fix(runtime): resolve instanceof against a ClassExprFresh parent per evaluation

changelog.d/10640-instanceof-classexprfresh-shared-id.md

@@ -0,0 +1,18 @@
+### Fixed
+
+- `instanceof` against a `ClassExprFresh` parent (a heritage-carrying class
+  expression — captures, statics, private elements, or a self-binding)
+  resolved the dynamic parent by the SHARED template `class_id` rather than
+  per evaluation. An instance built from an EARLIER evaluation of a
+  repeatedly-evaluated factory, constructed after a LATER evaluation of the
+  same factory had run, constructed with the correct parent (a prior fix,
+  #9364/#6438, already gives each evaluation its own pinned heritage for
+  `super()`/capture resolution) but could fail `instanceof` against its own
+  true parent — the later evaluation's parent shadowed it in the shared,
+  last-write-wins `CLASS_REGISTRY` that `instanceof`'s class-chain walk read.
+  Fixed by pinning the constructing class object onto each new instance too
+  (`class_registry/evaluation_heritage.rs`) and giving `instanceof`'s chain
+  walk a value-aware path (`instanceof.rs`'s `class_chain_reaches_dynamic`)
+  that prefers a pinned VALUE at each hop over the shared class_id table,
+  gated behind a monotone latch so the common (never-evaluated-twice) case
+  is unaffected. Runtime-only; no codegen changes. (#10624)

crates/perry-runtime/src/object/class_constructors.rs

@@ -1183,6 +1183,19 @@ pub(crate) unsafe fn replay_class_object_constructor(
     let scope = crate::gc::RuntimeHandleScope::new();
     let classobj_handle = scope.root_nanbox_f64(classobj_value);
     let inst_handle = scope.root_raw_mut_ptr(inst);
+    // #10624: remember which specific evaluation of this template built
+    // `inst`, so a later `instanceof` check against it can walk THAT
+    // evaluation's own pinned heritage instead of the shared, possibly
+    // since-overwritten class_id registry (`object/instanceof.rs`'s
+    // `class_chain_reaches_dynamic`). Runs before anything below can
+    // allocate/collect and return early, so `inst` is pinned regardless of
+    // which path this replay takes.
+    inst_handle.with_mut_ptr::<ObjectHeader, _>(|inst| {
+        super::class_registry::pin_instance_constructing_class(
+            inst,
+            classobj_handle.get_nanbox_f64(),
+        );
+    });
     // Spec: a derived class with no own `constructor` gets the implicit
     // `constructor(...args) { super(...args) }` — the nearest ancestor's ctor
     // must run with the same argument list. `lookup_class_constructor` holds

crates/perry-runtime/src/object/class_registry.rs

@@ -53,7 +53,8 @@ pub mod decl_prototype_table;
 mod dispatch;
 pub(crate) mod evaluation_heritage;
 pub(crate) use evaluation_heritage::{
-    active_class_evaluation_parent, is_self_heritage_value, push_active_class_evaluation,
+    active_class_evaluation_parent, instance_pinned_constructing_class, is_self_heritage_value,
+    pin_instance_constructing_class, push_active_class_evaluation,
 };
 mod function_prototype;
 mod gc_roots;
@@ -217,8 +218,8 @@ pub(crate) use parent_static::{
     class_own_symbol_method, class_private_instance_getter_value,
     class_private_instance_setter_apply, class_static_accessor_getter_value,
     class_static_accessor_setter_apply, class_symbol_getter_value, class_symbol_setter_apply,
-    get_parent_class_id, lookup_class_symbol_method_in_chain, lookup_static_method_in_chain,
-    register_class, register_class_dynamic_static_accessor,
+    dynamic_value_class_id, get_parent_class_id, lookup_class_symbol_method_in_chain,
+    lookup_static_method_in_chain, register_class, register_class_dynamic_static_accessor,
 };
 pub use parent_static::{
     is_class_object_ptr, is_class_object_value, is_registered_class_prototype_object,

crates/perry-runtime/src/object/class_registry/evaluation_heritage.rs

@@ -152,6 +152,78 @@ pub(crate) fn is_self_heritage_value(class_id: u32, parent_bits: u64) -> bool {
     parent_bits & 0xFFFF_0000_0000_0000 == INT32_TAG && parent_bits as u32 == class_id
 }
 
