fix(runtime): <index> in <Uint8Array> / Buffer resolves numeric indices (#6148)

[proggeramlug]

Fixes #6148 (the index case).

Summary

0 in new Uint8Array([1,2,3]) returned false (as did "length" in u8),
while every other typed-array kind worked:

0 in new Uint8Array([1,2,3])   // was false → true
0 in new Int16Array([1,2,3])   // already true
0 in new Float64Array([1,2,3]) // already true

Uint8Array / Buffer are backed by a header-less registered buffer (not
TYPED_ARRAY_REGISTRY), so the in operator's typed-array arm — which gates on
lookup_typed_array_kind — never saw them. It was Uint8Array/Buffer-specific,
independent of size.

Fix

Add a buffer branch to js_object_has_property, mirroring the property-get path
(get_field_by_name_tail.rs): detect via is_registered_buffer, then

• a numeric index is present iff it's in [0, js_buffer_length)
• the own view slots (length / byteLength / byteOffset /
  BYTES_PER_ELEMENT / buffer) are present

Scope / follow-up

Inherited prototype members via in on a buffer ("subarray" in u8,
"toString" in u8) are left as a follow-up: it's the same string-key gap the
registered typed-array arm already has, tied to lazy %TypedArray%.prototype
population (order-dependent), so it deserves its own fix covering both.

Validation

Byte-for-byte vs node --experimental-strip-types: index in for Uint8Array
(small + large), Buffer.from, Float64Array, Int16Array; negative and
out-of-bounds indices; the five view slots; plus an in regression sweep (plain
object, array, registered typed array, Object.create, primitive-throw).

Summary by CodeRabbit

• Bug Fixes
  • Improved property-existence checks for buffer values so the in operator now returns the expected results for numeric indices and supported buffer-related properties.
  • Fixed cases where certain buffer-backed objects were not recognized correctly during property lookup, preventing incorrect false results.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a fast-path branch in js_object_has_property for registered Buffer receivers, handling the in operator by returning true for in-bounds numeric indices and specific buffer-related string properties (length, byteLength, byteOffset, BYTES_PER_ELEMENT, buffer), and false otherwise.

Changes

Buffer in-operator fast path

Layer / File(s)	Summary
Registered Buffer handling in in-operator crates/perry-runtime/src/object/field_get_set/has_property.rs	Adds a branch detecting registered Buffer objects and resolving key existence for numeric indices and specific buffer-related string properties, returning false otherwise.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• <index> in <typed array> and "length"/method in <typed array> report false #6148: Directly addresses the gap in js_object_has_property where in reports false for typed-array/buffer indices and properties like length.
• String-key in on typed arrays/Buffers misses prototype members (order-dependent) #6164: Both issues concern js_object_has_property's typed-array/Buffer in-operator handling.

Possibly related PRs

• PerryTS/perry#6024: Both PRs modify has_property.rs, with the earlier PR adding a js_in_operator wrapper that delegates to js_object_has_property, which this PR's Buffer branch extends.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The change fixes numeric indices and view-slot properties, but explicitly leaves inherited members like subarray/toString for later, so #6148 is only partially met.	Extend the property-existence logic to cover inherited prototype members, or split that behavior into a linked follow-up issue.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main runtime fix for in on typed arrays/Buffer numeric indices.
Out of Scope Changes check	✅ Passed	All changes stay within the typed-array/Buffer in-operator fix and add no unrelated scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/6148-typedarray-in

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/perry-runtime/src/object/field_get_set/has_property.rs`:
- Around line 325-342: The buffer-branch handling in has_property is only
checking the named view slots, so string-encoded indices like "0" are
incorrectly falling through to false; update this branch to also recognize
canonical array-index string keys the same way the typed-array path delegates to
typed_array_has_property. Use the existing key parsing in has_property (the
key_val.is_any_string() block) and add an index check before returning false so
in-bounds numeric strings on buffer-backed views are reported as present, while
still preserving the current named-slot behavior and the intended exclusion for
inherited prototype members.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b09541f1-d033-468d-bca1-a0672bb7de85

📥 Commits

Reviewing files that changed from the base of the PR and between d1d3ddf and b8787da.

📒 Files selected for processing (1)

• crates/perry-runtime/src/object/field_get_set/has_property.rs

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

String-encoded numeric indices ("0" in buf) incorrectly return false.

