fix(codegen): #6039 over-filtered module_local_types — 17 test262 regressions from swallowed receiver-typed throws

[proggeramlug]

Summary

A consolidation test262 sweep found the recent mechanism-PR wave shipped 24 regressions (net was still +16, but 24 previously-passing cases now failed). Bisected the dominant clusters to a single culprit and forward-fixed it.

Culprit: 09f2f24895 (#6039) — "fix(codegen): #5982 — module-global captures must not feed the typed-ABI closure specialization".

Root cause

#6039 correctly stopped a closure that captures a module-global local (read via @perry_global_*, not the capture array) from feeding the typed-ABI closure specialization — which otherwise read an unset capture slot and returned 0 (for(let i…){const c=i; fns.push(()=>c)} → 0,0,0,0,0).

It did so by stripping every module-global id out of module_local_types. But that map is used for two distinct purposes in compile_module:

1. the typed-ABI closure-clone decision (typed_{f64,i1,i32,string}_closure_rejection_reason_with_types), and
2. the per-function-body receiver-type oracle — it is handed to emit_module_artifacts → FnCtx.local_types, which drives static_type_of / is_array_expr.

Removing a module-global's declared type from (2) mis-classified a captured array receiver as untyped inside a closure. arr.every() with an undefined callbackfn then lowered to the generic dynamic method dispatch (js_arraylike_*) instead of the array-typed path that emits js_validate_array_callback, so the mandatory TypeError was never thrown.

The test262 harness runs every negative case as assert.throws(TypeError, function () { … }) — a module-level closure that captures the module-global under test — so the swallowed throw surfaced as 24 conformance regressions:

• 8 Array HOF callbackfn-not-callable cases (every/filter/forEach/map/reduce/reduceRight/some 15.4.4.*-4-1)
• 3 symbol-strict [[Set]] cases (Object.defineProperty/freeze/seal *-strict: obj[sym]=2 on a non-writable prop must throw)
• 4 private-async-method, 1 Proxy set, 2 Temporal Instant limits — all reach the same harness-closure path.

Fix

Keep the module-globals filter scoped to the typed-ABI specialization only. Build a dedicated typed_abi_local_types (module-locals minus module-globals) and feed it to the four closure-clone decisions and the capture-rep probe; leave module_local_types (the receiver oracle passed to emit_module_artifacts) module-global-inclusive.

Decision and emission never disagree: the emission side (compile_typed_*_closure) is only reached for closures the decision accepted, and a closure capturing a module-global is always rejected by the decision (its capture type is absent from typed_abi_local_types, so typed_closure_capture_reps returns None). So #5982's win holds — for(let i…){const c=i; fns.push(()=>c)} still returns 0,1,2,3,4, not 0,0,0,0,0.

Verification (internal Linux sweep host)

• Bisected 8e303627e (GOOD, fix(runtime): in operator throws TypeError on a non-object right operand #6024 baseline: witness 10/10) → c5246ece6 (BAD: 0/10) to 09f2f24895 (fix(codegen): #5982 — module-global captures must not feed the typed-ABI closure specialization (#5466 regression) #6039). The originally-suspected [[Set]] PRs #6059/#6063 were cleared: the witness already fails at their common parent.
• Minimal repro: assert.throws-style closure capturing a module-global arr now throws again (CAUGHT); #5982 guard held (0,1,2,3,4).
• Witness slice restored to 10/10 (8 Array HOF + 3 symbol-strict; the 11th shares the Object cluster).
• Focused differential sweep (built-ins/Array + Object + TypedArrayConstructors + Reflect + Proxy, jobs=4) vs the GOOD baseline:
  • NEW regressions: 0
  • FIXED: 4 — including the TypedArrayConstructors/internals/Set/…/key-is-valid-index-reflect-set.js (+ BigInt variant) mechanism-PR wins from fix(runtime): typed-array integer-indexed [[Set]] spec rejection + coercion #6059/fix(runtime): OrdinarySet rejects a receiver-owned accessor instead of firing its setter #6063 preserved.
  • defineProperty/freeze/seal symbol-strict + Array-HOF + Proxy-set witness cases all PASS.

Scope note

7 of the 24 flagged cases (annexB createdynfn, Function/GeneratorFunction instance-length, S15.3*) are a separate, intentional trade-off from #6031 (new Function("") capability probe now honestly reports dynamic-codegen unavailable so zod 4 et al. take the interpreter fallback; opt-out PERRY_EVAL_CSP=0). Not attributable to the bisected culprit and out of scope here.

Files

• crates/perry-codegen/src/codegen/mod.rs — scope the module-globals filter to the typed-ABI specialization; keep the receiver oracle module-global-inclusive.

Summary by CodeRabbit

• Bug Fixes
  • Improved closure handling for values defined at module scope, so they can be captured and specialized more reliably.
  • Fixed cases where typed closures could be missed or treated inconsistently when they referenced module-level values.
  • Strengthened support for optimized closure behavior across several data types, with more consistent runtime results.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 92946a00-3b25-48ad-b1fd-9d9019402975

📥 Commits

Reviewing files that changed from the base of the PR and between 759f947 and 07ce0ea.

📒 Files selected for processing (1)

• crates/perry-codegen/src/codegen/mod.rs

---

📝 Walkthrough

Walkthrough

In compile_module, module_local_types is no longer mutated to strip module-global entries; a new filtered typed_abi_local_types map is introduced instead. Typed-ABI closure rejection and capture-representation checks for f64, i1, i32, and string closures now use this new map.

Changes

Typed-ABI Closure Specialization Scoping

Layer / File(s)	Summary
Introduce typed_abi_local_types and update typed closure checks crates/perry-codegen/src/codegen/mod.rs	Stops removing module-global entries from module_local_types in place; instead creates a filtered typed_abi_local_types map and switches typed f64/i1/i32/string closure rejection-reason and capture-representation checks to use it.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• PerryTS/perry#5949: Both PRs modify compile_module's handling of module_local_types-derived data feeding typed-ABI closure specialization logic.
• PerryTS/perry#6039: Both PRs adjust typed-ABI closure capture specialization in compile_module to prevent module-global values from being treated as unboxed capture slots.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the PR’s main fix: scoping the module_local_types filter to typed-ABI closure specialization.
Description check	✅ Passed	The description is detailed and largely complete, covering summary, root cause, fix, and verification, though it omits explicit related-issue and checklist sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/t262-regr-cleanup

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}