fix(runtime): #5588 strict Set check on proxy-source symbol keys

Address CodeRabbit review: the proxy-source path wrote symbol keys via
`js_object_set_symbol_property` directly, skipping the strict-`Set`
rejection (read-only symbol data prop, setter-less accessor, or new
symbol on a non-extensible target) the ordinary source path applies. A
Proxy source's enumerable symbol key could thus bypass the required
TypeError on a frozen/read-only target.

Extract that block into `object_assign_throw_if_symbol_set_rejected` and
call it from both the proxy and ordinary symbol-write paths. Extend the
gap test with symbol-key copying, the frozen-target rejection, and an
explicit ownKeys→getOwnPropertyDescriptor→get trap-order assertion — all
byte-for-byte vs `node --experimental-strip-types`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Ralph

crates/perry-runtime/src/object/alloc.rs

@@ -938,6 +938,34 @@ fn throw_object_assign_readonly(name: &str) -> ! {
     )
 }
 
+/// Strict `Set(to, sym, value, true)` rejection check for a symbol-keyed
+/// `Object.assign` write: a non-writable existing symbol data property, an
+/// accessor symbol property with no setter, or a new symbol property on a
+/// non-extensible target each make the write fail, which under throwing `Set`
+/// semantics is a `TypeError`. The string-keyed counterpart is
+/// `object_assign_throw_if_set_rejected`.
+unsafe fn object_assign_throw_if_symbol_set_rejected(target: *mut ObjectHeader, sym_ptr: usize) {
+    let owner = target as usize;
+    let existing = crate::symbol::symbol_property_root_bits(owner, sym_ptr).is_some()
+        || crate::symbol::symbol_accessor_descriptor_bits(owner, sym_ptr).is_some();
+    if existing {
+        if let Some((_get, set)) = crate::symbol::symbol_accessor_descriptor_bits(owner, sym_ptr) {
+            if set == 0 {
+                throw_object_assign_readonly("Symbol()");
+            }
+        } else if let Some(attrs) = crate::symbol::get_symbol_property_attrs(owner, sym_ptr) {
+            if !attrs.writable() {
+                throw_object_assign_readonly("Symbol()");
+            }
+        }
+    } else {
+        let gc = gc_header_for(target);
+        if (*gc)._reserved & crate::gc::OBJ_FLAG_NO_EXTEND != 0 {
+            throw_object_assign_readonly("Symbol()");
+        }
+    }
+}
+
 unsafe fn object_assign_set_string_key(
     target: *mut ObjectHeader,
     target_is_array: bool,
@@ -1041,6 +1069,9 @@ unsafe fn object_assign_proxy_source(
                 object_assign_set_string_key(target, target_is_array, key_ptr, value_f64);
             }
         } else if key.is_pointer() {
+            // Strict `Set` semantics for symbol keys, same as the ordinary path.
+            let sym_ptr = (key.bits() & crate::value::POINTER_MASK) as usize;
+            object_assign_throw_if_symbol_set_rejected(target, sym_ptr);
             crate::symbol::js_object_set_symbol_property(target_f64, key_f64, value_f64);
         }
     }
@@ -1266,30 +1297,7 @@ pub unsafe extern "C" fn js_object_assign_one(target_f64: f64, source_f64: f64)
         // copy already uses `[[Get]]` via `js_object_get_field_by_name`.
         let value_f64 = crate::symbol::js_object_get_symbol_property(source_f64, sym_f64);
         // Strict `Set` semantics for symbol-keyed writes too.
-        {
-            let owner = tgt_raw;
-            let existing = crate::symbol::symbol_property_root_bits(owner, sym_ptr).is_some()
-                || crate::symbol::symbol_accessor_descriptor_bits(owner, sym_ptr).is_some();
-            if existing {
-                if let Some((_get, set)) =
-                    crate::symbol::symbol_accessor_descriptor_bits(owner, sym_ptr)
-                {
-                    if set == 0 {
-                        throw_object_assign_readonly("Symbol()");
-                    }
-                } else if let Some(attrs) = crate::symbol::get_symbol_property_attrs(owner, sym_ptr)
-                {
-                    if !attrs.writable() {
-                        throw_object_assign_readonly("Symbol()");
-                    }
-                }
-            } else {
-                let gc = gc_header_for(target);
-                if (*gc)._reserved & crate::gc::OBJ_FLAG_NO_EXTEND != 0 {
-                    throw_object_assign_readonly("Symbol()");
-                }
-            }
-        }
+        object_assign_throw_if_symbol_set_rejected(target, sym_ptr);
         crate::symbol::js_object_set_symbol_property(target_f64, sym_f64, value_f64);
     }
 

test-files/test_gap_5588_object_assign_proxy_source.ts

@@ -44,3 +44,28 @@ const doubler = new Proxy({ x: 2, y: 3 }, {
   get(t: any, k) { return typeof t[k] === "number" ? t[k] * 2 : t[k]; },
 });
 console.log(JSON.stringify(Object.assign({}, doubler)));          // {"x":4,"y":6}
+
+// ---- symbol keys are copied through the traps ----
+const sym = Symbol("s");
+const symSrc: any = { plain: 1 };
+symSrc[sym] = 42;
+const symOut: any = Object.assign({}, new Proxy(symSrc, {}));
+console.log("symbol copied: " + (symOut[sym] === 42 && symOut.plain === 1)); // true
+
+// ---- strict Set: a symbol key onto a non-extensible target throws ----
+const frozenTarget = Object.preventExtensions({});
+const symProxy = new Proxy(symSrc, {});
+console.log(thrown(() => Object.assign(frozenTarget, symProxy)));   // TypeError
+
+// ---- trap order: ownKeys -> getOwnPropertyDescriptor -> get, per key ----
+const order: string[] = [];
+const ordered = new Proxy({ k: 7 }, {
+  ownKeys(t) { order.push("ownKeys"); return Reflect.ownKeys(t); },
+  getOwnPropertyDescriptor(t, k) {
+    order.push("gopd:" + String(k));
+    return Reflect.getOwnPropertyDescriptor(t, k);
+  },
+  get(t: any, k) { order.push("get:" + String(k)); return t[k]; },
+});
+Object.assign({}, ordered);
+console.log("trap order: " + order.join(","));   // ownKeys,gopd:k,get:k