fix(runtime): #5844 — Proxy trap dispatch fixes across getOwnPropertyDescriptor, has, set, and setPrototypeOf (#5882)

* fix(runtime): #5844 — Proxy trap dispatch fixes across getOwnPropertyDescriptor, has, set, and setPrototypeOf

Fixes 12 of 33 test262 built-ins/Proxy failures, zero regressions
(verified against built-ins/Proxy, built-ins/Object, built-ins/Reflect,
language/expressions/in — 219/219/3132/101/15 pass respectively).

Root causes, all variations on "a Proxy is a small registered id, not a
real heap pointer, and several generic object-machinery code paths
either mis-treated it as one or never checked for it at all":

- js_reflect_get_own_property_descriptor: the missing-trap fallback read
  the target's descriptor via the raw ObjectHeader path even when the
  target was itself a Proxy; now recurses through the Reflect entry
  point so a chain of trap-less proxies forwards correctly.

- ordinary_has_property (the `in` operator's prototype-chain walk) and
  its array-fast-path counterpart didn't recognize a Proxy sitting in
  the recorded `[[Prototype]]` chain, silently returning false (or
  reading garbage) instead of dispatching the proxy's `has` trap.

- ordinary_set_with_receiver's prototype-chain walk had the same gap on
  the write side, and `js_proxy_set`/`Reflect.set` didn't thread a
  distinct `receiver` through to the trap when a Proxy was reached via
  a prototype hop rather than as the direct assignment target.

- Object.create(proto) and Object.setPrototypeOf(obj, proto) rejected a
  Proxy `proto` argument outright (their "is this an object" checks
  don't recognize the small registered id), and Object.create had no
  path to record a Proxy prototype at all — it can't be modeled via the
  synthetic-class-id machinery used for real prototype objects, so route
  it through the same static-prototype side table setPrototypeOf uses.

- Object.setPrototypeOf's cycle-detection walk called
  `[[GetPrototypeOf]]` unconditionally while probing the candidate
  prototype's chain, including on a Proxy — invoking its trap as an
  unrelated side effect of cycle-safety bookkeeping (OrdinarySetPrototypeOf
  step 7.b.ii.1 says to stop the walk there instead).

Also fixed, found while debugging the above with a fresh (Proxy-free)
repro: the cycle-detection loop's Floyd's tortoise-and-hare walk only
guarded `tortoise` against an already-null position before advancing;
`hare` (which steps twice per iteration) had no equivalent guard, so a
2-hop-to-null prototype chain re-advanced an already-null `hare` and
threw "Cannot convert undefined or null to object" on a plain, entirely
ordinary `Object.setPrototypeOf({}, {foo: 1})`.

Refs #5844.

* refactor(runtime): move js_proxy_set/proxy_set_with_receiver into proxy/put_value.rs

proxy.rs grew to 2004 lines after rebasing onto main (which independently
added ~30 lines), tripping the 2000-line file-size CI gate. Relocate the
Proxy [[Set]] entry points into the sibling put_value.rs submodule
(already the natural home for PutValue/[[Set]] dispatch) rather than
trim comments to fit — same pattern as the file's other topical splits.
Pure code motion, no behavior change (re-verified: built-ins/Proxy still
219 pass / 21 runtime-fail).

---------

Co-authored-by: Ralph <ralph@skelpo.com>

Author: proggeramlug

crates/perry-runtime/src/object/descriptors.rs

@@ -1368,6 +1368,7 @@ pub extern "C" fn js_object_create_with_props(proto_value: f64, props_value: f64
     let proto_jv = crate::value::JSValue::from_bits(proto_value.to_bits());
     let proto_is_symbol = unsafe { crate::symbol::js_is_symbol(proto_value) != 0 };
     let proto_ok = proto_jv.is_null()
+        || crate::proxy::js_proxy_is_proxy(proto_value) != 0
         || (!proto_is_symbol
             && (unsafe { value_is_object_like(proto_value) }
                 || super::class_ref_id(proto_value).is_some()));

