fix(runtime): reflect ClassBody accessors on per-evaluation class prototypes

changelog.d/11113-class-eval-proto-accessors.md

@@ -0,0 +1,25 @@
+fix(runtime): a capture-carrying class's prototype now reflects its ClassBody accessors (part of #11043)
+
+A class whose members close over a local of the enclosing function lowers to
+`ClassExprFresh`, and each evaluation materializes its own prototype object
+(`class_evaluation_prototype_value`). Like a declared class's prototype, that
+object carries physical `constructor` + method keys while `get`/`set`
+accessors live only in the template vtable — but it was never recognized by
+`class_id_for_decl_prototype_object`, the lookup every reflection site uses to
+surface those accessors. So `Object.getOwnPropertyNames(C.prototype)` omitted
+them, and `Object.defineProperties(C.prototype, { x: { enumerable: true } })`
+(whatwg-url's generated `URL` wrapper) installed a read-only `undefined` data
+property over `get x`/`set x`. mongodb 7.5.0 compiled from real source then
+threw `Cannot assign to read only property 'pathname'` from
+`mongodb-connection-string-url`'s `ConnectionString` constructor.
+
+`class_id_for_decl_prototype_object` now falls back to
+`class_evaluation_prototype_class_id`, which recognizes a per-evaluation
+prototype structurally (own `constructor` is a heap class object of the same
+template id whose hidden evaluation-prototype slot points back at it) — no
+side table to root or rekey, no allocation, and gated on an `AtomicBool` so
+programs without such classes pay one relaxed load on the miss path.
+
+Gap test: `test_gap_11043_class_eval_proto_accessors`. The next mongodb blocker
+is #11111 (`net.Socket#write` returns `undefined`); #11112 tracks the `in`
+operator on the same class shape.

crates/perry-runtime/src/object/class_registry/state.rs

@@ -823,7 +823,18 @@ pub(crate) fn class_id_for_decl_prototype_object(ptr: usize) -> Option<u32> {
     if ptr == 0 {
         return None;
     }
-    CLASS_DECL_PROTOTYPE_OBJECTS.with(|table| table.read().ok()?.as_ref()?.class_id_for(ptr))
+    CLASS_DECL_PROTOTYPE_OBJECTS
+        .with(|table| table.read().ok()?.as_ref()?.class_id_for(ptr))
+        // #11043: a capture-carrying class (`ClassExprFresh`) gets a distinct
+        // prototype object per evaluation instead of the table entry above,
+        // but it is built exactly like one — physical constructor + methods,
+        // ClassBody accessors living only in the template's vtable. Every
+        // reflection site keyed on this lookup (descriptors, own keys,
+        // `defineProperty`, `hasOwn`, `delete`) must therefore see it too, or
+        // its accessors are invisible and `Object.defineProperties(C.prototype,
+        // { x: { enumerable: true } })` replaces `get x`/`set x` with a
+        // read-only `undefined` data property (whatwg-url's `URL`).
+        .or_else(|| super::super::field_get_set::class_evaluation_prototype_class_id(ptr))
 }
 
 /// #7757: a monomorphized specialization (`Gen$num`) must present the GENERIC's

crates/perry-runtime/src/object/field_get_set.rs

@@ -265,7 +265,9 @@ pub(crate) use accessors::{
     primitive_builtin_prototype_property, primitive_object_prototype_accessor,
     primitive_tagged_prototype_property, string_index_value,
 };
-pub(crate) use class_object_props::class_object_prototype_value;
+pub(crate) use class_object_props::{
+    class_evaluation_prototype_class_id, class_object_prototype_value,
+};
 pub(crate) use crypto_key::{
     crypto_key_property_value, CLASS_ID_BOXED_BIGINT, CLASS_ID_BOXED_BOOLEAN,
     CLASS_ID_BOXED_NUMBER, CLASS_ID_BOXED_STRING, CLASS_ID_BOXED_SYMBOL,

crates/perry-runtime/src/object/field_get_set/class_object_props.rs

@@ -7,6 +7,67 @@ use super::*;
 
 const CLASS_EVALUATION_PROTOTYPE_KEY: &[u8] = b"#<perry:class-evaluation-prototype>";
 