The buffer branch only matches string keys against the five named view slots and returns false for everything else. This means "0" in new Uint8Array([1,2,3]) returns false, when per spec it should return true — ToPropertyKey("0") resolves to an in-bounds index.

The typed-array branch above (lines 272–281) delegates all string keys to typed_array_has_property, which handles string-encoded indices. The buffer branch lacks equivalent handling. The comment at lines 326–330 claims this is "the same string-key gap the registered typed-array arm above has," but the typed-array arm handles string keys comprehensively — the string-encoded index gap is unique to this buffer branch.

This is not covered by the PR's stated scope limitation (which only excludes inherited prototype members like "subarray" in u8). String-encoded numeric indices are own properties, not inherited members.

🐛 Proposed fix: add `canonical_array_index` check for string-encoded indices

             if key_val.is_any_string() {
                 // Own view slots, always present. Inherited prototype MEMBERS
                 // (`subarray`, `map`, `toString`, …) via `in` on a buffer are a
                 // separate follow-up — the same string-key gap the registered
                 // typed-array arm above has, tied to lazy `%TypedArray%`
                 // prototype population.
                 let mut sso = [0u8; crate::value::SHORT_STRING_MAX_LEN];
                 if let Some(name) = unsafe { crate::string::js_string_key_bytes(key_val, &mut sso) }
                     .and_then(|b| std::str::from_utf8(b).ok())
                 {
                     if matches!(
                         name,
                         "length" | "byteLength" | "byteOffset" | "BYTES_PER_ELEMENT" | "buffer"
                     ) {
                         return nanbox_true;
                     }
+                    // String-encoded numeric indices (e.g. `"0" in buf`).
+                    if let Some(idx) = super::super::canonical_array_index(name) {
+                        if (idx as i32) < len {
+                            return nanbox_true;
+                        }
+                    }
                 }
                 return nanbox_false;
             }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	if key_val.is_any_string() {
	// Own view slots, always present. Inherited prototype MEMBERS
	// (`subarray`, `map`, `toString`, …) via `in` on a buffer are a
	// separate follow-up — the same string-key gap the registered
	// typed-array arm above has, tied to lazy `%TypedArray%`
	// prototype population.
	let mut sso = [0u8; crate::value::SHORT_STRING_MAX_LEN];
	if let Some(name) = unsafe { crate::string::js_string_key_bytes(key_val, &mut sso) }
	.and_then(|b| std::str::from_utf8(b).ok())
	{
	if matches!(
	name,
	"length" | "byteLength" | "byteOffset" | "BYTES_PER_ELEMENT" | "buffer"
	) {
	return nanbox_true;
	}
	}
	return nanbox_false;
	if key_val.is_any_string() {
	// Own view slots, always present. Inherited prototype MEMBERS
	// (`subarray`, `map`, `toString`, …) via `in` on a buffer are a
	// separate follow-up — the same string-key gap the registered
	// typed-array arm above has, tied to lazy `%TypedArray%`
	// prototype population.
	let mut sso = [0u8; crate::value::SHORT_STRING_MAX_LEN];
	if let Some(name) = unsafe { crate::string::js_string_key_bytes(key_val, &mut sso) }
	.and_then(|b| std::str::from_utf8(b).ok())
	{
	if matches!(
	name,
	"length" | "byteLength" | "byteOffset" | "BYTES_PER_ELEMENT" | "buffer"
	) {
	return nanbox_true;
	}
	// String-encoded numeric indices (e.g. `"0" in buf`).
	if let Some(idx) = super::super::canonical_array_index(name) {
	if (idx as i32) < len {
	return nanbox_true;
	}
	}
	}
	return nanbox_false;

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/perry-runtime/src/object/field_get_set/has_property.rs` around lines
325 - 342, The buffer-branch handling in has_property is only checking the named
view slots, so string-encoded indices like "0" are incorrectly falling through
to false; update this branch to also recognize canonical array-index string keys
the same way the typed-array path delegates to typed_array_has_property. Use the
existing key parsing in has_property (the key_val.is_any_string() block) and add
an index check before returning false so in-bounds numeric strings on
buffer-backed views are reported as present, while still preserving the current
named-slot behavior and the intended exclusion for inherited prototype members.