fix(runtime): the three gap tests keeping main red

changelog.d/10387-groupby-json-raw-f64-layout.md

@@ -0,0 +1,28 @@
+### Fixed
+
+- `JSON.stringify` of an array built by a runtime helper that writes its element
+  slots directly no longer emits `null` for every non-number element.
+  `JSON.stringify([...Map.groupBy("aba", ch => ch).entries()])` answered
+  `[["a",[null,null]],["b",[null]]]` instead of `[["a",["a","a"]],["b",["b"]]]`,
+  while `arr[0]` and `String(arr)` on the same array stayed correct — so only a
+  JSON round-trip could see it.
+
+  `js_array_alloc` stamps `GC_ARRAY_RAW_F64_LAYOUT` ("every live slot is an
+  unboxed double") on the fresh, empty array, where it is vacuously true. A
+  producer such as `groupby.rs`'s `group_by_make_array` then sets `length` and
+  `std::ptr::write`s the element words itself, bypassing every noting store
+  helper that would have cleared the flag. That mislabelling was harmless until
+  `json::stringify_primitive_array` started taking the flag as proof and
+  emitting each slot through `write_number`: a NaN-boxed string read as a double
+  is non-finite, and JSON renders non-finite as `null`.
+  `test_gap_2899_2779_2777_static_helpers` went red on `main` in the window that
+  introduced that reader.
+
+  `object::gc_slots::rebuild_array_layout_from_slots` — the choke point every
+  such producer already calls to repair the GC pointer bitmap — now re-derives
+  the numeric-layout flag from the same slots it just walked. The reclassify is
+  clear-only, so an array that really is all-numbers keeps its fast path, and no
+  receiver that used to decline now passes. `test_gap_2899_2779_2777_static_helpers`
+  gained JSON coverage for string, boolean, object, mixed and numeric group
+  values, plus the non-JSON readback beside it so a future failure says which
+  half broke.

changelog.d/10387-iterator-prototype-next-spread-arms.md

@@ -0,0 +1,52 @@
+### Fixed
+
+- A replaced `%ArrayIteratorPrototype%.next` (and its Map / Set / String
+  siblings) now drives spread, `Array.from` and call-spread, not just `for…of`
+  and a manual `.next()`. `[...[4, 5]]` under a patch that doubles each value
+  printed `4,5`; `[...new Set([1, 2])]` printed `1,2`; `[..."ab"]` printed
+  `a,b`; `f(...[13, 14])` passed the raw elements.
+
+  Each of these ends in a runtime element-COPY arm — `dense_spread_source`'s
+  memcpy (#7533), `js_set_to_array` / `js_map_entries`,
+  `js_string_to_char_array`, `js_array_like_to_array`'s array fast path — that
+  materializes the result without ever calling `.next()`, so the per-call
+  "is `next` still the builtin?" proof in `object/iterator_prototypes.rs` cannot
+  be reached from inside them. This is the same hole #10086 closed for the
+  `for…of` index loop and the array-destructuring fast arm, and it is closed the
+  same way: the family prototype object can only be patched after it has escaped
+  to user code through `Object.getPrototypeOf` / `Reflect.getPrototypeOf`, so
+  that escape is the choke point. `note_iterator_prototype_exposed` (was
+  `note_array_iterator_prototype_exposed`) now recognises the Map, Set and String
+  family prototypes and `%IteratorPrototype%` itself as well as the array one,
+  and the copy arms decline on their family's signal and run the real protocol.
+
+  The array arms move from the narrow `array_proto_iterator_modified` (the
+  `Symbol.iterator` slot was written) to the broader
+  `array_iteration_not_pristine`. The narrow fact implies the broad one, so
+  every receiver that declined before still declines. Nothing changes for a
+  program that never introspects a built-in iterator: all four signals stay
+  false until `Object.getPrototypeOf` hands the prototype out.
+
+  `test_gap_iterator_prototype_next_patch` has been red on `main` since it
+  landed on 2026-09-06 (gap-suite shard log for `87dc334920` — the first run that
+  contained it — already reported `pass -> parity_fail`), so this is a
+  first-time fix of a fixture that over-specified the implementation, not a
+  regression repair. The fixture and its
+  `crates/perry/tests/issue_9846_iterator_prototype_next_patch.rs` companion
+  gained `Array.from(array)`, call-spread, multi-operand spread,
+  `Array.from(set)`, `Array.from(map)`, `[...map]` and `Array.from(string)`
+  cases under the same patches.
+
+The fixture also could not pass for a reason that was not Perry's: it called
+`console.log` while a built-in iterator prototype was patched. Node builds
+`SafeMap` out of `internal/per_context/primordials` lazily, and the parity
+harness runs the oracle under `FORCE_COLOR=0`, which is the path that defers
+that construction into the patched window — so the ORACLE died with
+
+    node:internal/per_context/primordials:449
+      class SafeMap extends Map {},
+
+leaving `Node exit: 1, Perry exit: 0` however the runtime behaved. Output is now
+buffered inside each patched window and flushed after the prototype is restored;
+every value is still computed inside the window, which is the subject, and the
+emitted text is byte-identical to the unbuffered run.