+/// Set once the first per-evaluation prototype is materialized, so
+/// [`class_evaluation_prototype_class_id`] costs one relaxed load for the
+/// (overwhelmingly common) program that never builds one. Its caller is the
+/// miss path of `class_id_for_decl_prototype_object`, which every
+/// `Object.defineProperty` reaches (#9180).
+static CLASS_EVALUATION_PROTOTYPES_MATERIALIZED: std::sync::atomic::AtomicBool =
+    std::sync::atomic::AtomicBool::new(false);
+
+/// #11043: the template class id of `ptr` when it is the prototype object
+/// materialized by [`class_evaluation_prototype_value`] for one evaluation of
+/// a heap class object, else `None`.
+///
+/// Recognized structurally rather than through a side table: the prototype's
+/// own `constructor` is the class object, and that class object's hidden
+/// evaluation-prototype slot points back at `ptr`. A side table would have to
+/// be either a GC root (leaking one prototype per evaluation of a class that
+/// lives in a factory) or a weak, evacuation-rekeyed map; the back-edge is
+/// already maintained by the heap itself. Never allocates — callers hold raw
+/// pointers across this call.
+pub(crate) fn class_evaluation_prototype_class_id(ptr: usize) -> Option<u32> {
+    if !CLASS_EVALUATION_PROTOTYPES_MATERIALIZED.load(std::sync::atomic::Ordering::Relaxed) {
+        return None;
+    }
+    unsafe {
+        let header = crate::value::addr_class::try_read_gc_header(ptr)?;
+        if header.obj_type != crate::gc::GC_TYPE_OBJECT
+            || header.gc_flags & crate::gc::GC_FLAG_FORWARDED != 0
+        {
+            return None;
+        }
+        // A class object shares its template id with its prototype; it is
+        // the constructor, never the prototype.
+        if super::super::class_registry::is_class_object_ptr(ptr as *const u8) {
+            return None;
+        }
+        let class_id = (*(ptr as *const ObjectHeader)).class_id;
+        if class_id == 0 {
+            return None;
+        }
+        let proto_value = crate::value::js_nanbox_pointer(ptr as i64);
+        let ctor = super::super::js_object_get_own_field_or_undef(
+            proto_value,
+            b"constructor".as_ptr(),
+            b"constructor".len(),
+        );
+        if !super::super::class_registry::is_class_object_value(ctor) {
+            return None;
+        }
+        let class_obj = JSValue::from_bits(ctor.to_bits()).as_pointer::<ObjectHeader>();
+        if (*class_obj).class_id != class_id {
+            return None;
+        }
+        let back_edge = super::super::js_object_get_own_field_or_undef(
+            ctor,
+            CLASS_EVALUATION_PROTOTYPE_KEY.as_ptr(),
+            CLASS_EVALUATION_PROTOTYPE_KEY.len(),
+        );
+        (back_edge.to_bits() == proto_value.to_bits()).then_some(class_id)
+    }
+}
+
 /// Materialize the distinct prototype object created by one evaluation of a
 /// heap class expression/declaration. Template class ids still own dispatch,
 /// but observable method identity and private-name closures belong to the
@@ -29,6 +90,7 @@ unsafe fn class_evaluation_prototype_value(obj: *const ObjectHeader) -> f64 {
 
     let class_id = class.with_mut_ptr::<ObjectHeader, _>(|class| (*class).class_id);
     let proto = scope.root_raw_mut_ptr(js_object_alloc(class_id, 0));
+    CLASS_EVALUATION_PROTOTYPES_MATERIALIZED.store(true, std::sync::atomic::Ordering::Relaxed);
 
     let constructor_key = crate::string::js_string_from_bytes(b"constructor".as_ptr(), 11);
     let constructor_key = scope.root_string_ptr(constructor_key);

