fix(runtime): an Array subclass in a base-typed binding was read as a raw header (#7574)

Author: Ralph Küpper

crates/perry-codegen/src/expr/array_push.rs

@@ -298,11 +298,38 @@ pub(crate) fn lower(ctx: &mut FnCtx<'_>, expr: &Expr) -> Result<String> {
                 // head — the inline path's offset-0 length read would
                 // otherwise pick up the lower 32 bits of the
                 // forwarding pointer (garbage).
+                //
+                // #7574: the same load also has to prove the receiver IS an
+                // array. `Expr::ArrayPush` is folded from the receiver's
+                // DECLARED type, and a declared type is a hint, never a layout
+                // fact (CLAUDE.md, *Known Limitations*), so
+                // `const a: number[] = new MyArr()` — a `class X extends Array`
+                // instance, which perry models as a plain `ObjectHeader` —
+                // reached the inline store below. `ObjectHeader` overlays
+                // `ArrayHeader` field for field, so `length` read
+                // `object_type` (= 1) and `capacity` read `class_id` (large):
+                // `1 < class_id` passed the in-bounds test and the value was
+                // stored at `handle + 8 + 1*8` — i.e. over `ObjectHeader
+                // .keys_array`, a live GC child edge — while `length + 1`
+                // overwrote `object_type`. The SECOND push then SIGSEGVed
+                // (exit 139) dereferencing `keys_array`, whose bytes were now
+                // the double `1.0` (fault address `0x3ff0000000000000`).
+                //
+                // Route any non-`GC_TYPE_ARRAY` receiver to `js_array_push_f64`
+                // — the same slow arm forwarding already uses — which resolves
+                // an array-like object receiver onto the spec-generic engine.
+                // Strictly more restrictive than the old test: nothing that
+                // used to take the slow arm now takes the inline store.
+                let gc_type_addr = blk.sub(I64, &arr_handle, "8");
+                let gc_type_ptr = blk.inttoptr(I64, &gc_type_addr);
+                let gc_type = blk.load(I8, &gc_type_ptr);
+                let not_array = blk.icmp_ne(I8, &gc_type, "1"); // != GC_TYPE_ARRAY
                 let gc_flags_addr = blk.sub(I64, &arr_handle, "7");
                 let gc_flags_ptr = blk.inttoptr(I64, &gc_flags_addr);
                 let gc_flags = blk.load(I8, &gc_flags_ptr);
                 let fwd_bits = blk.and(I8, &gc_flags, "128");
-                let is_fwd = blk.icmp_ne(I8, &fwd_bits, "0");
+                let fwd_set = blk.icmp_ne(I8, &fwd_bits, "0");
+                let is_fwd = blk.or(I1, &not_array, &fwd_set);
 
                 let fwd_idx = ctx.new_block("apush.fwd");
                 let nofwd_idx = ctx.new_block("apush.nofwd");