crates/perry-runtime/src/object/field_get_set/has_property.rs

@@ -295,6 +295,18 @@ pub extern "C" fn js_object_has_property(obj: f64, key: f64) -> f64 {
                 // / `arr.hasOwnProperty(i)` stay correct after `arr.length = N`.
                 let arr = crate::array::clean_arr_ptr(obj_ptr as *const crate::array::ArrayHeader);
                 let length = (*arr).length;
+                // A Proxy installed as the array's `[[Prototype]]`
+                // (`Object.setPrototypeOf(arr, proxy)`) — `array_spec_has_index`
+                // only recognizes a *real array* custom prototype, so a Proxy
+                // hop is silently treated as absent. Recover it here so the
+                // idx/string-key misses below can fall back to the proxy's
+                // `[[HasProperty]]` instead of a bare `false` (ECMA-262 10.1.7.1
+                // step 5).
+                let proxy_proto =
+                    super::super::prototype_chain::object_static_prototype(obj_ptr as usize)
+                        .filter(|&b| (b >> 48) == 0x7FFD)
+                        .map(f64::from_bits)
+                        .filter(|&v| crate::proxy::js_proxy_is_proxy(v) != 0);
                 // Numeric key: extract the index. Accept both NaN-boxed i32
                 // and plain f64 (e.g. literal `1`) provided it's a
                 // non-negative integer in range.
@@ -329,6 +341,24 @@ pub extern "C" fn js_object_has_property(obj: f64, key: f64) -> f64 {
                     if crate::array::object_prototype_has_index_prop(idx) {
                         return nanbox_true;
                     }
+                    if let Some(proxy) = proxy_proto {
+                        let idx_str = idx.to_string();
+                        let key_ptr = crate::string::js_string_from_bytes(
+                            idx_str.as_ptr(),
+                            idx_str.len() as u32,
+                        );
+                        let key_val = f64::from_bits(
+                            crate::value::js_nanbox_string(key_ptr as i64).to_bits(),
+                        );
+                        return if crate::value::js_is_truthy(crate::proxy::js_proxy_has(
+                            proxy, key_val,
+                        )) != 0
+                        {
+                            nanbox_true
+                        } else {
+                            nanbox_false
+                        };
+                    }
                     return nanbox_false;
                 }
                 if key_val.is_any_string() {
@@ -353,12 +383,21 @@ pub extern "C" fn js_object_has_property(obj: f64, key: f64) -> f64 {
                                 {
                                     return nanbox_true;
                                 }
-                                return nanbox_false;
-                            }
-                            if array_prototype_property_value(key_name, obj_ptr as usize).is_some()
+                            } else if array_prototype_property_value(key_name, obj_ptr as usize)
+                                .is_some()
                             {
                                 return nanbox_true;
                             }
+                            if let Some(proxy) = proxy_proto {
+                                return if crate::value::js_is_truthy(crate::proxy::js_proxy_has(
+                                    proxy, key,
+                                )) != 0
+                                {
+                                    nanbox_true
+                                } else {
+                                    nanbox_false
+                                };
+                            }
                         }
                     }
                 }
@@ -497,6 +536,23 @@ unsafe fn ordinary_has_property(
             Some(b) if b == TAG_NULL => return false,
             Some(b) => {
                 let top16 = b >> 48;
+                // A Proxy prototype hop (ECMA-262 10.1.7.1 step 5: `Return ?
+                // parent.[[HasProperty]](P)`) — the small registered proxy id is
+                // NOT a real heap pointer, so continuing the raw-pointer walk
+                // below would misread garbage (or crash). Dispatch through the
+                // proxy's own `[[HasProperty]]` (trap, or its trap-less forward
+                // through further proxy targets / the eventual real target) and
+                // use its boolean result directly — that call already resolves
+                // the rest of the chain.
+                if top16 == 0x7FFD {
+                    let proto_val = f64::from_bits(b);
+                    if crate::proxy::js_proxy_is_proxy(proto_val) != 0 {
+                        let key_val =
+                            f64::from_bits(crate::value::js_nanbox_string(key as i64).to_bits());
+                        let result = crate::proxy::js_proxy_has(proto_val, key_val);
+                        return crate::value::js_is_truthy(result) != 0;
+                    }
+                }
                 let p = if top16 == 0x7FFD {
                     (b & crate::value::POINTER_MASK) as usize
                 } else if top16 == 0 && b > 0x10000 {