test-files/test_gap_11043_class_eval_proto_accessors.ts

@@ -0,0 +1,138 @@
+// #11043: a capture-carrying class (one whose members close over a local of
+// the enclosing function) gets a distinct prototype object per evaluation.
+// Its ClassBody accessors must be own properties of that prototype, exactly
+// like a top-level class's. whatwg-url's generated `URL` wrapper is the shape
+// that broke mongodb: the class is declared inside `install(globalObject)`,
+// its accessors close over `globalObject`, and the module then runs
+// `Object.defineProperties(URL.prototype, { pathname: { enumerable: true } })`.
+// A generic descriptor must only flip `enumerable` — before the fix it
+// replaced the accessor with a read-only `undefined` data property and
+// `url.pathname = "/"` threw "Cannot assign to read only property".
+
+function describe(label: string, proto: object, key: string): void {
+  const d = Object.getOwnPropertyDescriptor(proto, key);
+  if (d === undefined) {
+    console.log(label, key, "missing");
+    return;
+  }
+  console.log(
+    label,
+    key,
+    "get:" + typeof d.get,
+    "set:" + typeof d.set,
+    "enumerable:" + d.enumerable,
+    "configurable:" + d.configurable,
+    "value" in d ? "has-value" : "no-value",
+  );
+}
+
+// 1. The whatwg-url shape.
+const implSymbol = Symbol("impl");
+function install(globalObject: any): void {
+  class URL {
+    constructor(href: string) {
+      const wrapper = Object.create(new.target.prototype);
+      Object.defineProperty(wrapper, implSymbol, {
+        value: { href, pathname: "" },
+        configurable: true,
+      });
+      return wrapper;
+    }
+    get href(): string {
+      const esValue = this !== null && this !== undefined ? this : globalObject;
+      return esValue[implSymbol].href;
+    }
+    get pathname(): string {
+      const esValue = this !== null && this !== undefined ? this : globalObject;
+      return esValue[implSymbol].pathname;
+    }
+    set pathname(v: string) {
+      const esValue = this !== null && this !== undefined ? this : globalObject;
+      esValue[implSymbol].pathname = String(v);
+    }
+    toJSON(): string {
+      return (this as any)[implSymbol].href;
+    }
+  }
+  console.log("own before", Object.getOwnPropertyNames(URL.prototype).join(","));
+  describe("before", URL.prototype, "pathname");
+  Object.defineProperties(URL.prototype, {
+    toJSON: { enumerable: true },
+    href: { enumerable: true },
+    pathname: { enumerable: true },
+    [Symbol.toStringTag]: { value: "URL", configurable: true },
+  });
+  describe("after", URL.prototype, "pathname");
+  describe("after", URL.prototype, "href");
+  describe("after", URL.prototype, "toJSON");
+  console.log("keys after", Object.keys(URL.prototype).join(","));
+  Object.defineProperty(globalObject, "URL", { configurable: true, writable: true, value: URL });
+}
+const sharedGlobalObject: any = {};
+install(sharedGlobalObject);
+const WURL = sharedGlobalObject.URL;
+
+const u = new WURL("mongodb://h/x");
+u.pathname = "/db";
+console.log("set on instance", u.pathname, Object.prototype.toString.call(u));
+
+// 2. Reflection on a plain capturing accessor, per evaluation.
+function makeCounter(start: number) {
+  let n = start;
+  class Counter {
+    get value(): number {
+      return n;
+    }
+    set value(v: number) {
+      n = v;
+    }
+    get readOnly(): number {
+      return n * 2;
+    }
+    bump(): number {
+      return ++n;
+    }
+  }
+  return Counter;
+}
+const A = makeCounter(1);
+const B = makeCounter(10);
+console.log("distinct prototypes", A.prototype !== B.prototype);
+describe("A", A.prototype, "value");
+describe("A", A.prototype, "readOnly");
+describe("A", A.prototype, "bump");
+console.log(
+  "hasOwn",
+  Object.prototype.hasOwnProperty.call(A.prototype, "value"),
+  Object.prototype.hasOwnProperty.call(B.prototype, "readOnly"),
+  Object.prototype.hasOwnProperty.call(new A(), "value"),
+);
+console.log("names A", Object.getOwnPropertyNames(A.prototype).join(","));
+console.log("names B", Object.getOwnPropertyNames(B.prototype).join(","));
+Object.defineProperty(B.prototype, "value", { enumerable: true });
+describe("B redefined", B.prototype, "value");
+const b = new B();
+b.value = 42;
+console.log("B setter after redefine", b.value, b.bump(), b.readOnly);
+const a = new A();
+a.value = 7;
+console.log("A untouched", a.value, a.bump());
+
+// A reflected getter still reads through the receiver.
+const getter = Object.getOwnPropertyDescriptor(A.prototype, "readOnly")!.get!;
+console.log("reflected getter", getter.call(a));
+
+// 3. Getter-only accessor stays getter-only after a generic redefine.
+function makeFrozen(tag: string) {
+  class Frozen {
+    get tag(): string {
+      return tag;
+    }
+  }
+  Object.defineProperties(Frozen.prototype, { tag: { enumerable: true } });
+  return Frozen;
+}
+const F = makeFrozen("t1");
+describe("F", F.prototype, "tag");
+const f: any = new F();
+console.log("F reads", f.tag, Object.keys(F.prototype).join(","));