+/// #10624: monotone "has any class object ever pinned its own heritage"
+/// flag. `js_class_object_pin_parent` arms it before its own write, so
+/// anything it can EVER make true (an instance pinned to its constructing
+/// class object, or a class_id that has more than one live per-evaluation
+/// parent) is only reachable once this is armed. `instanceof`'s value-aware
+/// chain walk (`object/instanceof.rs`'s `class_chain_reaches_dynamic`) is
+/// gated on it: the overwhelming majority of programs never evaluate a
+/// heritage-carrying class expression more than once, and this keeps that
+/// case exactly as cheap as it was before this fix (one relaxed-cost atomic
+/// load) instead of paying a table lookup at every hop of every
+/// `instanceof` check. See `registry_latch.rs`.
+pub(crate) static CLASS_OBJECT_HERITAGE_PIN_LATCH: crate::registry_latch::RegistryLatch =
+    crate::registry_latch::RegistryLatch::new();
+
+/// Own-property key under which a genuine INSTANCE (constructed via
+/// `new <perEvaluationClassObject>()`) remembers which SPECIFIC evaluation
+/// built it (#10624).
+///
+/// `js_class_object_pin_parent`'s pin lives on the CLASS OBJECT and answers
+/// "what is MY parent" — `super()`, the prototype chain, and capture
+/// resolution above all already consult it. Nothing, though, gave the
+/// resulting INSTANCE a way back to that same evaluation: an instance
+/// carries only its class's shared TEMPLATE `class_id`
+/// (`ObjectHeader.class_id`), identical for every evaluation of the same
+/// factory. `instanceof`'s class-chain walk therefore fell back to
+/// `CLASS_REGISTRY`/`get_parent_class_id` — the same last-write-wins table
+/// `super()` used to read before #9364 — so an instance built from an
+/// EARLIER evaluation, checked after a LATER evaluation of the same
+/// template has run, could construct correctly (via the class-object pin
+/// above) yet fail `instanceof` against its own true parent (the later
+/// evaluation's parent shadows it in that shared table).
+///
+/// Pinning the constructing class object onto the instance too closes that
+/// gap: `object/instanceof.rs`'s `class_chain_reaches_dynamic` walks from
+/// THIS value, following the exact same per-evaluation pin chain
+/// `pinned_class_object_for_ancestor` already walks for capture resolution,
+/// instead of the shared class_id table.
+pub(crate) const INSTANCE_CONSTRUCTING_CLASS_KEY: &str = "__perry_ctor_class_object";
+
+/// Pin the per-evaluation class OBJECT that is about to construct `inst`
+/// onto `inst` itself (#10624). A no-op when `classobj_value` is not itself
+/// a per-evaluation class object, or carries no heritage of its own to
+/// disambiguate — an ordinary class DECLARATION (or a heritage-less class
+/// expression) has none of the ambiguity this exists to resolve, and the
+/// plain class_id registry is already exact for those.
+pub(crate) fn pin_instance_constructing_class(inst: *mut ObjectHeader, classobj_value: f64) {
+    if inst.is_null() || !is_class_object_value(classobj_value) {
+        return;
+    }
+    let class_ptr = crate::value::js_nanbox_get_pointer(classobj_value) as *const ObjectHeader;
+    if class_ptr.is_null() || class_object_pinned_parent(class_ptr).is_none() {
+        return;
+    }
+    // `js_class_object_pin_parent` already armed `CLASS_OBJECT_HERITAGE_PIN_LATCH`
+    // before writing `class_ptr`'s own pin above (the ordering rule in
+    // `registry_latch.rs`) — that write happens-before this one in this
+    // thread's program order, so the latch is already armed here.
+    let key_bytes = INSTANCE_CONSTRUCTING_CLASS_KEY.as_bytes();
+    let key = crate::string::js_string_from_bytes(key_bytes.as_ptr(), key_bytes.len() as u32);
+    crate::object::js_object_set_field_by_name(inst, key, classobj_value);
+}
+
+/// Read back the pin [`pin_instance_constructing_class`] wrote, or `None`
+/// when `obj` was never pinned — including the common case where the latch
+/// alone already answers "no" without scanning `obj`'s own fields at all.
+pub(crate) fn instance_pinned_constructing_class(obj: *const ObjectHeader) -> Option<f64> {
+    if CLASS_OBJECT_HERITAGE_PIN_LATCH.is_idle() {
+        return None;
+    }
+    class_object_own_field_bytes(obj, INSTANCE_CONSTRUCTING_CLASS_KEY.as_bytes())
+}
+
 #[cfg(test)]
 #[path = "evaluation_heritage/tests.rs"]
 mod tests;