crates/perry-runtime/src/object/object_ops/define_properties.rs

@@ -167,6 +167,7 @@ pub extern "C" fn js_object_set_prototype_of(obj_value: f64, proto: f64) -> f64
     let proto_is_null = proto_bits == TAG_NULL;
     let proto_is_symbol = unsafe { crate::symbol::js_is_symbol(proto) != 0 };
     let proto_ok = proto_is_null
+        || crate::proxy::js_proxy_is_proxy(proto) != 0
         || (!proto_is_symbol
             && (unsafe { value_is_object_like(proto) }
                 || super::super::class_ref_id(proto).is_some()));
@@ -209,6 +210,17 @@ pub extern "C" fn js_object_set_prototype_of(obj_value: f64, proto: f64) -> f64
         const TAG_UNDEFINED_U64: u64 = 0x7FFC_0000_0000_0001;
         let advance = |bits: u64| -> u64 {
             let val = f64::from_bits(bits);
+            // OrdinarySetPrototypeOf step 7.b.ii.1: if `p`'s [[GetPrototypeOf]]
+            // is not the ordinary internal method (a Proxy's is exotic — it may
+            // run arbitrary trap code), the walk stops here without invoking it.
+            // Without this guard the cycle-detection walk called the target's
+            // `getPrototypeOf` trap as a side effect of unrelated cycle-safety
+            // bookkeeping (test262 has/call-in-prototype-index.js,
+            // set/call-parameters-prototype-index.js observe a `getPrototypeOf`
+            // trap the test handler never installs).
+            if crate::proxy::js_proxy_is_proxy(val) != 0 {
+                return TAG_NULL_U64;
+            }
             let next = js_object_get_prototype_of(val);
             let nb = next.to_bits();
             // Treat undefined as chain-end like null: `js_object_get_prototype_of`
@@ -236,11 +248,7 @@ pub extern "C" fn js_object_set_prototype_of(obj_value: f64, proto: f64) -> f64
             if tortoise == TAG_NULL_U64 {
                 break;
             }
-            // Advance tortoise one step, hare two steps.  Guard the second
-            // advance: if the first step lands on null, calling advance(null)
-            // would invoke js_object_get_prototype_of(null) which throws
-            // "Cannot convert undefined or null to object" (test262
-            // setPrototypeOf/success.js — plain object proto chain ends at null).
+            // Advance tortoise one step, hare two steps.
             tortoise = advance(tortoise);
             // The hare reaches the chain end (null) before the tortoise on any
             // acyclic chain longer than one link (e.g. a function proto:

crates/perry-runtime/src/object/object_ops/prototype.rs

@@ -51,6 +51,27 @@ pub extern "C" fn js_object_create(proto_value: f64) -> f64 {
     // Set/Map/Regex source Perry can't model as a prototype) falls back
     // to the original behavior: a plain prototype-less object.
     const POINTER_TAG: u64 = 0x7FFD_0000_0000_0000;
+
+    // `Object.create(proxy)` — a Proxy is a small registered id, not a real
+    // heap pointer, so the synthetic-class-id modeling below (which stores a
+    // REAL prototype pointer) can't represent it, and the `is_valid_obj_ptr`
+    // check would reject it outright (falling back to a plain, prototype-less
+    // object — wrong: reads/writes/`in` on the result must still route through
+    // the proxy). Record it in the SAME observable `[[Prototype]]` side table
+    // `Object.setPrototypeOf` uses instead: a plain (class_id 0, non-null-proto)
+    // object whose prototype hop the generic chain walks (`ordinary_has_property`,
+    // `own_set_descriptor`'s `prototype_of_for_set`, field-get) already resolve
+    // through the proxy's traps. (test262 has/call-in-prototype.js,
+    // has/call-object-create.js, set/call-parameters-prototype.js.)
+    if crate::proxy::js_proxy_is_proxy(proto_value) != 0 {
+        let obj = js_object_alloc(0, 0);
+        crate::object::prototype_chain::object_set_static_prototype(
+            obj as usize,
+            proto_value.to_bits(),
+        );
+        return f64::from_bits((obj as u64) | POINTER_TAG);
+    }
+
     let mut class_id: u32 = 0;
     let proto_bits = proto_value.to_bits();
     if (proto_bits & 0xFFFF_0000_0000_0000) == POINTER_TAG {

crates/perry-runtime/src/proxy.rs

@@ -22,7 +22,8 @@ use crate::closure::{js_closure_call0, js_closure_call1, js_closure_call2, js_cl
 
 mod invariants;
 mod put_value;
-pub use put_value::js_put_value_set;
+pub(crate) use put_value::proxy_set_with_receiver;
+pub use put_value::{js_proxy_set, js_put_value_set};
 mod json;
 mod metadata;
 mod own_keys;
@@ -705,84 +706,6 @@ fn target_get(target: f64, key: f64) -> f64 {
     )
 }
 
