current).is_some() {
+            return crate::value::js_is_truthy(proxy_set_with_receiver(
+                current, key, value, receiver,
+            )) != 0;
+        }
         // Integer-Indexed exotic [[Set]] (§10.4.5.5): a typed array in the
         // chain intercepts a canonical numeric index key — the prototype
         // chain is NEVER consulted for it. `SameValue(O, Receiver)` writes

crates/perry-runtime/src/proxy/reflect.rs

@@ -1,7 +1,7 @@
 use super::{
     closure_from, coerce_trap_bool, extract_pointer, handler_trap, is_callable_function,
-    js_closure_call0, js_closure_call2, js_proxy_delete, js_proxy_get, js_proxy_has, js_proxy_set,
-    lookup, nanbox_bool, reflect_non_object_typeerror, reflect_ordinary_delete_property_key,
+    js_closure_call0, js_closure_call2, js_proxy_delete, js_proxy_get, js_proxy_has, lookup,
+    nanbox_bool, reflect_non_object_typeerror, reflect_ordinary_delete_property_key,
     reflect_ordinary_set_with_receiver, reflect_value_is_object, revoked_return,
     target_get_property_key, throw_type_error, PROXIES, TAG_NULL, TAG_TRUE, TAG_UNDEFINED,
 };
@@ -107,7 +107,7 @@ pub extern "C" fn js_reflect_set(target: f64, key: f64, value: f64, receiver: f6
         }
     };
     if lookup(target).is_some() {
-        return js_proxy_set(target, property_key, value);
+        return super::proxy_set_with_receiver(target, property_key, value, receiver);
     }
     reflect_ordinary_set_with_receiver(target, property_key, value, receiver)
 }
@@ -348,6 +348,12 @@ pub extern "C" fn js_reflect_get_own_property_descriptor(target: f64, key: f64)
     let trap = handler_trap(handler, "getOwnPropertyDescriptor");
     let trap_bits = trap.to_bits();
     if trap_bits == TAG_UNDEFINED || trap_bits == TAG_NULL {
+        // No trap — forward to the target's [[GetOwnProperty]]. When the target
+        // is itself a Proxy, recurse through the Reflect entry point rather than
+        // the ordinary object path, which would deref the fake proxy pointer.
+        if lookup(inner).is_some() {
+            return js_reflect_get_own_property_descriptor(inner, property_key);
+        }
         return crate::object::js_object_get_own_property_descriptor(inner, property_key);
     }
     if !is_callable_function(trap) {