fix(hir): capture class member enclosing vars by reference, not snapshot

changelog.d/10615-class-member-var-captures.md

@@ -0,0 +1,5 @@
+Fix class members nested in a function or CommonJS module body capturing enclosing `var`/`let` bindings by value snapshot instead of by reference: a method saw the value the binding had at class-declaration time, and writes from constructors/static methods to a captured `var` were silently lost. This blocked `@redis/client` (TypeScript's `var _a; class X {…} _a = X;` static-self-reference emit) and `sql.js`/emscripten (the `FS.nextInode` counter that never advanced, corrupting every `FSNode.id`).
+
+Root cause: `desugar_shared_mutable_captures` decides whether a captured local is safe to promote to a shared reference cell by counting how many times its `LocalId` is declared and requiring exactly one — but a `var` is declared twice in HIR (a body-entry predefine slot, then the declaration statement), so every `var` capture failed that check and fell back to the stale value-snapshot path. The counter is replaced with a `DeclCensus`/`CensusWalker` that walks a region in execution order and accepts an id as one binding when either it has a single declaration, or all its declarations sit in the same closure scope under the same name with the first dominating (the shape of a `var`) — declarations in different closure scopes stay ambiguous, preserving the earlier #6089 fix. A `var` redeclaration that runs after the class has already captured the id, or inside a loop, is demoted into a write to the shared cell instead of being treated as a fresh binding.
+
+Added `test-files/test_gap_10485_class_member_var_captures.ts` (byte-for-byte against Node 26.5.1) covering every member kind, constructor/static/setter writes, `var` redeclaration, the emscripten hoisted-factory shape, and same-named `var`+class pairs in sibling functions, plus 4 new HIR-level unit tests in `crates/perry-hir/src/lower/tests/class_member_var_captures.rs`. Proven to fail on a pristine pre-fix tree and pass on this change.

crates/perry-hir/src/destructuring/var_decl.rs

@@ -257,6 +257,19 @@ pub(crate) fn lower_var_decl_with_destructuring(
             // Alias / prototype / static-method tracking for the freshly-
             // bound identifier (extracted to `alias_tracking`).
             track_decl_aliases(ctx, decl, &name, id, &init);
+            // #10489: remember WHICH class this binding holds, so a `new <name>()`
+            // resolves to it even when another binding claimed the same name.
+            if let Some(key) = init.as_ref().and_then(class_expr_value_key) {
+                if decl
+                    .init
+                    .as_deref()
+                    .is_some_and(crate::lower::expr_assign::rhs_accepts_assignment_name)
+                    && ctx.inferred_class_bindings.contains(&name)
+                {
+                    ctx.inferred_class_bindings
+                        .record_binding(id, key.to_string());
+                }
+            }
             // `with (o) { var foo = v; }` — the binding `foo` is hoisted to
             // the enclosing var scope, but the *initialisation* is a normal
             // PutValue under the with environment: when `o` has a `foo`
@@ -528,3 +541,22 @@ pub(crate) fn lower_var_decl_with_destructuring(
 
     Ok(result)
 }
+
+/// The registration key of the class a lowered class-expression initializer
+/// yields: a bare `ClassRef`/`ClassExprFresh`, or the tail of the sequence
+/// `lower_class_expr` wraps it in (parent registration, computed names, the
+/// #6654 capture-owner `LocalSet(owner, fresh), LocalGet(owner)` pair).
+fn class_expr_value_key(expr: &Expr) -> Option<&str> {
+    match expr {
+        Expr::ClassRef(key) => Some(key),
+        Expr::ClassExprFresh { template, .. } => Some(template),
+        Expr::Sequence(items) => match items.as_slice() {
+            [.., Expr::LocalSet(owner, value), Expr::LocalGet(read)] if owner == read => {
+                class_expr_value_key(value)
+            }
+            [.., last] => class_expr_value_key(last),
+            [] => None,
+        },
+        _ => None,
+    }
+}

crates/perry-hir/src/lower/context.rs

@@ -127,7 +127,7 @@ impl LoweringContext {
             class_display_names: HashMap::new(),
             gen_param_prologue_len: HashMap::new(),
             assignment_inferred_name: None,
-            inferred_class_bindings: std::collections::HashSet::new(),
+            inferred_class_bindings: Default::default(),
             closure_source_text: HashMap::new(),
             class_source_text: HashMap::new(),
             func_return_native_instances: Vec::new(),

crates/perry-hir/src/lower/expr_assign.rs

@@ -829,9 +829,10 @@ fn lower_assignment_target(
                                     && ctx.lookup_func(&cls_name).is_none()
                                 {
                                     None
-                                } else if ctx.lookup_local(&cls_name).is_some()
-                                    && !ctx.inferred_class_bindings.contains(cls_name.as_str())
-                                {
+                                } else if ctx.lookup_local(&cls_name).is_some_and(|local| {
+                                    ctx.inferred_class_bindings.class_key_for(local, &cls_name)
+                                        != Some(cls_name.as_str())
+                                }) {
                                     // A lexical local shadows any same-named
                                     // module-scope class for this write too
                                     // (wall 7's disease, 4th surface): the

crates/perry-hir/src/lower/expr_member.rs

@@ -1064,8 +1064,11 @@ fn lower_member_inner(ctx: &mut LoweringContext, member: &ast::MemberExpr) -> Re
         // so reading through the shared template's `StaticFieldGet` loses both
         // its value and its property-presence semantics. This mirrors the
         // static-call guard in `expr_call/static_and_instance.rs`.
-        let local_shadows_class = ctx.lookup_local(source_name).is_some()
-            && !ctx.inferred_class_bindings.contains(source_name);
+        let local_shadows_class = ctx.lookup_local(source_name).is_some_and(|local| {
+            ctx.inferred_class_bindings
+                .class_key_for(local, source_name)
+                != Some(source_name)
+        });
         let obj_name = ctx.resolve_class_name(source_name);
         if !local_shadows_class && ctx.lookup_class(&obj_name).is_some() {
             if let ast::MemberProp::Ident(prop_ident) = &member.prop {