crates/perry-runtime/src/object/class_registry/evaluation_heritage/tests.rs

@@ -176,3 +176,63 @@ fn an_active_replay_does_not_answer_for_another_class_id() {
         );
     }
 }
+
+#[test]
+fn sibling_class_objects_of_the_same_template_keep_distinct_pins() {
+    let _lock = crate::gc::global_side_table_test_lock();
+    const TEMPLATE: u32 = 0x0936_40C0;
+    const FIRST_PARENT: u32 = 0x0936_40C1;
+    const LAST_PARENT: u32 = 0x0936_40C2;
+    register(TEMPLATE);
+    register(FIRST_PARENT);
+    register(LAST_PARENT);
+
+    let scope = crate::gc::RuntimeHandleScope::new();
+
+    // First evaluation: pins FIRST_PARENT onto its own class object.
+    let first_handle = scope.root_raw_mut_ptr(crate::object::js_object_alloc(TEMPLATE, 0));
+    first_handle.with_mut_ptr::<crate::ObjectHeader, _>(|class| {
+        crate::object::class_registry::js_object_mark_class(class as i64)
+    });
+    js_register_class_parent_dynamic(TEMPLATE, class_ref(FIRST_PARENT));
+    first_handle.with_mut_ptr::<crate::ObjectHeader, _>(|class| {
+        super::super::parent_static::js_class_object_pin_parent(class as i64, TEMPLATE)
+    });
+    let first_pin = first_handle.with_mut_ptr::<crate::ObjectHeader, _>(|class| {
+        super::super::parent_static::class_object_pinned_parent(class as *const crate::ObjectHeader)
+    });
+    assert_eq!(
+        first_pin.map(|v| v.to_bits()),
+        Some(class_ref(FIRST_PARENT).to_bits()),
+        "first evaluation's own pin must be readable immediately after being written",
+    );
+
+    // Second evaluation of the SAME template: pins LAST_PARENT onto a
+    // DIFFERENT class object, overwriting the shared CLASS_DYNAMIC_PARENT_VALUE
+    // stash for TEMPLATE.
+    let last_handle = scope.root_raw_mut_ptr(crate::object::js_object_alloc(TEMPLATE, 0));
+    last_handle.with_mut_ptr::<crate::ObjectHeader, _>(|class| {
+        crate::object::class_registry::js_object_mark_class(class as i64)
+    });
+    js_register_class_parent_dynamic(TEMPLATE, class_ref(LAST_PARENT));
+    last_handle.with_mut_ptr::<crate::ObjectHeader, _>(|class| {
+        super::super::parent_static::js_class_object_pin_parent(class as i64, TEMPLATE)
+    });
+
+    // The EARLIER evaluation's own pin must be UNCHANGED by the later one.
+    let first_pin_again = first_handle.with_mut_ptr::<crate::ObjectHeader, _>(|class| {
+        super::super::parent_static::class_object_pinned_parent(class as *const crate::ObjectHeader)
+    });
+    assert_eq!(
+        first_pin_again.map(|v| v.to_bits()),
+        Some(class_ref(FIRST_PARENT).to_bits()),
+        "an earlier evaluation's pin must survive a LATER sibling evaluation's pin write",
+    );
+    let last_pin = last_handle.with_mut_ptr::<crate::ObjectHeader, _>(|class| {
+        super::super::parent_static::class_object_pinned_parent(class as *const crate::ObjectHeader)
+    });
+    assert_eq!(
+        last_pin.map(|v| v.to_bits()),
+        Some(class_ref(LAST_PARENT).to_bits()),
+    );
+}

crates/perry-runtime/src/object/class_registry/parent_static.rs

@@ -66,6 +66,57 @@ pub extern "C" fn js_register_class_parent(class_id: u32, parent_class_id: u32)
     }
 }
 
