fix(runtime): dispatch inherited Array statics on a subclass constructor (#7541)

Author: Ralph Küpper

changelog.d/7605-array-subclass-inherited-statics.md

@@ -0,0 +1,37 @@
+### fix(runtime): dispatch inherited Array statics on a subclass constructor (#7541)
+
+`[...MyArr.from([1, 2, 3])]` (where `class MyArr extends Array {}`) threw
+`TypeError: value is not iterable`. The spread was never at fault — a
+directly-constructed subclass instance has always spread correctly. **`MyArr.from`
+resolved to nothing**: `Array.from` / `Array.of` / `Array.isArray` are folded in
+the HIR on the *literal identifier* `Array`, so a subclass receiver matched no
+fold, fell through to `js_class_static_method_call`, and hit its documented
+miss-fallback — which returns the RECEIVER. The call therefore evaluated to the
+class ref, which is genuinely not iterable. Same "keyed on a literal `extends`
+name" weak area as the instance-side native-base gaps, on the static side.
+
+`js_class_static_method_call` now has an Array arm beside the existing
+`class X extends Promise` and `class X extends Buffer` ones, gated on the same
+bounded class-chain walk (`is_array_subclass_class_id`). Both spec statics were
+already implemented constructor-aware — `array_from_full` / `array_of_full` run
+`Construct(C, …)` when `IsConstructor(this)`, and a class ref answers true — so
+passing the subclass receiver through builds a real subclass instance, matching
+`Array.from.call(MyArr, x)` in node rather than degrading to a plain `Array`.
+
+Depends on #7574's funnel: `array_from_full` installs elements through
+`CreateDataPropertyOrThrow`, which branches on `js_array_is_array` — true for a
+subclass instance — and so reaches `js_array_set_f64_extend` on what is
+physically an `ObjectHeader`. Without that fix this change would construct the
+right object and then write into its header.
+
+Validated by `test-files/test_gap_7541_array_subclass_inherited_statics.ts`
+(byte-identical to node, exit 0; covers `from` with a mapFn / from a `Set` /
+from an array-like, `of`, `isArray`, an indirect subclass, and the full
+iteration surface on a static-produced instance), plus a full runtime revert
+reproducing the reported `TypeError` verbatim.
+
+Still open, deliberately: the property-GET form (`typeof MyArr.from` reports
+`undefined` — only the call form is dispatched, as is already the case for the
+Promise/Buffer subclass statics), `sub instanceof MyArr` (the class-registry
+parent-edge gap, Array sibling of #7575), and `ArraySpeciesCreate` on
+`sub.map(f)`.

crates/perry-runtime/src/object/class_registry/parent_static.rs

@@ -1523,6 +1523,48 @@ pub unsafe extern "C" fn js_class_static_method_call(
             return result;
         }
     }
+    // #7541: `class X extends Array` — inherited builtin static
+    // (`X.from(...)`, `X.of(...)`, `X.isArray(...)`).
+    //
+    // `Array.from` / `Array.of` are folded in the HIR on the LITERAL identifier
+    // `Array` (`lower/expr_call/array_only_methods.rs`), so a subclass receiver
+    // never matched and `MyArr.from([1, 2, 3])` resolved to nothing. The
+    // fallback at the end of this function returns the RECEIVER unchanged, so
+    // the call evaluated to the class ref — and `[...MyArr.from([1,2,3])]` threw
+    // `TypeError: value is not iterable` (#7541's report), which looked like a
+    // spread bug but is a missing static.
+    //
+    // Both spec statics are already implemented constructor-aware
+    // (`array::{array_from_full, array_of_full}` run `Construct(C, …)` when
+    // `IsConstructor(this)`, and `class_ref_id` makes a class ref answer true),
+    // so passing the subclass receiver as `this` builds a subclass instance —
+    // matching `Array.from.call(MyArr, …)`. Mirrors the Promise arm above.
+    if crate::array::is_array_subclass_class_id(class_id) {
+        let arg = |i: usize| -> f64 {
+            if i < args_len && !args_ptr.is_null() {
+                *args_ptr.add(i)
+            } else {
+                f64::from_bits(crate::value::TAG_UNDEFINED)
+            }
+        };
+        match name {
+            "from" => {
+                return crate::array::array_from_full(receiver, arg(0), arg(1), arg(2));
+            }
+            "of" => {
+                let vals: &[f64] = if args_ptr.is_null() || args_len == 0 {
+                    &[]
+                } else {
+                    std::slice::from_raw_parts(args_ptr, args_len)
+                };
+                return crate::array::array_of_full(receiver, vals);
+            }
+            "isArray" => {
+                return crate::array::js_array_is_array(arg(0));
+            }
+            _ => {}
+        }
+    }
     // #6475: `class X extends <function value>() {}` — a static member
     // INHERITED from the parent FUNCTION's own properties, invoked as a call
     // (`X.use(f)`, effect's `HttpRouter.Tag(id)().use`/`unwrap`/`serve`). The