crates/perry-codegen/src/expr/index_get.rs

@@ -542,16 +542,32 @@ fn lower_bounded_array_index_get(
     // bytes at `arr + 8 + idx*8`, so route through the slow path only when
     // the receiver is lazy. Issue #233: also detect FORWARDED arrays; the
     // slow path's `clean_arr_ptr` follows the chain.
+    //
+    // #7574: the test is now POSITIVE — `obj_type == GC_TYPE_ARRAY` — instead
+    // of "not lazy". `is_array_expr` is satisfied by a DECLARED `Type::Array`,
+    // and a declared type is a hint, never a layout fact (CLAUDE.md, *Known
+    // Limitations*), so `const a: number[] = new MyArr()` (a `class X extends
+    // Array` instance — a plain `ObjectHeader`) reached the raw
+    // `gep + load double` at `handle + 8 + idx*8`, i.e. straight into
+    // `parent_class_id ‖ field_count`, then the `keys_array` and `meta`
+    // POINTERS — reading two live GC child edges out as user doubles. The
+    // sibling tier in `index_get/guarded_array.rs` has always tested
+    // `GC_TYPE_ARRAY` here; this one only excluded lazy arrays.
+    //
+    // Strictly more restrictive than the old test (`GC_TYPE_LAZY_ARRAY` is 9,
+    // so `!= GC_TYPE_ARRAY` subsumes `== GC_TYPE_LAZY_ARRAY`): no receiver that
+    // used to take the slow path now takes the fast one. It is also one
+    // instruction CHEAPER — a single `icmp ne` replaces `icmp eq` + `or`.
     let gc_type_addr = blk.sub(I64, &arr_handle, "8");
     let gc_type_ptr = blk.inttoptr(I64, &gc_type_addr);
     let gc_type = blk.load(I8, &gc_type_ptr);
-    let is_lazy = blk.icmp_eq(I8, &gc_type, "9"); // GC_TYPE_LAZY_ARRAY
+    let not_array = blk.icmp_ne(I8, &gc_type, "1"); // != GC_TYPE_ARRAY
     let gc_flags_addr = blk.sub(I64, &arr_handle, "7");
     let gc_flags_ptr = blk.inttoptr(I64, &gc_flags_addr);
     let gc_flags = blk.load(I8, &gc_flags_ptr);
     let fwd_bits = blk.and(I8, &gc_flags, "128"); // GC_FLAG_FORWARDED
     let is_fwd = blk.icmp_ne(I8, &fwd_bits, "0");
-    let needs_slow = blk.or(I1, &is_lazy, &is_fwd);
+    let needs_slow = blk.or(I1, &not_array, &is_fwd);
     // Index accessors / custom attribute descriptors (`Object.defineProperty
     // (arr, i, { get })`) divert element reads through the descriptor tables —
     // the raw slot load below would bypass them (test262 sort/precise-*).

crates/perry-runtime/src/array/from_concat.rs

@@ -781,6 +781,15 @@ unsafe fn peek_plain_array_len(arr: *const ArrayHeader) -> Option<u32> {
     if crate::array::array_ptr_as_proxy(arr).is_some() {
         return None;
     }
+    // #7574: `clean_arr_ptr` now REFUSES a `GC_TYPE_OBJECT` allocation, so an
+    // array-like object — a `class X extends Array` instance among them — would
+    // fall into the null arm below and be mis-sized as an EMPTY array. It used
+    // to reach the `obj_type != GC_TYPE_ARRAY` test and answer `None`
+    // ("un-peekable, size it as 1 and take the spec-shaped per-source flow").
+    // Keep that answer: classify BEFORE the null shortcut.
+    if crate::array::subclass::raw_receiver_is_heap_object(arr) {
+        return None;
+    }
     let arr = clean_arr_ptr(arr);
     if arr.is_null() {
         return Some(0);
@@ -825,6 +834,16 @@ unsafe fn dense_concat_array_source(src: *const ArrayHeader) -> Option<(*const A
     if crate::array::array_ptr_as_proxy(src).is_some() {
         return None;
     }
+    // #7574: same hazard as `peek_plain_array_len` — but here mis-classifying a
+    // `class X extends Array` argument as an empty dense source would SILENTLY
+    // DROP its elements, because this bulk path returns `Some(out)` and the
+    // spec-shaped `append_concat_arg` flow (which has the subclass snapshot
+    // arm) never runs. `[1, 2].concat(sub)` yielded `1,2`. Reject it here so
+    // the caller falls through, exactly as it did before `clean_arr_ptr`
+    // started refusing object receivers.
+    if crate::array::subclass::raw_receiver_is_heap_object(src) {
+        return None;
+    }
     let src = clean_arr_ptr(src);
     if src.is_null() {
         return Some((src, 0));

