fix(runtime): build functions from every Function constructor call shape

changelog.d/10547-function-constructor-paths.md

@@ -0,0 +1,53 @@
+Every way of reaching the `Function` constructor now builds the function the
+same way `new Function(...)` does, and an auto-optimized binary keeps the
+runtime interpreter whenever the program can reach the constructor.
+
+- #10422: `Function(p, body)`, `Function.apply(null, [...])` and
+  `Function.call(null, ...)` with a body built at runtime compiled to a
+  function that always threw "new Function() cannot run in an ahead-of-time
+  compiled binary". `check_eval_function_call` built that stub for the call
+  form while the `new` form already fell through to the #6559 interpreter.
+  An unfolded call now lowers to the same `js_function_ctor_from_strings`
+  construct (the direct call), or calls the `Function` value (`.apply`,
+  `.call`, spread arguments). This is the generate-function 2.3.1 `toFunction`
+  shape that every mysql2 3.23.2 row parser uses.
+- #10423: the global `Function` value carried the shared no-op thunk, so
+  `const F = Function; F(p, body)`, lodash's `var Function = context.Function`,
+  `Function.bind(...)` and `module.exports = Function` all returned
+  `undefined`. It now has a rest-argument call thunk that runs the
+  constructor. `fn.constructor(p, body)` returned the dispatcher's empty-object
+  stub because a function receiver never resolved its inherited
+  `constructor`; it now calls the value the `fn.constructor` read returns.
+- #10424: `js_function_ctor_from_strings` read each argument as a string and
+  turned anything else into `""`, so `new Function(['a', 'b'], body)` (lodash
+  `_.template`'s import names) lost its parameters. Arguments now go through
+  ToString, left to right (rooted first, since `toString` is user code), and a
+  Symbol throws TypeError. `new Function(...parts)` passed the spread array as
+  one argument; it now lowers to `NewDynamicSpread` on the `Function` value.
+  The interpreter also binds a rest parameter (`new Function('...xs', body)`),
+  which it used to refuse.
+- #10421: the auto-optimize build linked `dyn-eval` only for recorded
+  runtime-unknown sites. A known-codegen-library site (find-my-way, ajv,
+  fast-json-stringify), an unfoldable constant call, and every value route to
+  the constructor compiled against a runtime without the interpreter and threw
+  at the first call, while `PERRY_NO_AUTO_OPTIMIZE=1` builds worked. Lowering
+  now notes each runtime construction it emits, and a per-module AST pre-scan
+  (`pre_scan/function_ctor_reach.rs`) notes value uses: the `Function`
+  identifier outside `Function.prototype` / `typeof` / `instanceof` /
+  equality, a property named `Function`, `globalThis[key]` with a computed key,
+  and `.constructor` of a function or any `x.constructor(...)` call.
+
+Reflective construction of the intrinsic now routes to the from-strings entry
+before `js_new_function_construct` allocates an instance, since its argument
+buffer is not a GC root.
+
+The integration test `function_apply_dynamic_args_eval_surface` asserted the
+always-throwing stub; it now asserts the mysql2 shape builds a working
+function.
+
+Validation: gap tests `test_gap_10421_function_ctor_as_value`,
+`test_gap_10422_function_call_runtime_body` and
+`test_gap_10424_function_ctor_to_string_args` fail on v0.5.1589 and match Node
+26.5.1 in both no-auto and auto-optimize builds. Each #10421 shape compiled
+alone under auto-optimize prints Node's result; programs that never reach the
+constructor keep the interpreter out (hello-world size +4 KB).

crates/perry-hir/src/eval_classifier.rs

@@ -53,6 +53,7 @@
 //! mirroring `#503`'s `PERRY_ALLOW_DYNAMIC_STDLIB`.
 
 use std::cell::RefCell;
+use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Mutex;
 
 use swc_ecma_ast as ast;
@@ -622,9 +623,27 @@ fn record_deferred_site(classification: &EvalClassification) {
     );
 }
 