-/// `proxy[key] = value` — if handler.set exists, call it with
-/// (target, key, value) and return TAG_TRUE (the trap's return value is
-/// ignored by the default test semantics since we echo `value`). Otherwise
-/// forward to the target directly.
-#[no_mangle]
-pub extern "C" fn js_proxy_set(proxy_boxed: f64, key: f64, value: f64) -> f64 {
-    let id = match lookup(proxy_boxed) {
-        Some(id) => id,
-        None => return f64::from_bits(TAG_FALSE),
-    };
-    let (target, handler, revoked) = PROXIES.with(|p| {
-        p.borrow()
-            .get(id as usize)
-            .and_then(|o| o.as_ref())
-            .map(|e| (e.target, e.handler, e.revoked))
-            .unwrap_or((
-                f64::from_bits(TAG_UNDEFINED),
-                f64::from_bits(TAG_UNDEFINED),
-                false,
-            ))
-    });
-    if revoked {
-        return revoked_return();
-    }
-    let trap = handler_trap(handler, "set");
-    if is_callable(trap) {
-        // #2756: the `set` trap's boolean result is observable through
-        // `Reflect.set(proxy, …)` (and strict-mode assignment). Coerce and
-        // return it rather than discarding it. The trap receives the spec
-        // argument list `(target, key, value, receiver)` with `this` bound to
-        // the handler.
-        let scope = crate::gc::RuntimeHandleScope::new();
-        let target_h = scope.root_nanbox_f64(target);
-        let key_h = scope.root_nanbox_f64(key);
-        let value_h = scope.root_nanbox_f64(value);
-        let trap_result = call_trap(
-            handler,
-            trap,
-            &[
-                target_h.get_nanbox_f64(),
-                key_h.get_nanbox_f64(),
-                value_h.get_nanbox_f64(),
-                proxy_boxed,
-            ],
-        );
-        // A falsy trap result means the assignment failed; no invariant check.
-        if crate::value::js_is_truthy(trap_result) == 0 {
-            return nanbox_bool(false);
-        }
-        invariants::enforce_set_invariant(
-            target_h.get_nanbox_f64(),
-            key_h.get_nanbox_f64(),
-            value_h.get_nanbox_f64(),
-        );
-        return nanbox_bool(true);
-    }
-    // No set trap — forward to the target's `[[Set]]`. When the target is
-    // itself a Proxy, recurse through the proxy dispatch (its own trap or
-    // target) rather than `ordinary_set`, which would deref the fake pointer.
-    if lookup(target).is_some() {
-        return js_proxy_set(target, key, value);
-    }
-    reflect_ordinary_set(target, key, value)
-}
-
-/// Perform an ordinary (non-proxy) `[[Set]]` and report success as a NaN-boxed
-/// boolean, without throwing on a non-writable / non-extensible target the way
-/// strict-mode assignment does (#2756 / #615). Returns `false` when the write
-/// cannot be applied.
-fn reflect_ordinary_set_property_key(target: f64, property_key: f64, value: f64) -> f64 {
-    nanbox_bool(ordinary_set_with_receiver(
-        target,
-        property_key,
-        value,
-        target,
-    ))
-}
-
 /// `Reflect.set` with an explicit receiver: OrdinarySet(target, P, V,
 /// receiver), boolean result NaN-boxed.
 pub(crate) fn reflect_ordinary_set_with_receiver(
@@ -799,20 +722,6 @@ pub(crate) fn reflect_ordinary_set_with_receiver(
     ))
 }
 
-fn reflect_ordinary_set(target: f64, key: f64, value: f64) -> f64 {
-    let scope = crate::gc::RuntimeHandleScope::new();
-    let target_handle = scope.root_nanbox_f64(target);
-    let key_handle = scope.root_nanbox_f64(key);
-    let value_handle = scope.root_nanbox_f64(value);
-    let property_key_handle = scope
-        .root_nanbox_f64(unsafe { crate::object::js_to_property_key(key_handle.get_nanbox_f64()) });
-    reflect_ordinary_set_property_key(
-        target_handle.get_nanbox_f64(),
-        property_key_handle.get_nanbox_f64(),
-        value_handle.get_nanbox_f64(),
-    )
-}
-
 fn target_set(target: f64, key: f64, value: f64) {
     let property_key = unsafe { crate::object::js_to_property_key(key) };
     if unsafe { crate::symbol::js_is_symbol(property_key) } != 0 {
@@ -1331,6 +1240,15 @@ fn ordinary_set_with_receiver(target: f64, key: f64, value: f64, receiver: f64)
 
     let mut current = target;
     for _ in 0..64 {
+        // A Proxy hop in the prototype chain: `OrdinarySetWithOwnDescriptor`
+        // step 2.a-b dispatches the full `[[Set]]` on the parent with the
+        // ORIGINAL `receiver`, not the raw own-descriptor walk below (which
+        // would misread the small proxy id as a heap pointer).
+        if lookup(current).is_some() {
+            return crate::value::js_is_truthy(proxy_set_with_receiver(
+                current, key, value, receiver,
+            )) != 0;
+        }
         // Integer-Indexed exotic [[Set]] (§10.4.5.5): a typed array in the
         // chain intercepts a canonical numeric index key — the prototype
         // chain is NEVER consulted for it. `SameValue(O, Receiver)` writes

crates/perry-runtime/src/proxy/put_value.rs

@@ -5,6 +5,97 @@
 
 use super::*;
 