changelog.d/10387-suppressed-error-heritage.md

@@ -0,0 +1,26 @@
+### Fixed
+
+- `new SuppressedError(...) instanceof Error` is `true` again, and
+  `Object.getPrototypeOf(SuppressedError.prototype) === Error.prototype` /
+  `Object.getPrototypeOf(SuppressedError) === Error` now hold as ECMA-262
+  requires.
+
+  `SuppressedError` was missing from `is_native_error_subclass_constructor`, so
+  the `globalThis` population loop never linked its prototype pair into the
+  Error family — `SuppressedError.prototype`'s `[[Prototype]]` stayed
+  `Object.prototype`. That was latent while `instanceof Error` answered from the
+  class registry (`extends_builtin_error(CLASS_ID_SUPPRESSED_ERROR)`, which
+  `js_suppressed_error_new` registers). It stopped being latent when
+  `js_instanceof` began consulting the instance's RECORDED prototype chain FIRST
+  for `class_id == CLASS_ID_ERROR`: the walk reached a chain with no
+  `Error.prototype` in it, returned `Some(false)`, and short-circuited the
+  registry fact that used to carry the answer. `test_gap_disposablestack_2875`
+  went red on `main` between `87dc334920` and `f207cf6618` — the window
+  containing that change — and stayed red.
+
+  The fix is the missing link itself, not a special case in `instanceof`: the
+  recorded chain is now correct, so the walk answers `true` on its own and
+  `Error.prototype.toString` is inherited (`String(err)` is
+  `"SuppressedError: both failed"`). `test_gap_disposablestack_2875` gained
+  direct assertions for both prototype links, for the `TypeError` control, and
+  for the inherited `toString`.

crates/perry-runtime/src/array/flat_clone.rs

@@ -50,9 +50,16 @@ unsafe fn receiver_gc_type(ptr: *const ArrayHeader) -> u8 {
 ///    `Array.prototype` / `Object.prototype` index properties shadowing the
 ///    dense slots, and no live indices past the dense backing store — the three
 ///    cases where `arr[i]` is not the raw slot.
-///  - `array_proto_iterator_modified`: user code replaced or deleted
-///    `Array.prototype[Symbol.iterator]`, so the builtin walk is no longer what
-///    a spread must run.
+///  - `array_iteration_not_pristine`: array iteration can no longer be PROVEN
+///    to be the pristine builtin protocol — either user code replaced or
+///    deleted `Array.prototype[Symbol.iterator]`, or `%ArrayIteratorPrototype%`
+///    itself escaped through `Object.getPrototypeOf` and its `next` may have
+///    been replaced (#10086's escape signal; #9846). Both mean the builtin walk
+///    is no longer what a spread must run. This gate used to read only the
+///    narrower `array_proto_iterator_modified`, so `[...[4, 5]]` under a patched
+///    `%ArrayIteratorPrototype%.next` memcpy'd the raw elements and never called
+///    the patch. The narrow fact implies the broad one, so nothing that used to
+///    decline now passes.
 ///  - `object_static_prototype`: `Object.setPrototypeOf(array, custom)` can
 ///    replace the inherited iterator without touching Array.prototype.
 ///  - `has_own_symbol_property`: the instance carries its OWN `[Symbol.iterator]`,
@@ -85,7 +92,7 @@ pub(crate) fn dense_spread_source(value: f64) -> Option<*const ArrayHeader> {
     if crate::array::array_iteration_is_exotic(arr) {
         return None;
     }
-    if crate::array::array_proto_iterator_modified() {
+    if crate::array::array_iteration_not_pristine() {
         return None;
     }
     if crate::object::prototype_chain::object_static_prototype(arr as usize).is_some() {

