fix(codegen): read-PIC honors descriptors installed after priming (#6080)

[proggeramlug]

Summary

Fixes sub-bug (b) of #6080: the read inline-cache (Read-PIC) bypassed a property/accessor descriptor installed after the call site was primed.

The generic property-get IC hit predicate (expr/property_get/generic_dispatch.rs) validated the receiver's keys_array pointer, GC type, object_type, non-null keys and closure-magic — but never checked OBJ_FLAG_HAS_DESCRIPTORS. Since Object.defineProperty does not change keys_array, a site primed on a plain data property kept serving a raw slot load after that key became a getter (or was redefined), silently returning the stale value instead of invoking the accessor.

Fix

Add a descriptor-flag guard to the hit predicate, mirroring the existing one in class_field_inline_guard.rs: load the GcHeader _reserved i16 at offset -6 and force a PIC miss whenever OBJ_FLAG_HAS_DESCRIPTORS (0x800) is set. The read then routes through js_object_get_field_ic_miss → js_object_get_field_by_name, which honors descriptors. Cost is a single load+and+cmp folded into the existing hit cond_br; descriptor-free objects keep hitting the cache.

Verification

function f(o){ return o.x; }
const a = { x: 1 };
f(a);                                              // prime -> 1
Object.defineProperty(a, "x", { get(){ return 42; } });
f(a);                                              // before: 1 (stale)  after: 42 ✓

• Deterministic repro now matches Node (42, and data-redefine 99).
• Sanity: hot property-read loops still hit the cache (unchanged sums), getters-from-start and untouched sibling keys read correctly.
• Added test-files/test_gap_6080_defineproperty_after_prime.ts — byte-for-byte parity with node --experimental-strip-types.

Scope / follow-up

Leaves the separate ABA-staleness sub-bug (a) of #6080 as a follow-up: the cache slot stores a raw, unrooted keys_array address that can be recycled by a different shape after GC. That fix needs GC-root registration or hot-path content validation and is not deterministically reproducible; it's the higher-risk half and deserves its own PR.

Summary by CodeRabbit

• Bug Fixes
  • Fixed property reads after Object.defineProperty changes a property into a getter or redefined data property.
  • Ensured property accesses no longer return stale cached values after descriptor changes.
  • Preserved correct reads for unrelated properties on the same object.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 6d934ce4-3132-421e-9d1e-1c4db3a019dd

📥 Commits

Reviewing files that changed from the base of the PR and between 7ed3e5c and 1f7c8e2.

📒 Files selected for processing (2)

• crates/perry-codegen/src/expr/property_get/generic_dispatch.rs
• test-files/test_gap_6080_defineproperty_after_prime.ts

---

📝 Walkthrough

Walkthrough

The generic property GET PIC fast path now rejects receivers marked as having descriptors, routing them through descriptor-aware miss handling. A regression test primes property reads, applies Object.defineProperty, and verifies getter, redefined data-property, and unrelated-key behavior.

Changes

Descriptor-aware property reads

Layer / File(s)	Summary
PIC descriptor guard and regression coverage crates/perry-codegen/src/expr/property_get/generic_dispatch.rs, test-files/test_gap_6080_defineproperty_after_prime.ts	The PIC fast-hit predicate checks OBJ_FLAG_HAS_DESCRIPTORS; tests verify that post-priming descriptor changes return updated values while unrelated own keys remain readable.

Estimated code review effort: 3 (Moderate) | ~15–30 minutes

Possibly related issues

• Read-PIC keyed on raw keys-array address: ABA staleness + defineProperty-after-prime bypass #6080 — Directly covers the defineProperty-after-PIC-priming bypass addressed by this guard.

Possibly related PRs

• PerryTS/perry#5675 — Modifies the same generic property-GET dispatch logic at related fast-path decision points.
• PerryTS/perry#6057 — Adds a related OBJ_FLAG_HAS_DESCRIPTORS receiver check for disabling stale inline fast paths.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: read-PIC now honors descriptors installed after priming.
Description check	✅ Passed	The description covers the fix, verification, and scope, though some template sections are not filled verbatim.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/6080-pic-descriptor-guard

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}