crates/perry-runtime/src/array/header.rs

@@ -620,13 +620,51 @@ pub(crate) fn clean_arr_ptr(arr: *const ArrayHeader) -> *const ArrayHeader {
         if (cleaned as usize) >= crate::gc::GC_HEADER_SIZE + 0x1000 {
             let gc_header =
                 (cleaned as *const u8).sub(crate::gc::GC_HEADER_SIZE) as *const crate::gc::GcHeader;
-            if (*gc_header).obj_type == crate::gc::GC_TYPE_LAZY_ARRAY {
+            let obj_type = (*gc_header).obj_type;
+            if obj_type == crate::gc::GC_TYPE_LAZY_ARRAY {
                 let lazy = cleaned as *mut crate::json_tape::LazyArrayHeader;
                 if (*lazy).magic == crate::json_tape::LAZY_ARRAY_MAGIC {
                     let materialized = crate::json_tape::force_materialize_lazy(lazy);
                     return materialized as *const ArrayHeader;
                 }
             }
+            // #7574: a `GC_TYPE_OBJECT` / `GC_TYPE_CLOSURE` allocation is NOT
+            // an `ArrayHeader`, and the two layouts overlay field for field —
+            // `ArrayHeader.length` reads `ObjectHeader.object_type` (= 1),
+            // `.capacity` reads `class_id`, and the element slots at +8/+16/+24
+            // are `parent_class_id ‖ field_count`, `keys_array` and `meta`. The
+            // sanity check below waves that through (1 <= class_id <= 100M), so
+            // an element WRITE overwrites two live GC child edges with
+            // arbitrary doubles and the collector then traces them: `class X
+            // extends Array` in a `T[]`-annotated binding SIGSEGVs on its
+            // second `.push()`.
+            //
+            // A declared TypeScript type is a hint, never a layout fact
+            // (CLAUDE.md, *Known Limitations*), so this is reachable from every
+            // binding form. Refusing it here makes ALL ~190 `clean_arr_ptr`
+            // call sites fail-closed at once — each degrades through its
+            // existing null branch instead of dereferencing a forged header —
+            // and it is the same "resolve at the shared runtime funnel, not at
+            // one codegen predicate at a time" shape #7573 used for Map/Set.
+            //
+            // Correctness (rather than mere safety) for the entry points the
+            // declared-type tiers actually reach is layered on top: those null
+            // branches re-enter through `array::subclass::array_object_*`,
+            // which runs the operation on the spec-generic array-like engine.
+            //
+            // Costs one compare on a byte this block already loaded. Buffers
+            // and typed arrays are `std::alloc`-backed with no `GcHeader`, so
+            // their preceding bytes are allocator bookkeeping that can read as
+            // any value — confirm against the registries before nulling, in the
+            // cold arm only.
+            if obj_type == crate::gc::GC_TYPE_OBJECT || obj_type == crate::gc::GC_TYPE_CLOSURE {
+                let addr = cleaned as usize;
+                if !crate::buffer::is_registered_buffer(addr)
+                    && crate::typedarray::lookup_typed_array_kind(addr).is_none()
+                {
+                    return std::ptr::null();
+                }
+            }
         }
     }
     // Length/capacity sanity: dense arrays have length <= capacity and