+/// `proxy[key] = value` — if handler.set exists, call it with
+/// (target, key, value) and return TAG_TRUE (the trap's return value is
+/// ignored by the default test semantics since we echo `value`). Otherwise
+/// forward to the target directly.
+#[no_mangle]
+pub extern "C" fn js_proxy_set(proxy_boxed: f64, key: f64, value: f64) -> f64 {
+    proxy_set_with_receiver(proxy_boxed, key, value, proxy_boxed)
+}
+
+/// Proxy `[[Set]]` (ECMA-262 §10.5.9) with an explicit `Receiver`, distinct
+/// from `proxy_boxed` itself — reached when a Proxy sits partway up another
+/// object's `[[Prototype]]` chain (`OrdinarySetWithOwnDescriptor` forwards to
+/// `parent.[[Set]](P, V, Receiver)` with the ORIGINAL receiver, not `parent`).
+pub(crate) fn proxy_set_with_receiver(
+    proxy_boxed: f64,
+    key: f64,
+    value: f64,
+    receiver: f64,
+) -> f64 {
+    let id = match lookup(proxy_boxed) {
+        Some(id) => id,
+        None => return f64::from_bits(TAG_FALSE),
+    };
+    let (target, handler, revoked) = PROXIES.with(|p| {
+        p.borrow()
+            .get(id as usize)
+            .and_then(|o| o.as_ref())
+            .map(|e| (e.target, e.handler, e.revoked))
+            .unwrap_or((
+                f64::from_bits(TAG_UNDEFINED),
+                f64::from_bits(TAG_UNDEFINED),
+                false,
+            ))
+    });
+    if revoked {
+        return revoked_return();
+    }
+    let trap = handler_trap(handler, "set");
+    if is_callable(trap) {
+        // #2756: the `set` trap's boolean result is observable through
+        // `Reflect.set(proxy, …)` (and strict-mode assignment). Coerce and
+        // return it rather than discarding it. The trap receives the spec
+        // argument list `(target, key, value, receiver)` with `this` bound to
+        // the handler.
+        let scope = crate::gc::RuntimeHandleScope::new();
+        let target_h = scope.root_nanbox_f64(target);
+        let key_h = scope.root_nanbox_f64(key);
+        let value_h = scope.root_nanbox_f64(value);
+        let receiver_h = scope.root_nanbox_f64(receiver);
+        let trap_result = call_trap(
+            handler,
+            trap,
+            &[
+                target_h.get_nanbox_f64(),
+                key_h.get_nanbox_f64(),
+                value_h.get_nanbox_f64(),
+                receiver_h.get_nanbox_f64(),
+            ],
+        );
+        // A falsy trap result means the assignment failed; no invariant check.
+        if crate::value::js_is_truthy(trap_result) == 0 {
+            return nanbox_bool(false);
+        }
+        invariants::enforce_set_invariant(
+            target_h.get_nanbox_f64(),
+            key_h.get_nanbox_f64(),
+            value_h.get_nanbox_f64(),
+        );
+        return nanbox_bool(true);
+    }
+    // No set trap — forward to the target's `[[Set]]`. When the target is
+    // itself a Proxy, recurse through the proxy dispatch (its own trap or
+    // target) rather than `ordinary_set`, which would deref the fake pointer.
+    if lookup(target).is_some() {
+        return proxy_set_with_receiver(target, key, value, receiver);
+    }
+    let scope = crate::gc::RuntimeHandleScope::new();
+    let target_handle = scope.root_nanbox_f64(target);
+    let key_handle = scope.root_nanbox_f64(key);
+    let value_handle = scope.root_nanbox_f64(value);
+    let receiver_handle = scope.root_nanbox_f64(receiver);
+    let property_key_handle = scope
+        .root_nanbox_f64(unsafe { crate::object::js_to_property_key(key_handle.get_nanbox_f64()) });
+    reflect_ordinary_set_with_receiver(
+        target_handle.get_nanbox_f64(),
+        property_key_handle.get_nanbox_f64(),
+        value_handle.get_nanbox_f64(),
+        receiver_handle.get_nanbox_f64(),
+    )
+}
+
 /// Assignment PutValue for a property reference. Returns the assigned RHS value
 /// on success or sloppy failure, and throws TypeError when strict code attempts
 /// a failed [[Set]].