+/// #10421: the program can construct a function from runtime strings through a
+/// path no recorded site stands for — a known-codegen-library site, a
+/// `Function(...)` whose constant fold failed, or the constructor reached as a
+/// value (`const F = Function`, `ctx.Function`, `fn.constructor(...)`). Only
+/// ever set to `true` during a compile; process-global for the same reason as
+/// [`EVAL_DEFERRED_SITES`], and cleared with it by the notice drain.
+static DYNAMIC_FUNCTION_REACHABLE: AtomicBool = AtomicBool::new(false);
+
+/// Record that the program being compiled can reach the runtime `Function`
+/// constructor, so the auto-optimized runtime keeps the `dyn-eval`
+/// interpreter. Over-reporting costs binary size only; a miss compiles a
+/// program that throws at runtime while a `PERRY_NO_AUTO_OPTIMIZE=1` build of
+/// it works.
+pub fn note_dynamic_function_reachable() {
+    DYNAMIC_FUNCTION_REACHABLE.store(true, Ordering::Relaxed);
+}
+
 /// Drain and return every deferred bucket-3 site recorded so far this
 /// compile. Called by the driver to render the end-of-compile notice.
 pub fn take_deferred_eval_sites() -> Vec<DeferredEvalSite> {
+    DYNAMIC_FUNCTION_REACHABLE.store(false, Ordering::Relaxed);
     EVAL_DEFERRED_SITES
         .lock()
         .map(|mut v| std::mem::take(&mut *v))
@@ -637,15 +656,17 @@ pub fn take_deferred_eval_sites() -> Vec<DeferredEvalSite> {
 /// BEFORE the notice drain, to decide whether `libperry_runtime.a` must carry
 /// the `dyn-eval` interpreter feature. Dynamic-`import(...)` and
 /// unimplemented-API deferrals don't count — they never reach the Function
-/// constructor.
+/// constructor. #10421: neither does a recorded site alone — see
+/// [`note_dynamic_function_reachable`].
 pub fn has_deferred_dynamic_code_sites() -> bool {
-    EVAL_DEFERRED_SITES
-        .lock()
-        .map(|v| {
-            v.iter()
-                .any(|s| s.kind.contains("eval") || s.kind.contains("Function"))
-        })
-        .unwrap_or(false)
+    DYNAMIC_FUNCTION_REACHABLE.load(Ordering::Relaxed)
+        || EVAL_DEFERRED_SITES
+            .lock()
+            .map(|v| {
+                v.iter()
+                    .any(|s| s.kind.contains("eval") || s.kind.contains("Function"))
+            })
+            .unwrap_or(false)
 }
 
 /// What the lowering site should do with a classified call (#5206).
@@ -953,6 +974,14 @@ mod tests {
         assert_eq!(mine[0].kind, "eval(...)");
     }
 
+    /// #10421: a Function constructor reached without a recorded site still
+    /// selects the `dyn-eval` runtime.
+    #[test]
+    fn noted_dynamic_function_reach_needs_the_interpreter() {
+        note_dynamic_function_reachable();
+        assert!(has_deferred_dynamic_code_sites());
+    }
+
     /// Strict-eval mode: a runtime-unknown site is a hard compile-time error.
     #[test]
     fn strict_mode_refuses_runtime_unknown() {

crates/perry-hir/src/lib.rs

@@ -51,9 +51,10 @@ pub use egress::{audit_module_egress, EgressRefusalReason, EgressViolation};
 pub use enums::fix_imported_enums;
 pub use eval_classifier::{
     check_unimplemented_api, classify as classify_eval_surface, has_deferred_dynamic_code_sites,
-    location_string, record_deferred_aot_site, set_eval_strict_mode, set_unimplemented_strict_mode,
-    take_deferred_eval_sites, DeferredEvalSite, EvalBucket, EvalClassification, EvalDecision,
-    EvalSurface, UnimplementedDecision, UNIMPLEMENTED_API_KIND,
+    location_string, note_dynamic_function_reachable, record_deferred_aot_site,
+    set_eval_strict_mode, set_unimplemented_strict_mode, take_deferred_eval_sites,
+    DeferredEvalSite, EvalBucket, EvalClassification, EvalDecision, EvalSurface,
+    UnimplementedDecision, UNIMPLEMENTED_API_KIND,
 };
 pub use ir::*;
 pub use js_transform::{

crates/perry-hir/src/lower/expr_call/intrinsics/eval_strict.rs

@@ -4,7 +4,7 @@ use crate::types::Type;
 use anyhow::Result;
 use swc_ecma_ast as ast;
 
-use super::super::super::LoweringContext;
+use super::super::super::{lower_expr, LoweringContext};
 
