fix(runtime): an inherited static reads its declaring class evaluation's captures (#11200, #10911)

changelog.d/11230-inherited-static-captures.md

@@ -0,0 +1,3 @@
+- **An inherited static reached through a subclass reads its declaring class's captured bindings, not the subclass's (#11200, #10911).** A class that reads an enclosing binding keeps its captured values on each evaluated class object, in `__perry_ctor_caps`. A CommonJS module body is lowered as a function body, so any class in it that reads a module-scope `const` or function counts as capturing. A capturing static's prologue reads slot `index` through `js_class_capture_value_for_receiver`, which took the receiver (or the static-dispatch owner, which is also the receiver) and read its caps array directly. For `Sub.make()` running `Base.make`, that is the SUBCLASS's array, which is laid out for the subclass's own capture list, so the read returned an unrelated binding. mongodb 7.5.0's `CursorResponse.make(bson)` (inherited from `MongoDBResponse`) saw `typeof isErrorResponse === "object"`, and `collection.find().toArray()` threw `TypeError: value is not a function`. The read now walks each candidate's heritage to the evaluation of the DECLARING template (per-evaluation pinned parent first, then the template-keyed dynamic parent, the order `instanceof` uses) and reads only that evaluation's array. When no such evaluation is reachable it uses the declaration snapshot, and never another class's array. The same walk fixes #10911's capturing static METHOD on a factory class expression inherited by a top-level declaration (`class A3 extends fCapM("a") {}; A3.tagv()` returned `undefined`). A ClassRef has no caps array, and a class expression registers no snapshot, so that read had nothing to fall back on.
+- A static GETTER inherited through a per-evaluation class object now binds `this` to the class the read started from. `get_field_by_name`'s pinned-parent recursion re-entered with the parent evaluation as the object, so `Sub.tag` ran with `this === Base`. It now stashes the original receiver through `accessor_receiver_override_begin`, the same way the ClassRef static-prototype walk does.
+- Files: `crates/perry-runtime/src/object/class_constructors.rs` (`capture_owner_for_template`, `class_object_capture_slot`) and `crates/perry-runtime/src/object/field_get_set/get_field_by_name.rs`. Gap test `test-files/test_gap_11200_inherited_static_module_captures.ts` (+ `fixtures/issue_11200_inherited_static_captures/`) covers the mongodb shape, 4-level inheritance, a computed `(rt ?? Base).make` receiver, `.call` with a subclass receiver, static getters, subclass-own capturing statics, and the #10911 factory rows.

crates/perry-runtime/src/object/class_constructors.rs

@@ -60,23 +60,97 @@ pub extern "C" fn js_class_capture_value_for_receiver(
     // Function.prototype.call/apply. Dispatch restores that evaluated class
     // either as the private lexical brand (method-value dispatch) or as the
     // static private owner (ordinary static dispatch); prefer it when present.
-    let receiver = super::field_get_set::current_private_lexical_brand_value(class_id)
-        .or_else(super::static_private_owner_current)
-        .unwrap_or(receiver);
-    if super::class_registry::is_class_object_value(receiver) {
-        let caps_value =
-            super::js_object_get_own_field_or_undef(receiver, b"__perry_ctor_caps".as_ptr(), 17);
-        let caps = crate::value::JSValue::from_bits(caps_value.to_bits());
-        if caps.is_pointer() {
-            let array = caps.as_pointer::<crate::array::ArrayHeader>();
-            if !array.is_null() && index < crate::array::js_array_length(array) {
-                return crate::array::js_array_get_f64(array, index);
-            }
+    //
+    // #11200 / #10911: the candidate is not necessarily an evaluation of
+    // `class_id` itself. An INHERITED static reached through a subclass
+    // (`Sub.make()` running `Base.make`) is dispatched with the SUBCLASS as
+    // receiver and owner, and the subclass's own `__perry_ctor_caps` is laid
+    // out for the subclass's capture list -- reading `index` from it returned
+    // an unrelated binding (mongodb's `CursorResponse.make` saw an object
+    // where `isErrorResponse` belonged). And a top-level `class A extends
+    // f()` is a ClassRef with no caps at all, so its inherited capturing
+    // statics fell through to the template snapshot, which a class
+    // EXPRESSION never registers (`undefined`). Only an evaluation of the
+    // declaring template owns these slots: walk each candidate's heritage to
+    // it, and when none is reachable use the declaration snapshot -- never
+    // another class's array.
+    let candidates = [
+        super::field_get_set::current_private_lexical_brand_value(class_id),
+        super::static_private_owner_current(),
+        Some(receiver),
+    ];
+    for candidate in candidates.into_iter().flatten() {
+        if let Some(owner) = capture_owner_for_template(candidate, class_id) {
+            return class_object_capture_slot(owner, index)
+                .unwrap_or_else(|| js_class_capture_value(class_id, index));
         }
     }
     js_class_capture_value(class_id, index)
 }
 