crates/perry-hir/src/lower/expr_new.rs

@@ -1543,15 +1543,21 @@ pub(super) fn lower_new(ctx: &mut LoweringContext, new_expr: &ast::NewExpr) -> R
                 // attach), which the generic dynamic construct does not.
                 // A shadowing local over an UNRELATED same-named class
                 // declaration has no alias entry, so wall 7's reroute keeps
-                // firing.
-                let local_is_class_alias =
-                    ctx.inferred_class_bindings.contains(class_name.as_str());
-                if !local_is_class_alias {
-                    return Ok(Expr::NewDynamic {
-                        callee: Box::new(Expr::LocalGet(local_id)),
-                        args,
-                        byte_offset: new_byte_offset,
-                    });
+                // firing. When two class expressions claimed this name, the
+                // binding's OWN class is used (#10489), never the first
+                // claimant's.
+                match ctx
+                    .inferred_class_bindings
+                    .class_key_for(local_id, &class_name)
+                {
+                    Some(key) => class_name = key.to_string(),
+                    None => {
+                        return Ok(Expr::NewDynamic {
+                            callee: Box::new(Expr::LocalGet(local_id)),
+                            args,
+                            byte_offset: new_byte_offset,
+                        });
+                    }
                 }
             }
             // Issue #838 followup (b): when `<Ident>` is NOT a real

crates/perry-hir/src/lower/lower_expr/arm_class.rs

@@ -92,6 +92,7 @@ pub(crate) fn lower_class_expr(
                     // for this same expression. Record the BINDING name so
                     // `new <name>()` keeps the static construct path.
                     ctx.inferred_class_bindings.insert(name.clone());
+                    ctx.inferred_class_bindings.mark_contested(&name);
                     display_override = Some(name.clone());
                     format!("{}__anon_dup_{}", name, ctx.fresh_class())
                 }

crates/perry-hir/src/lower/lowering_context.rs

@@ -12,6 +12,61 @@ use std::collections::{HashMap, HashSet};
 use crate::ir::*;
 use crate::ClassAccessorNames;
 
+/// Binding names whose class registration was created by the binding's own
+/// class-expression initializer (see `LoweringContext::inferred_class_bindings`).
+///
+/// The name set alone cannot tell two same-named bindings apart. When a second
+/// class expression infers an already-claimed name (the #5592 `__anon_dup_`
+/// arm: `function a() { const K = class {…} }` next to `function b() { const
+/// K = class {…} }`), `new K()` inside `b` resolved `K` to `a`'s class and
+/// appended `a`'s capture ids, so `b`'s constructor ran against another
+/// function's locals (#10489). Such CONTESTED names resolve per binding local:
+/// a declaration records which class its local holds, and an unrecorded local
+/// constructs its runtime value.
+#[derive(Debug, Default)]
+pub(crate) struct InferredClassBindings {
+    names: HashSet<String>,
+    contested: HashSet<String>,
+    by_local: HashMap<LocalId, String>,
+}
+
+impl InferredClassBindings {
+    pub(crate) fn contains(&self, name: &str) -> bool {
+        self.names.contains(name)
+    }
+
+    pub(crate) fn insert(&mut self, name: String) -> bool {
+        self.names.insert(name)
+    }
+
+    pub(crate) fn remove(&mut self, name: &str) -> bool {
+        self.names.remove(name)
+    }
+
+    /// A second class expression claimed `name` under a disambiguated key.
+    pub(crate) fn mark_contested(&mut self, name: &str) {
+        self.contested.insert(name.to_string());
+    }
+
+    /// The declaration of binding `local` evaluated the class registered as
+    /// `class_key`.
+    pub(crate) fn record_binding(&mut self, local: LocalId, class_key: String) {
+        self.by_local.insert(local, class_key);
+    }
+
+    /// The registration key of the class the in-scope local `local` (a binding
+    /// named `name`) provably holds, or `None` when it must be treated as an
+    /// arbitrary runtime value.
+    pub(crate) fn class_key_for(&self, local: LocalId, name: &str) -> Option<&str> {
+        if let Some(key) = self.by_local.get(&local) {
+            return Some(key.as_str());
+        }
+        (self.names.contains(name) && !self.contested.contains(name))
+            .then(|| self.names.get(name).map(String::as_str))
+            .flatten()
+    }
+}
+
 #[derive(Debug, Clone, Copy)]
 pub(crate) struct WithEnvFrame {
     pub(crate) local_id: LocalId,
@@ -361,8 +416,10 @@ pub struct LoweringContext {
     /// bind name too). At a `new <name>()` site, such a name's local provably
     /// holds that same class, so the static construct path (with its exact
     /// builtin-parent handling) is correct; any OTHER in-scope local shadows
-    /// whatever same-named class exists and must construct dynamically.
-    pub(crate) inferred_class_bindings: std::collections::HashSet<String>,
+    /// whatever same-named class exists and must construct dynamically. Names
+    /// claimed by more than one class expression resolve by binding identity
+    /// instead (see [`InferredClassBindings::class_key_for`]).
+    pub(crate) inferred_class_bindings: InferredClassBindings,
     /// #4101: original source text keyed by FuncId, captured by slicing the
     /// module source against each function's AST span at lowering time.
     /// Flushed into `Module.closure_source_text` alongside `pending_functions`.