fix(instanceof): #7575 — a monomorphized generic class is an instance of the generic

`m instanceof MyMap` was false for a `class MyMap<K, V> extends Map<K, V>`
instance while `m instanceof Map` was true. The issue read this as a Map/Set
subclass / prototype-chain defect. It is neither: the mechanism is
MONOMORPHIZATION, and Map/Set had nothing to do with it.

Perry specializes generic classes. `class Gen<T> {}` plus `new Gen<number>()`
emits a SECOND class named `Gen$num` (monomorph::mangle::generate_specialized_name)
with its own class id, and the instance is stamped with that id — while
`x instanceof Gen` resolves the RHS to the GENERIC's id, which appears nowhere
in the specialization's parent chain. The bisect that pins it:

  class Gen<T> extends Base {}   new Gen<number>()  ->  instanceof Gen  false
  class Gen<T> extends Base {}   new Gen()          ->  instanceof Gen  true
  class Conc  extends Base {}    new Conc()         ->  instanceof Conc true
  class GenNoExtends<T> {}       new G<number>()    ->  instanceof G    false

The last row has no base class at all, so this was never about `super()`-to-a-
native-base wiring. `class MyMap<K, V> extends Map<K, V>` is simply the
idiomatic spelling, which is why it surfaced there.

HIR now records `Class::specialized_from`; codegen emits one
`js_register_class_generic_origin(spec, generic)` per specialization next to the
parent edges; and `instanceof`'s chain walk (now one shared, depth-bounded
`class_chain_reaches`, used by both the static and the dynamic-RHS path) follows
that edge as well as `extends`.

It is deliberately a SEPARATE edge, not a CLASS_REGISTRY parent edge: that chain
also resolves `super()` construction, static-method lookup and vtable dispatch,
so splicing the generic in between a specialization and its real base would
re-run the wrong constructor.

The Array-side sibling #7603 left unfixed is covered by the same mechanism —
`new GenArr<number>() instanceof GenArr` now holds. `constructor.name` still
reports the mangled `Gen$num`; that is the same root cause on a different
surface and is filed separately rather than folded in here.

Validated locally: new gap test byte-identical to node 26.5.1 and byte-identical
again under PERRY_GC_ZEAL=1 + PERRY_GC_PROTECT_FROMSPACE=1; 4 new runtime unit
tests over the walk (including that the edge stays directional and does not make
sibling specializations match); test_gap_6325 and test_gap_7570 tightened to
assert the subclass edge the issue asked for.

Author: Ralph Küpper

crates/perry-codegen/src/codegen/mod.rs

@@ -479,6 +479,10 @@ pub fn compile_module(hir: &HirModule, opts: CompileOptions) -> Result<Vec<u8>>
             // #6812: width hints don't cross module metadata; imported stubs
             // fall back to runtime learned sizing.
             alloc_width_hint: 0,
+            // #7575: monomorphization is per-module, so an imported stub never
+            // stands in for a specialization — its defining module registers
+            // the origin edge itself.
+            specialized_from: None,
             type_params: Vec::new(),
             extends: None,
             extends_name: ic.parent_name.clone(),

crates/perry-codegen/src/codegen/string_pool.rs

@@ -515,6 +515,38 @@ pub(super) fn emit_string_pool(
         );
     }
 
+    // #7575: register the GENERIC class a monomorphized specialization came
+    // from. `class Gen<T> {}` + `new Gen<number>()` emits a second class
+    // `Gen$num` carrying its own class id, and the instance is stamped with
+    // that id — but `x instanceof Gen` resolves the RHS to the GENERIC's id,
+    // which is in no parent chain, so the walk answered `false` for the class
+    // the user wrote. This is a distinct edge from the parent one on purpose:
+    // `CLASS_REGISTRY`'s chain also resolves `super()`, static-method lookup
+    // and vtable dispatch, so it must keep pointing at the real base.
+    let mut origin_pairs: Vec<(u32, u32)> = Vec::new();
+    for (name, &cid) in class_ids.iter() {
+        let Some(class) = classes.get(name) else {
+            continue;
+        };
+        let Some(generic_name) = &class.specialized_from else {
+            continue;
+        };
+        if let Some(&generic_cid) = class_ids.get(generic_name) {
+            if generic_cid != 0 && generic_cid != cid {
+                origin_pairs.push((cid, generic_cid));
+            }
+        }
+    }
+    origin_pairs.sort_unstable();
+    for (cid, generic_cid) in origin_pairs {
+        chunker.roll_if_full();
+        let blk = chunker.current_block();
+        blk.call_void(
+            "js_register_class_generic_origin",
+            &[(I32, &cid.to_string()), (I32, &generic_cid.to_string())],
+        );
+    }
+
     // Issue #392: register every user class method in the runtime
     // VTABLE_REGISTRY so cross-module callers can dispatch via
     // `js_native_call_method` even when the codegen of the calling

crates/perry-codegen/src/runtime_decls/strings.rs

@@ -1275,6 +1275,11 @@ pub fn declare_phase_b_strings(module: &mut LlModule) {
     // allocators register on every alloc; the inline allocator skips
     // the alloc-site call and relies on this one-time registration.
     module.declare_function("js_register_class_parent", VOID, &[I32, I32]);
+    // #7575: specialization -> generic edge for monomorphized generic classes.
+    // A SEPARATE edge from the parent one: the parent chain also resolves
+    // `super()`, static-method lookup and vtable dispatch, so only `instanceof`
+    // may follow this one.
+    module.declare_function("js_register_class_generic_origin", VOID, &[I32, I32]);
     // Issue #711: dynamic parent registration for `class X extends fn(...)`
     // shapes. Codegen emits at the class-declaration source position in
     // module.init (lower.rs); the runtime helper extracts the parent