+/// The class evaluation of template `class_id` that `start` (a class object or
+/// a declaration ClassRef) is, or inherits from. Each hop prefers the
+/// per-evaluation pinned parent and falls back to the template-keyed dynamic
+/// heritage, the same order `instanceof`'s `class_chain_reaches_dynamic` walks.
+/// A ClassRef of `class_id` itself answers `None`: a declaration's captures
+/// live in its decl-site snapshot, not on an object.
+fn capture_owner_for_template(start: f64, class_id: u32) -> Option<f64> {
+    let mut current = start;
+    for _ in 0..64 {
+        let cid = if super::class_registry::is_class_object_value(current) {
+            let object =
+                crate::value::JSValue::from_bits(current.to_bits()).as_pointer::<ObjectHeader>();
+            if object.is_null() {
+                return None;
+            }
+            let cid = super::js_object_get_class_id(object);
+            if cid == class_id {
+                return Some(current);
+            }
+            if let Some(parent) = super::class_registry::class_object_pinned_parent(object) {
+                current = parent;
+                continue;
+            }
+            cid
+        } else if super::class_prototype_ref_id(current).is_some() {
+            return None;
+        } else {
+            let cid = super::class_ref_id(current)?;
+            if cid == class_id {
+                return None;
+            }
+            cid
+        };
+        if cid == 0 {
+            return None;
+        }
+        let parent = super::class_registry::parent_static::template_dynamic_parent_value(cid);
+        if parent.to_bits() == current.to_bits() {
+            return None;
+        }
+        current = parent;
+    }
+    None
+}
+
+/// Slot `index` of a class evaluation's own `__perry_ctor_caps` array, when it
+/// carries one that long. `class_value` must already be a verified class object
+/// (`capture_owner_for_template` only answers with one), so this does not
+/// repeat that registry check on the static-method prologue's hot path.
+fn class_object_capture_slot(class_value: f64, index: u32) -> Option<f64> {
+    let caps_value =
+        super::js_object_get_own_field_or_undef(class_value, b"__perry_ctor_caps".as_ptr(), 17);
+    let caps = crate::value::JSValue::from_bits(caps_value.to_bits());
+    if !caps.is_pointer() {
+        return None;
+    }
+    let array = caps.as_pointer::<crate::array::ArrayHeader>();
+    if array.is_null() || index >= crate::array::js_array_length(array) {
+        return None;
+    }
+    Some(crate::array::js_array_get_f64(array, index))
+}
+
 /// #1787: per-template constructor function pointers, keyed by the
 /// compile-time class_id. The value is `(fn_ptr, total_param_count)`:
 /// `fn_ptr` is the standalone `<prefix>__<class>_constructor` LLVM symbol

crates/perry-runtime/src/object/field_get_set/get_field_by_name.rs

@@ -680,7 +680,27 @@ pub(crate) fn get_field_by_name_past_inherited_cache(
                                 && crate::value::addr_class::is_above_handle_band(praw as usize)
                                 && crate::object::is_valid_obj_ptr(praw as *const u8)
                             {
+                                // #10911: the recursion re-enters with the
+                                // PARENT evaluation as the object, so a static
+                                // getter found there would bind `this` to the
+                                // parent (`Sub.tag` ran with `this === Base`).
+                                // Stash the class the read started from --
+                                // `begin` keeps the OUTERMOST one across a
+                                // multi-level walk -- exactly as the ClassRef
+                                // static-prototype walk below does.
+                                let scope = crate::gc::RuntimeHandleScope::new();
+                                let receiver = f64::from_bits(
+                                    crate::value::js_nanbox_pointer(obj as i64).to_bits(),
+                                );
+                                let prev =
+                                    crate::object::field_get_set::accessor_receiver_override_begin(
+                                        receiver,
+                                    )
+                                    .map(|value| scope.root_nanbox_f64(value));
                                 let v = js_object_get_field_by_name(praw, key);
+                                crate::object::field_get_set::accessor_receiver_override_end(
+                                    prev.map(|handle| handle.get_nanbox_f64()),
+                                );
                                 if !v.is_undefined() {
                                     return v;
                                 }