crates/perry-runtime/src/array/indexing.rs

@@ -660,10 +660,15 @@ pub extern "C" fn js_array_get_element_f64(arr: i64, index: i64) -> f64 {
 /// Use when the codegen KNOWS the pointer is a plain Array (not Map/Set/Buffer).
 #[no_mangle]
 pub extern "C" fn js_array_get_f64_unchecked(arr: *const ArrayHeader, index: u32) -> f64 {
-    let arr = clean_arr_ptr(arr);
-    if arr.is_null() {
+    let cleaned = clean_arr_ptr(arr);
+    if cleaned.is_null() {
+        // #7574: array-like OBJECT receiver — see `js_array_get_f64`.
+        if crate::array::subclass::array_object_receiver(arr).is_some() {
+            return js_array_get_f64(arr, index);
+        }
         return f64::NAN;
     }
+    let arr = cleaned;
     // Index accessors / custom attrs installed via `Object.defineProperty`
     // need the descriptor-aware getter.
     if array_object_flags(arr) & crate::gc::OBJ_FLAG_ARRAY_DESCRIPTORS != 0 {
@@ -763,10 +768,17 @@ pub extern "C" fn js_array_get_f64(arr: *const ArrayHeader, index: u32) -> f64 {
             }
         }
     }
-    let arr = clean_arr_ptr(arr);
-    if arr.is_null() {
+    let cleaned = clean_arr_ptr(arr);
+    if cleaned.is_null() {
+        // #7574: `a[i]` on a `class X extends Array` instance held in a
+        // `T[]`-annotated binding. Read the object's indexed property through
+        // the spec-generic `Get`, not the `ObjectHeader` words.
+        if let Some(recv) = crate::array::subclass::array_object_receiver(arr) {
+            return crate::array::subclass::array_object_index_get(recv, index);
+        }
         return f64::NAN;
     }
+    let arr = cleaned;
     // Check if this is actually a TypedArray — dispatch through typed array helper
     if crate::typedarray::lookup_typed_array_kind(arr as usize).is_some() {
         return crate::typedarray::js_typed_array_get(
@@ -1074,10 +1086,20 @@ pub extern "C" fn js_array_set_f64_extend(
 ) -> *mut ArrayHeader {
     // Demote a uniquely-owned string source — see `js_array_set_f64`.
     crate::string::js_string_addref_if_heap_string(value);
-    let arr = clean_arr_ptr_mut(arr);
-    if arr.is_null() {
+    let cleaned = clean_arr_ptr_mut(arr);
+    if cleaned.is_null() {
+        // #7574: `a[i] = v` on a `class X extends Array` instance held in a
+        // `T[]`-annotated binding. Pre-fix this stored the value into
+        // `ObjectHeader.keys_array` / `.meta`. Run the object `[[Set]]` plus
+        // the Array-exotic `length` maintenance, and return the ORIGINAL
+        // receiver so the caller's realloc write-back keeps the binding.
+        if let Some(recv) = crate::array::subclass::array_object_receiver(arr) {
+            crate::array::subclass::array_object_index_set(recv, index, value);
+            return arr;
+        }
         return js_array_alloc(0);
     }
+    let arr = cleaned;
     // If this write targets `Array.prototype`, mark the prototype as carrying an
     // indexed property so out-of-bounds element reads on ordinary arrays consult
     // it (ECMA-262 OrdinaryGet → prototype chain). Cheap no-op otherwise.

crates/perry-runtime/src/array/iter_methods.rs

@@ -107,6 +107,18 @@ impl Drop for DenseThisGuard {
 /// Returns nothing (void)
 #[no_mangle]
 pub extern "C" fn js_array_forEach(arr: *const ArrayHeader, callback: *const ClosureHeader) {
+    // #7574: `normalize_array_receiver` materializes an array-like OBJECT
+    // receiver — a `class X extends Array` instance among them — into a fresh
+    // dense snapshot. The spec passes the RECEIVER as the callback's 3rd
+    // argument, so without this the callback saw the snapshot and
+    // `self === sub` was false (the same "forEach's 3rd argument" obligation
+    // #7573 hit for Map/Set). Gated on a one-load `GC_TYPE_OBJECT` header test,
+    // so a genuine array pays a compare and never enters the registry probes.
+    let self_override = if crate::array::subclass::raw_receiver_is_heap_object(arr) {
+        crate::array::subclass::array_object_receiver(arr)
+    } else {
+        None
+    };
     let arr = normalize_array_receiver(arr);
     if arr.is_null() {
         return;
@@ -142,6 +154,13 @@ pub extern "C" fn js_array_forEach(arr: *const ArrayHeader, callback: *const Clo
         let length = (*arr).length;
         let scope = crate::gc::RuntimeHandleScope::new();
         let rooted = RootedIterArray::new(&scope, arr);
+        // The override is a movable `ObjectHeader` held across user callbacks
+        // that allocate — root it for the duration of the loop.
+        let self_handle = self_override.map(|recv| scope.root_nanbox_f64(recv));
+        let self_value = |rooted: &RootedIterArray| match &self_handle {
+            Some(h) => h.get_nanbox_f64(),
+            None => rooted.receiver(),
+        };
         let _tg = DenseThisGuard::bind_undefined();
         if crate::array::array_iteration_is_exotic(arr) {
             for i in 0..length as usize {
@@ -150,7 +169,7 @@ pub extern "C" fn js_array_forEach(arr: *const ArrayHeader, callback: *const Clo
                     continue;
                 }
                 let element = crate::array::array_spec_get(arr, i as u32);
-                js_closure_call3(callback, element, i as f64, rooted.receiver());
+                js_closure_call3(callback, element, i as f64, self_value(&rooted));
             }
             return;
         }
@@ -162,7 +181,7 @@ pub extern "C" fn js_array_forEach(arr: *const ArrayHeader, callback: *const Clo
             // dispatch path supports call3 safely, so bound native
             // methods like `array.forEach(console.log)` can observe the
             // source array just like Node.
-            js_closure_call3(callback, element, i as f64, rooted.receiver());
+            js_closure_call3(callback, element, i as f64, self_value(&rooted));
         }
     }
 }