crates/perry-codegen/src/stmt/element_shape_loop_tests.rs

@@ -118,6 +118,7 @@ fn node_class(extends_name: Option<&str>) -> Class {
         aliases: Vec::new(),
         is_nested: false,
         alloc_width_hint: 0,
+        specialized_from: None,
     }
 }
 

crates/perry-codegen/src/type_analysis_tests.rs

@@ -215,6 +215,7 @@ fn hir_inferred_types_reuse_codegen_contextual_class_facts() {
         is_exported: false,
         is_nested: false,
         alloc_width_hint: 0,
+        specialized_from: None,
         aliases: Vec::new(),
     };
     let widget = perry_hir::Class {
@@ -286,6 +287,7 @@ fn hir_inferred_types_reuse_codegen_contextual_class_facts() {
         is_exported: false,
         is_nested: false,
         alloc_width_hint: 0,
+        specialized_from: None,
         aliases: Vec::new(),
     };
     let classes = HashMap::from([("Base".to_string(), &base), ("Widget".to_string(), &widget)]);

crates/perry-hir/src/analysis/value_types_tests.rs

@@ -623,6 +623,7 @@ fn seeds_contextual_class_and_enum_facts_from_module() {
         is_exported: false,
         is_nested: false,
         alloc_width_hint: 0,
+        specialized_from: None,
         aliases: Vec::new(),
     });
 
@@ -696,6 +697,7 @@ fn infers_named_class_and_interface_property_facts() {
         is_exported: false,
         is_nested: false,
         alloc_width_hint: 0,
+        specialized_from: None,
         aliases: Vec::new(),
     });
     module.classes.push(Class {
@@ -721,6 +723,7 @@ fn infers_named_class_and_interface_property_facts() {
         is_exported: false,
         is_nested: false,
         alloc_width_hint: 0,
+        specialized_from: None,
         aliases: Vec::new(),
     });
     module.interfaces.push(Interface {
@@ -1665,6 +1668,7 @@ fn resolves_this_and_super_in_class_context() {
         is_exported: false,
         is_nested: false,
         alloc_width_hint: 0,
+        specialized_from: None,
         aliases: Vec::new(),
     });
     module.classes.push(Class {
@@ -1690,6 +1694,7 @@ fn resolves_this_and_super_in_class_context() {
         is_exported: false,
         is_nested: false,
         alloc_width_hint: 0,
+        specialized_from: None,
         aliases: Vec::new(),
     });
 

crates/perry-hir/src/ir/decl.rs

@@ -268,6 +268,19 @@ pub struct Class {
     /// site. Pure capacity: does not add fields, keys, or enumeration
     /// entries. 0 = no hint.
     pub alloc_width_hint: u32,
+    /// #7575: the GENERIC class this one was monomorphized from, when it is a
+    /// specialization. `class Gen<T> {}` + `new Gen<number>()` produces a second
+    /// class named `Gen$num` (`monomorph::mangle::generate_specialized_name`)
+    /// carrying its own class id, and the instance is stamped with THAT id —
+    /// while `x instanceof Gen` resolves the RHS to the generic's id, which no
+    /// longer appears anywhere in the instance's chain.
+    ///
+    /// The runtime learns the edge from here (`js_register_class_generic_origin`)
+    /// and consults it during the `instanceof` chain walk ONLY. It deliberately
+    /// is not folded into `extends`/`extends_name`: the runtime parent chain also
+    /// resolves `super()`, static-method lookup and vtable dispatch, so splicing
+    /// the generic in as a parent would re-run the wrong constructor.
+    pub specialized_from: Option<String>,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]

crates/perry-hir/src/lower/context.rs

@@ -1101,6 +1101,7 @@ impl LoweringContext {
             // timing is irrelevant.
             is_nested: false,
             alloc_width_hint,
+            specialized_from: None,
         });
 
         self.anon_shape_classes

crates/perry-hir/src/lower/module_decl/namespace.rs

@@ -110,6 +110,7 @@ pub(crate) fn lower_namespace_as_class(
                 aliases: Vec::new(),
                 is_nested: false,
                 alloc_width_hint: 0,
+                specialized_from: None,
             });
         }
     };
@@ -409,5 +410,6 @@ pub(crate) fn lower_namespace_as_class(
         aliases: Vec::new(),
         is_nested: false,
         alloc_width_hint: 0,
+        specialized_from: None,
     })
 }

crates/perry-hir/src/lower_decl/class_decl.rs

@@ -1304,6 +1304,7 @@ pub fn lower_class_decl(
         // initializers must run on class evaluation, not at module init.
         is_nested: ctx.scope_depth > 0 || ctx.inside_block_scope > 0,
         alloc_width_hint: 0,
+        specialized_from: None,
     })
 }
 
@@ -1911,5 +1912,6 @@ pub fn lower_class_from_ast(
         // initializers must run on class evaluation, not at module init.
         is_nested: ctx.scope_depth > 0 || ctx.inside_block_scope > 0,
         alloc_width_hint: 0,
+        specialized_from: None,
     })
 }