test-files/fixtures/issue_11200_inherited_static_captures/doc.cjs

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Doc = void 0;
+class Doc {
+    constructor(bson, offset = 0, isArray = false, elements) {
+        this.cache = Object.create(null);
+        this.bson = bson;
+        this.elements = elements ?? [bson.length];
+    }
+    get(name) { return this.cache[name] ?? null; }
+}
+exports.Doc = Doc;

test-files/fixtures/issue_11200_inherited_static_captures/responses.cjs

@@ -0,0 +1,54 @@
+"use strict";
+// Mirrors the shape of mongodb 7.5.0's lib/cmap/wire_protocol/responses.js:
+// a static `make` on the base reads module-scope bindings (a namespace object,
+// a function, a const table), and is inherited by subclasses that carry their
+// OWN, differently laid out, module-scope captures.
+Object.defineProperty(exports, "__esModule", { value: true });
+const lib_1 = { parse(b) { return [b.length]; } };
+const doc_1 = require("./doc.cjs");
+const Off = { a: 0, b: 1 };
+const PREFIX = "resp:";
+function isErr(b, els) {
+    for (let i = 0; i < els.length; i++) {
+        if (els[i] === Off.b + 100) return true;
+    }
+    return b === "err";
+}
+class ErrorBox {
+    constructor(message) { this.message = message; }
+}
+class Base extends doc_1.Doc {
+    static make(bson) {
+        const elements = (0, lib_1.parse)(bson);
+        const isError = isErr(bson, elements);
+        return isError ? new Base(bson, 0, false, elements) : new this(bson, 0, false, elements);
+    }
+    static describe() {
+        return PREFIX + this.name + ":" + typeof isErr + ":" + typeof lib_1.parse + ":" + Off.b;
+    }
+    static get tag() {
+        return PREFIX + this.name + "/" + new ErrorBox("x").constructor.name;
+    }
+}
+exports.Base = Base;
+class Sub extends Base {
+    constructor() {
+        super(...arguments);
+        this._batch = null;
+        this.iterated = 0;
+    }
+    get id() {
+        try { return lib_1.parse(this.cursor); }
+        catch (cause) { throw new ErrorBox(cause.message); }
+    }
+    static kind() { return "sub-" + PREFIX + typeof ErrorBox; }
+}
+exports.Sub = Sub;
+class Sub2 extends Sub {
+    get more() { return Off.a + String(doc_1.Doc.name); }
+}
+exports.Sub2 = Sub2;
+class Leaf extends Sub2 {
+    static leafOnly() { return isErr("err", [0]) + ":" + PREFIX; }
+}
+exports.Leaf = Leaf;