crates/perry-runtime/src/array/from_concat.rs

@@ -74,6 +74,32 @@ fn throw_map_fn_not_callable(map_fn: f64) -> ! {
 ///
 /// Takes the raw NaN-boxed f64 value (NOT a pre-unboxed pointer) so it can
 /// inspect the tag bits before stripping.
+/// #9846: is `value` a String / Set / Map whose iterator prototype has escaped
+/// to user code, so its `Array.from` element copy is no longer unobservable?
+/// See the call site in [`js_array_from_value`].
+fn array_from_family_not_pristine(value: f64) -> bool {
+    // Sticky-flag loads FIRST. The classification below costs two registry
+    // lookups, and `Array.from` is hot: in the overwhelmingly common program no
+    // iterator prototype has ever escaped, so this must cost three relaxed
+    // loads and nothing else.
+    let string_dirty = crate::object::iterator_prototypes::string_iteration_not_pristine();
+    let set_dirty = crate::object::iterator_prototypes::set_iteration_not_pristine();
+    let map_dirty = crate::object::iterator_prototypes::map_iteration_not_pristine();
+    if !(string_dirty || set_dirty || map_dirty) {
+        return false;
+    }
+    let jsv = crate::value::JSValue::from_bits(value.to_bits());
+    if jsv.is_any_string() {
+        return string_dirty;
+    }
+    let raw = crate::value::js_nanbox_get_pointer(value) as usize;
+    if raw == 0 {
+        return false;
+    }
+    (set_dirty && crate::set::is_registered_set(raw))
+        || (map_dirty && crate::map::is_registered_map(raw))
+}
+
 #[no_mangle]
 pub extern "C" fn js_array_from_value(boxed: f64) -> *mut ArrayHeader {
     let bits = boxed.to_bits();
@@ -91,16 +117,31 @@ pub extern "C" fn js_array_from_value(boxed: f64) -> *mut ArrayHeader {
     // `js_array_clone` then behaves exactly as it does for a literal.
     // #7542: `Array.from(arr)` is `GetIterator(arr)` + drain, so a patched
     // `Array.prototype[Symbol.iterator]` drives it exactly as it drives spread.
+    // #9846 widened the condition from the `Symbol.iterator` write alone to the
+    // whole "array iteration is no longer provably pristine" fact, so a patched
+    // `%ArrayIteratorPrototype%.next` drives `Array.from(arr)` too.
     // This function's array arm ends in a raw `js_array_clone` — a shallow
     // element copy that never consults the protocol — so the guard has to be
     // here rather than downstream. `array_from_spread_value` already routes the
     // patched case through `js_get_iterator`; reuse it so the two entry points
     // cannot answer differently for the same receiver.
-    if crate::array::array_proto_iterator_modified()
+    if crate::array::array_iteration_not_pristine()
         && crate::array::js_array_is_array(boxed).to_bits() == crate::value::TAG_TRUE
     {
         return crate::array::js_array_clone_for_spread(boxed);
     }
+    // #9846: the Map / Set / String families have the same hole. Their arms end
+    // in `js_array_clone`'s element copies (the Set backing, the Map entry
+    // pairs, the string's codepoint cut), none of which calls `.next()`, so a
+    // patched `%SetIteratorPrototype%.next` was invisible to `Array.from(set)`
+    // exactly as it was to `[...set]`. `array_from_spread_value` is the one
+    // implementation that declines those copies on the escape signal; delegate
+    // to it rather than restate the decision here. Every receiver this admits
+    // is iterable, so the delegation cannot turn an accepted `Array.from` into
+    // the "not iterable" throw.
+    if array_from_family_not_pristine(boxed) {
+        return crate::array::js_array_clone_for_spread(boxed);
+    }
 
     let jsval = crate::value::JSValue::from_bits(bits);
     if jsval.is_short_string() {

crates/perry-runtime/src/array/header.rs

@@ -1297,6 +1297,33 @@ pub(crate) unsafe fn clear_array_numeric_layout(arr: *const ArrayHeader) {
     clear_array_raw_f64_layout_flag(arr);
 }
 