+/// Resolve a class_id from an arbitrary NaN-boxed runtime VALUE: an INT32
+/// `ClassRef` (the payload IS the class_id, verified registered) or a
+/// POINTER-tagged object (its `ObjectHeader.class_id`, falling back to the
+/// synthetic class id a plain closure's reassigned `.prototype` was given).
+/// `0` for anything else (primitives, an unregistered closure, `undefined`,
+/// `null`) — "no answer", never a wrong one.
+///
+/// Shared by `js_register_class_parent_dynamic` (deriving the class_id to
+/// register a NEW parent edge) and `object/instanceof.rs`'s
+/// `class_chain_reaches_dynamic` (#10624, walking an EXISTING
+/// per-evaluation pin chain) — both need the identical "what class_id does
+/// this value denote" answer.
+pub(crate) fn dynamic_value_class_id(value: f64) -> u32 {
+    let bits = value.to_bits();
+    const INT32_TAG: u64 = 0x7FFE_0000_0000_0000;
+    const POINTER_TAG: u64 = 0x7FFD_0000_0000_0000;
+    let tag = bits & 0xFFFF_0000_0000_0000;
+    if tag == INT32_TAG {
+        // ClassRef: lower 32 bits are the class id. Verify it's
+        // actually a registered class id before trusting it.
+        let payload = bits as u32;
+        if payload == 0 {
+            0
+        } else {
+            let guard = REGISTERED_CLASS_IDS.read().unwrap();
+            match guard.as_ref() {
+                Some(set) if set.contains(&payload) => payload,
+                _ => 0,
+            }
+        }
+    } else if tag == POINTER_TAG {
+        // Object instance: read class_id from the ObjectHeader.
+        let ptr = crate::value::js_nanbox_get_pointer(value) as *const ObjectHeader;
+        let from_obj = js_object_get_class_id(ptr);
+        if from_obj != 0 {
+            from_obj
+        } else {
+            // Issue #711 part 2: the value might be a closure whose
+            // `.prototype` was assigned to an object via the
+            // `function Base() {}; Base.prototype = X` pattern. Look
+            // up the synthetic class id assigned at
+            // `js_set_function_prototype` time. Returns 0 if the
+            // closure has no registered prototype object — falls
+            // through to the parentless baseline.
+            function_class_id(value)
+        }
+    } else {
+        0
+    }
+}
+
 /// Issue #711: dynamic parent-class registration for
 /// `class X extends fn(...)` shapes where the parent class_id is only
 /// known at runtime. Called from codegen-emitted module-init code at
@@ -239,41 +290,9 @@ pub extern "C" fn js_register_class_parent_dynamic(class_id: u32, mut parent_val
 
     let bits = parent_value.to_bits();
     let tag = bits & 0xFFFF_0000_0000_0000;
-    const INT32_TAG: u64 = 0x7FFE_0000_0000_0000;
     const POINTER_TAG: u64 = 0x7FFD_0000_0000_0000;
 
-    let parent_cid: u32 = if tag == INT32_TAG {
-        // ClassRef: lower 32 bits are the class id. Verify it's
-        // actually a registered class id before trusting it.
-        let payload = bits as u32;
-        if payload == 0 {
-            0
-        } else {
-            let guard = REGISTERED_CLASS_IDS.read().unwrap();
-            match guard.as_ref() {
-                Some(set) if set.contains(&payload) => payload,
-                _ => 0,
-            }
-        }
-    } else if tag == POINTER_TAG {
-        // Object instance: read class_id from the ObjectHeader.
-        let ptr = crate::value::js_nanbox_get_pointer(parent_value) as *const ObjectHeader;
-        let from_obj = js_object_get_class_id(ptr);
-        if from_obj != 0 {
-            from_obj
-        } else {
-            // Issue #711 part 2: the value might be a closure whose
-            // `.prototype` was assigned to an object via the
-            // `function Base() {}; Base.prototype = X` pattern. Look
-            // up the synthetic class id assigned at
-            // `js_set_function_prototype` time. Returns 0 if the
-            // closure has no registered prototype object — falls
-            // through to the parentless baseline.
-            function_class_id(parent_value)
-        }
-    } else {
-        0
-    };
+    let parent_cid: u32 = dynamic_value_class_id(parent_value);
 
     if parent_cid != 0 && parent_cid != class_id {
         register_class(class_id, parent_cid);
@@ -355,6 +374,12 @@ pub extern "C" fn js_class_object_pin_parent(obj: i64, template_class_id: u32) {
     if parent.to_bits() == TAG_UNDEFINED {
         return;
     }
+    // #10624: arm BEFORE the write it advertises (the ordering rule in
+    // `registry_latch.rs`) — everything the latch gates (this own-property
+    // write, and `pin_instance_constructing_class`'s later instance pin,
+    // which never fires without this one already having happened) follows
+    // in this thread's program order.
+    super::evaluation_heritage::CLASS_OBJECT_HERITAGE_PIN_LATCH.arm();
     let key_bytes = CLASS_OBJECT_PARENT_KEY.as_bytes();
     let key = crate::string::js_string_from_bytes(key_bytes.as_ptr(), key_bytes.len() as u32);
     crate::object::js_object_set_field_by_name(

crates/perry-runtime/src/object/field_get_set/enumeration.rs

@@ -1651,6 +1651,8 @@ pub(crate) fn is_internal_runtime_key_bytes(b: &[u8]) -> bool {
     b == crate::object::map_set_subclass::BACKING_KEY
         || b == crate::weakref::WEAK_ENTRIES_KEY
         || b == crate::object::parent_static::CLASS_OBJECT_PARENT_KEY.as_bytes()
+        || b == crate::object::class_registry::evaluation_heritage::INSTANCE_CONSTRUCTING_CLASS_KEY
+            .as_bytes()
         || b == b"__perry_ctor_caps"
         || is_class_capture_key(b)
         || b.starts_with(crate::node_stream::NATIVE_BASE_SUPER_PREFIX)