test-files/test_gap_11200_inherited_static_module_captures.ts

@@ -0,0 +1,107 @@
+// #11200 / #10911: an INHERITED static reached through a subclass must read the
+// DECLARING class's captured bindings.
+//
+// CommonJS module bodies lower as function bodies, so a class there that reads
+// a module-scope binding is a capture-carrying class: its captures live on the
+// class object as a per-evaluation array. Static dispatch through a subclass
+// (`Sub.make()` running `Base.make`) handed the capture read the SUBCLASS
+// object, and the read took slot `index` of the subclass's own array -- laid
+// out for the subclass's capture list, so it returned an unrelated binding.
+// mongodb 7.5.0's `CursorResponse.make(bson)` saw `typeof isErrorResponse ===
+// "object"` and `find().toArray()` threw `value is not a function`.
+//
+// The #10911 half: a top-level `class A extends factory()` inheriting a
+// capturing static METHOD from the factory's class expression read the
+// capture as `undefined` (a ClassRef carries no capture array, and a class
+// expression registers no declaration snapshot).
+import * as resp from "./fixtures/issue_11200_inherited_static_captures/responses.cjs";
+
+function say(label: string, f: () => unknown) {
+  try {
+    console.log(label, String(f()));
+  } catch (e: any) {
+    console.log(label, "THREW", e?.constructor?.name, e?.message);
+  }
+}
+
+const R: any = resp;
+
+// 1. The mongodb shape: `make` on the base, called through each subclass.
+say("Base.make", () => R.Base.make("abc").constructor.name);
+say("Sub.make", () => R.Sub.make("abc").constructor.name);
+say("Sub2.make", () => R.Sub2.make("abc").constructor.name);
+say("Leaf.make", () => R.Leaf.make("abc").constructor.name);
+say("Sub.make(err)", () => R.Sub.make("err").constructor.name);
+// `(responseType ?? MongoDBResponse).make(bson)` -- a computed receiver.
+for (const responseType of [undefined, R.Sub, R.Leaf]) {
+  say("(rt ?? Base).make", () => (responseType ?? R.Base).make("xy").constructor.name);
+}
+say("Sub.make.elements", () => JSON.stringify(R.Sub.make("abcd").elements));
+
+// 2. Module-scope function / namespace object / const table, read by an
+//    inherited static, at every depth.
+say("Base.describe", () => R.Base.describe());
+say("Sub.describe", () => R.Sub.describe());
+say("Sub2.describe", () => R.Sub2.describe());
+say("Leaf.describe", () => R.Leaf.describe());
+
+// 3. A static getter using `this` and a captured class, via subclasses.
+say("Base.tag", () => R.Base.tag);
+say("Sub.tag", () => R.Sub.tag);
+say("Leaf.tag", () => R.Leaf.tag);
+
+// 4. The subclasses' own capturing statics still read their own captures.
+say("Sub.kind", () => R.Sub.kind());
+say("Leaf.kind", () => R.Leaf.kind());
+say("Leaf.leafOnly", () => R.Leaf.leafOnly());
+
+// 5. Instances built through the inherited static keep working.
+say("Leaf.make.more", () => R.Leaf.make("q").more);
+say("Sub.make instanceof", () => R.Sub.make("q") instanceof R.Sub);
+
+// 6. Inherited static via `.call` with a subclass receiver.
+say("Base.make.call(Sub2)", () => R.Base.make.call(R.Sub2, "zz").constructor.name);
+say("Base.describe.call(Leaf)", () => R.Base.describe.call(R.Leaf));
+
+// 7. #10911: capturing statics of a factory class expression, inherited by
+//    top-level declarations, including two levels down.
+function fCapM(tag: string) {
+  return class Out {
+    static who() { return this; }
+    static tagv() { return tag; }
+    static get tagg() { return tag + ":" + this.name; }
+  };
+}
+class A3 extends fCapM("a") {}
+class B3 extends fCapM("b") {}
+class C3 extends A3 {}
+say("A3.who()===A3", () => (A3 as any).who() === A3);
+say("A3.tagv()", () => (A3 as any).tagv());
+say("B3.tagv()", () => (B3 as any).tagv());
+say("C3.tagv()", () => (C3 as any).tagv());
+say("A3.tagg", () => (A3 as any).tagg);
+say("C3.tagg", () => (C3 as any).tagg);
+const O = fCapM("o");
+say("O.tagv()", () => (O as any).tagv());
+say("A3.tagv() again", () => (A3 as any).tagv());
+
+// 8. A capturing factory class whose subclass carries its own captures.
+function fPair(left: string) {
+  const helper = (s: string) => "<" + s + ">";
+  return class P {
+    static show() { return helper(left) + "@" + this.name; }
+  };
+}
+function fChild(right: number) {
+  const P = fPair("L" + right);
+  return class Q extends P {
+    static own() { return right * 2; }
+  };
+}
+const Q1: any = fChild(1);
+const Q2: any = fChild(2);
+say("Q1.show()", () => Q1.show());
+say("Q2.show()", () => Q2.show());
+say("Q2.own()", () => Q2.own());
+class Q3 extends Q2 {}
+say("Q3.show()", () => (Q3 as any).show());