+/// Re-derive the raw-f64 numeric layout flag from the slots that are actually
+/// there, CLEARING it when any live slot is not a number. Never sets it.
+///
+/// `js_array_alloc` stamps `GC_ARRAY_RAW_F64_LAYOUT` on the fresh (length 0)
+/// array, where it is vacuously true. A producer that fills the array through
+/// the noting store helpers keeps the flag honest; one that sets `length` and
+/// `std::ptr::write`s the element words directly — the documented "internal
+/// scratch array" shape called out on [`mark_array_raw_f64_holes_fresh`] —
+/// bypasses every clear and leaves a NaN-boxed pointer sitting in a slot the
+/// flag promises is a plain double.
+///
+/// That used to be merely latent. `json::stringify_primitive_array` (#9849)
+/// now takes the flag as proof and emits every slot through `write_number`, so
+/// a mislabelled array serializes its strings as `null`
+/// (`JSON.stringify([...Map.groupBy("aba", ch => ch).entries()])`). This is the
+/// repair for the choke point those producers already call,
+/// `object::gc_slots::rebuild_array_layout_from_slots`.
+#[inline]
+pub(crate) unsafe fn reclassify_array_numeric_layout_from_slots(arr: *mut ArrayHeader) {
+    if arr.is_null() || !array_has_raw_f64_layout_flag(arr) {
+        return;
+    }
+    if !array_slots_are_numeric(arr) {
+        clear_array_numeric_layout(arr);
+    }
+}
+
 #[inline]
 pub(crate) fn clear_array_numeric_layout_ptr(user_ptr: usize) {
     if user_ptr == 0 {

crates/perry-runtime/src/array/indexing_support.rs

@@ -162,7 +162,7 @@ pub(super) static ARRAY_PROTO_ITERATOR_MODIFIED: AtomicBool = AtomicBool::new(fa
 ///     HIR lowering, which never consults the iteration protocol, so such a
 ///     patch was ignored there even after the spread paths were fixed (#7542).
 ///   * The array-iterator PROTOTYPE object was handed to user code (#10086; see
-///     `object::iterator_prototypes::note_array_iterator_prototype_exposed`).
+///     `object::iterator_prototypes::note_iterator_prototype_exposed`).
 ///     A replaced `%ArrayIteratorPrototype%.next` is detected per `.next()` call
 ///     (`prototype_next_is_canonical`), which a fast arm that never calls
 ///     `.next()` cannot observe — and the only way to reach that object in order
@@ -172,10 +172,15 @@ pub(super) static ARRAY_PROTO_ITERATOR_MODIFIED: AtomicBool = AtomicBool::new(fa
 ///     introspect array iterators, while under-approximating would silently
 ///     return unpatched elements.
 ///
-/// Both consumers — the `for…of` index loop and #10086's array-destructuring
-/// arm — branch on it ONCE, which is also what the spec wants: iteration
-/// performs GetIterator exactly once, so a patch landing mid-loop must not
-/// change the iterator already in hand.
+/// The two GENERATED consumers — the `for…of` index loop and #10086's
+/// array-destructuring arm — branch on it ONCE, which is also what the spec
+/// wants: iteration performs GetIterator exactly once, so a patch landing
+/// mid-loop must not change the iterator already in hand.
+///
+/// #9846 added a third, RUNTIME-side consumer through
+/// [`array_iteration_not_pristine`]: `dense_spread_source`'s element copy and
+/// `array_from_spread_value`'s `Array.prototype[Symbol.iterator]` delegation,
+/// which are the spread / `Array.from` equivalents of the same hole.
 ///
 /// A separate `u8` global rather than exposing the `AtomicBool`: codegen emits
 /// a plain volatile `i8` load, the same shape as
@@ -184,9 +189,12 @@ pub(super) static ARRAY_PROTO_ITERATOR_MODIFIED: AtomicBool = AtomicBool::new(fa
 /// itself is emitted byte-identically to before.
 ///
 /// NOTE the asymmetry with [`ARRAY_PROTO_ITERATOR_MODIFIED`]: that bool keeps
-/// its exact original meaning (the `Symbol.iterator` slot was written) and still
-/// gates the Rust-side spread / `js_get_iterator` delegation. Only this byte
-/// carries the broader "not provably pristine" fact.
+/// its exact original meaning (the `Symbol.iterator` slot was written). This
+/// byte carries the broader "not provably pristine" fact, and since #9846 it
+/// is what the Rust-side spread / `js_get_iterator` delegation gates on too —
+/// the narrow bool implies it (`note_array_proto_iterator_write` sets both),
+/// so widening those call sites strictly grows the set of receivers that take
+/// the real protocol.
 #[no_mangle]
 pub static PERRY_ARRAY_ITERATION_NOT_PRISTINE: AtomicU8 = AtomicU8::new(0);
 