test-files/test_gap_7541_array_subclass_inherited_statics.ts

@@ -0,0 +1,63 @@
+// #7541 — `[...MyArr.from([1,2,3])]` threw `TypeError: value is not iterable`.
+//
+// The spread was never the problem: `Array.from` / `Array.of` / `Array.isArray`
+// are folded in the HIR on the LITERAL identifier `Array`, so a SUBCLASS
+// receiver matched nothing, and `js_class_static_method_call`'s miss-fallback
+// returns the RECEIVER — making `MyArr.from([1,2,3])` evaluate to the class ref,
+// which is genuinely not iterable. Directly-constructed instances always
+// spread fine; only the inherited-static-produced ones failed.
+//
+// KNOWN GAP, deliberately not asserted here: the property-GET form
+// (`typeof MyArr.from`) still reports `undefined` — only the CALL form is
+// dispatched. Same for `sub instanceof MyArr`, a pre-existing class-registry
+// parent-edge gap (#7575's Map/Set sibling).
+
+class MyArr extends Array {}
+class Indirect extends MyArr {}
+
+// The issue's exact repro.
+const sub = MyArr.from([1, 2, 3]);
+console.log([...sub]);
+console.log(Array.isArray([...sub]));
+
+// The statics themselves.
+console.log("from     ", Array.isArray(sub), sub.length, sub.join(","));
+const mapped = MyArr.from([1, 2, 3], (v: number) => v * 10);
+console.log("from+map ", mapped.length, mapped.join(","));
+const fromSet = MyArr.from(new Set([4, 5, 6]));
+console.log("from set ", fromSet.length, fromSet.join(","));
+const fromLike = MyArr.from({ length: 2, 0: "a", 1: "b" } as ArrayLike<string>);
+console.log("from like", fromLike.length, fromLike.join(","));
+const ofd = MyArr.of(7, 8, 9);
+console.log("of       ", ofd.length, ofd.join(","));
+console.log("isArray  ", MyArr.isArray([]), MyArr.isArray(1));
+
+// An INDIRECT subclass resolves through the same chain walk.
+const ind = Indirect.from([1, 2]);
+console.log("indirect ", Array.isArray(ind), ind.length, ind.join(","));
+
+// Every iteration surface on a static-produced instance.
+const it = MyArr.from([10, 20, 30]);
+const acc: number[] = [];
+for (const v of it) {
+  acc.push(v);
+}
+console.log("for-of   ", acc.join(","));
+console.log("spread   ", [...it].join(","));
+console.log("Array.from", Array.from(it).join(","));
+const [a0, a1] = it;
+console.log("destr    ", a0, a1);
+console.log("map      ", it.map((v) => v + 1).join(","));
+console.log("index    ", it[0], it[2], it.length);
+
+// Controls: the base intrinsic and a non-Array class are untouched.
+console.log("base from", Array.from([1, 2]).join(","));
+console.log("base of  ", Array.of(3, 4).join(","));
+class Other {
+  static make(): string {
+    return "other";
+  }
+}
+class OtherSub extends Other {}
+console.log("user stat", OtherSub.make());
+console.log("done");