 /// #1678 (Phase 0 of #1677) — classify a bare `Function(...)` /
 /// `eval(...)` call. The `Function('return this')()` globalThis fold runs
@@ -18,6 +18,8 @@ use super::super::super::LoweringContext;
 /// (defer) mode a runtime-unknown site returns `Ok(Some(throw_value))`
 /// (#5206): the caller uses that expression in place of the call so it
 /// throws a descriptive `Error` only if reached. `Ok(None)` means proceed.
+/// #10422: that throw-on-reach value is `eval`'s only; every unfolded
+/// `Function(...)` spelling builds its function at runtime instead.
 pub(crate) fn check_eval_function_call(
     ctx: &mut LoweringContext,
     call: &ast::CallExpr,
@@ -108,7 +110,39 @@ pub(crate) fn check_eval_function_call(
         }
         .map(|a| a.expr.as_ref())
     };
-    match crate::eval_classifier::check_site(surface, body_arg, &ctx.source_file_path, call.span)? {
+    let decision =
+        crate::eval_classifier::check_site(surface, body_arg, &ctx.source_file_path, call.span)?;
+    if surface == crate::eval_classifier::EvalSurface::FunctionCall {
+        // #10422: the constant fold did not compile this call, so the function
+        // is built at runtime — by the same interpreter `new Function(...)`
+        // reaches (#6559), whichever bucket the body landed in. The call form
+        // used to compile a runtime-unknown body to a stub that always threw,
+        // and let every other unfolded call (an array parameter list, a
+        // known-library body) fall through to `undefined`. Strict-eval mode
+        // has already refused inside `check_site`.
+        crate::eval_classifier::note_dynamic_function_reachable();
+        // `Function(p, body)` is spec-identical to `new Function(p, body)`:
+        // take the direct from-strings entry. A spread argument list and the
+        // `.call` / `.apply` spellings keep the generic lowering, which invokes
+        // the `Function` value (`global_this_function_call_thunk`) with its
+        // spec argument handling (`apply` of an array-like or `undefined`).
+        if matches!(callee, ast::Expr::Ident(_)) && call.args.iter().all(|a| a.spread.is_none()) {
+            let args = call
+                .args
+                .iter()
+                .map(|a| lower_expr(ctx, &a.expr))
+                .collect::<Result<Vec<_>>>()?;
+            return Ok(Some(Expr::New {
+                class_name: "Function".to_string(),
+                args,
+                type_args: Vec::new(),
+                byte_offset: call.span.lo.0,
+                cap_args_appended: 0,
+            }));
+        }
+        return Ok(None);
+    }
+    match decision {
         crate::eval_classifier::EvalDecision::Proceed => Ok(None),
         crate::eval_classifier::EvalDecision::DeferToRuntimeError(message) => Ok(Some(
             super::super::super::const_fold_fn::synth_deferred_eval_value(

crates/perry-hir/src/lower/expr_new.rs

@@ -813,6 +813,29 @@ pub(super) fn lower_new(ctx: &mut LoweringContext, new_expr: &ast::NewExpr) -> R
                         // still catchable, still located, never a crash.
                         crate::eval_classifier::EvalDecision::DeferToRuntimeError(_message) => {}
                     }
+                    // #10421: whichever bucket the body landed in (a
+                    // known-library body, or constant strings the fold could
+                    // not use), the function is built at runtime, so the
+                    // auto-optimized runtime must keep the interpreter.
+                    crate::eval_classifier::note_dynamic_function_reachable();
+                    // #10424: a spread argument list (`new Function(...parts)`)
+                    // must reach the constructor element by element. The
+                    // by-name `Expr::New` below lowers each argument as one
+                    // value, so the whole array became a single non-string
+                    // argument and the function got an empty body.
+                    if args_slice.iter().any(|a| a.spread.is_some()) {
+                        let callee = Expr::PropertyGet {
+                            byte_offset: 0,
+                            object: Box::new(Expr::GlobalGet(0)),
+                            property: "Function".to_string(),
+                        };
+                        let args = lower_new_spread_args(ctx, args_slice)?;
+                        return Ok(Expr::NewDynamicSpread {
+                            callee: Box::new(callee),
+                            args,
+                            byte_offset: new_byte_offset,
+                        });
+                    }
                 }
             }
 

crates/perry-hir/src/lower/lower_module_fn.rs

@@ -948,6 +948,10 @@ pub fn lower_module_full_with_platform_globals(
     // literals, and counter vars (see `fn_ctor_env`).
     ctx.fn_ctor_env = super::fn_ctor_env::build_fn_ctor_env(ast_module);
 
+    // #10421: a `Function` constructor reached as a value (an alias,
+    // `ctx.Function`, `fn.constructor(...)`) needs the interpreter too.
+    pre_scan_function_ctor_reach(ast_module);
+
     // #8882: every class DECLARATION name at any depth, for `lower_new`'s
     // unresolved-constructor guard (see `pre_scan/class_decl_names.rs`).
     pre_scan_class_decl_names(ast_module, &mut ctx);

crates/perry-hir/src/lower/pre_scan.rs

@@ -11,9 +11,11 @@ use super::*;
 use crate::ir::*;
 
 mod class_decl_names;
+mod function_ctor_reach;
 mod weakref_locals;
 
 pub(crate) use class_decl_names::pre_scan_class_decl_names;
+pub(crate) use function_ctor_reach::pre_scan_function_ctor_reach;
 pub(crate) use weakref_locals::pre_scan_weakref_locals;
 
 /// Pre-scan top-level function declarations for the standard TypeScript