@@ -198,6 +206,13 @@ pub(crate) fn note_array_iteration_not_pristine() {
     PERRY_ARRAY_ITERATION_NOT_PRISTINE.store(1, Ordering::Release);
 }
 
+/// Rust-side reader for [`PERRY_ARRAY_ITERATION_NOT_PRISTINE`]. Acquire-ordered
+/// to pair with `note_array_iteration_not_pristine`'s release.
+#[inline]
+pub(crate) fn array_iteration_not_pristine() -> bool {
+    PERRY_ARRAY_ITERATION_NOT_PRISTINE.load(Ordering::Acquire) != 0
+}
+
 /// Record (if `obj` is `Array.prototype` and `sym_key` is the well-known
 /// `Symbol.iterator`) that the array iteration protocol has been tampered
 /// with. Called from the symbol-property set/delete paths.

crates/perry-runtime/src/array/iterator.rs

@@ -966,6 +966,14 @@ pub(crate) fn array_from_spread_value(value: f64) -> *mut ArrayHeader {
         throw_not_iterable(value());
     }
     if jsv.is_any_string() {
+        // #9846: `[..."ab"]` is `GetIterator(str)` + drain per spec, and
+        // `js_string_to_char_array` is an element cut that never calls
+        // `%StringIteratorPrototype%.next`. That is unobservable — until the
+        // prototype object escapes to user code, after which the cut would
+        // silently ignore a patched `next`. Decline then, and run the protocol.
+        if crate::object::iterator_prototypes::string_iteration_not_pristine() {
+            return js_iterator_to_array(crate::symbol::js_get_iterator(value()));
+        }
         let str_ptr = crate::value::js_get_string_pointer_unified(value());
         let str_bits = crate::value::STRING_TAG | (str_ptr as u64 & POINTER_MASK);
         return crate::string::js_string_to_char_array(str_bits as i64) as *mut ArrayHeader;
@@ -1038,7 +1046,7 @@ pub(crate) fn array_from_spread_value(value: f64) -> *mut ArrayHeader {
     // not preempt the walk below for that case: `js_get_iterator`'s patched
     // branch reads the PROTOTYPE only, and would throw "not iterable" for an
     // array carrying its own method once the prototype slot has been deleted.
-    if crate::array::array_proto_iterator_modified()
+    if crate::array::array_iteration_not_pristine()
         && crate::array::js_array_is_array(value()).to_bits() == crate::value::TAG_TRUE
         && !array_has_own_iterator(value())
     {
@@ -1051,10 +1059,21 @@ pub(crate) fn array_from_spread_value(value: f64) -> *mut ArrayHeader {
     if crate::buffer::is_registered_buffer(raw_ptr()) {
         return crate::buffer::buffer_to_array(raw_ptr() as *const crate::buffer::BufferHeader);
     }
+    // #9846: the Set / Map arms below copy the backing store instead of
+    // driving `%SetIteratorPrototype%.next` / `%MapIteratorPrototype%.next`.
+    // Same trade as the array dense arm and the string cut above: free while
+    // the family prototype has never escaped to user code, wrong the moment it
+    // has, so decline on the escape signal and run the real protocol.
     if crate::set::is_registered_set(raw_ptr()) {
+        if crate::object::iterator_prototypes::set_iteration_not_pristine() {
+            return js_iterator_to_array(crate::symbol::js_get_iterator(value()));
+        }
         return crate::set::js_set_to_array(raw_ptr() as *const crate::set::SetHeader);
     }
     if crate::map::is_registered_map(raw_ptr()) {
+        if crate::object::iterator_prototypes::map_iteration_not_pristine() {
+            return js_iterator_to_array(crate::symbol::js_get_iterator(value()));
+        }
         return crate::map::js_map_entries(raw_ptr() as *const crate::map::MapHeader);
     }
     // `class X extends Map | Set` instance — spread (`[...container]`,