crates/perry-runtime/src/array/mod.rs

@@ -27,6 +27,8 @@ mod subclass;
 #[cfg(test)]
 mod spread_dense_tests;
 #[cfg(test)]
+mod subclass_tests;
+#[cfg(test)]
 mod tests;
 
 pub(crate) use self::alloc::{array_length_range_error, js_array_alloc_pointer_elements};
@@ -141,6 +143,13 @@ pub(crate) use self::sort::object_prototype_index_get as sort_object_prototype_i
 pub use self::subclass::{
     array_subclass_dense_snapshot, array_subclass_has_iterator_override, is_array_subclass_instance,
 };
+// #7574 — array-like OBJECT receiver resolution for the raw `js_array_*` entry
+// points, plus the Array-exotic `length` maintenance the generic OBJECT index
+// store needs for a `class X extends Array` receiver.
+pub(crate) use self::subclass::{
+    array_object_set_length, is_array_subclass_class_id, is_array_subclass_value,
+    maintain_array_exotic_length, note_array_subclass_index_write,
+};
 // Issue #1572 — flatten helpers reused by `node_stream::ns_iter_flat_map`
 // so an `async function*` mapper return is driven through the iterator
 // protocol instead of being appended as a single chunk.

crates/perry-runtime/src/array/push_pop.rs

@@ -589,10 +589,23 @@ pub extern "C" fn js_array_push_f64(arr: *mut ArrayHeader, value: f64) -> *mut A
         }
         return arr;
     }
-    let arr = clean_arr_ptr_mut(arr);
-    if arr.is_null() {
+    let cleaned = clean_arr_ptr_mut(arr);
+    if cleaned.is_null() {
+        // #7574: a `class X extends Array` instance (or any array-like object)
+        // in a `T[]`-annotated binding. Pre-fix `clean_arr_ptr` waved its
+        // `ObjectHeader` through and the store below overwrote `keys_array` /
+        // `meta` — the SECOND push SIGSEGVed (exit 139). Run the spec-generic
+        // `Array.prototype.push` on the object instead, and return the ORIGINAL
+        // receiver so codegen's realloc write-back leaves the binding pointing
+        // at the instance (returning a fresh empty array here is what made the
+        // push look silently dropped).
+        if let Some(recv) = crate::array::subclass::array_object_receiver(arr) {
+            crate::array::subclass::array_object_method(recv, "push", &[value]);
+            return arr;
+        }
         return js_array_alloc(0);
     }
+    let arr = cleaned;
     if array_is_frozen(arr) {
         throw_frozen_array_mutation();
     }
@@ -786,10 +799,18 @@ pub extern "C" fn js_array_pop_f64(arr: *mut ArrayHeader) -> f64 {
 /// here. test262 built-ins/Array length-write-on-frozen.
 #[no_mangle]
 pub extern "C" fn js_array_set_length_strict(arr: *mut ArrayHeader, new_length: f64) {
-    let arr = clean_arr_ptr_mut(arr);
-    if arr.is_null() {
+    let cleaned = clean_arr_ptr_mut(arr);
+    if cleaned.is_null() {
+        // #7574: `a.length = n` on a `class X extends Array` instance reached
+        // here through the `is_array_expr`-keyed `property_set` lowering and
+        // wrote `ObjectHeader.object_type`. Perform the Array-exotic
+        // `Set(O, "length", n, true)` on the object instead.
+        if let Some(recv) = crate::array::subclass::array_object_receiver(arr) {
+            crate::array::subclass::array_object_set_length(recv, new_length);
+        }
         return;
     }
+    let arr = cleaned;
     if array_object_flags(arr) & crate::gc::OBJ_FLAG_FROZEN != 0 {
         throw_non_writable_length();
     }