Fix URL component reflection with prototype accessors

changelog.d/10997-url-prototype-accessors.md

@@ -0,0 +1,13 @@
+Fixed URL component reflection (#10823).
+
+URL instances now keep their twelve component values in internal numbered slots
+and inherit enumerable, configurable accessors from `URL.prototype`. This makes
+`Object.keys(url)` and `Object.getOwnPropertyNames(url)` empty while preserving
+component reads, setters, and `Object.getPrototypeOf(url) === URL.prototype`.
+The first ordinary or `Object.defineProperty` expando reserves the internal
+slots before appending a user key, so it cannot overwrite `href` or the
+`searchParams` owner link. The `host` accessor now also updates hostname and
+an optional valid port.
+
+Verified with a compiled TypeScript regression covering descriptors, borrowed
+getters, setters, both expando paths, and URLSearchParams behavior on Linux.

crates/perry-runtime/src/object/field_set_by_name/tail.rs

@@ -410,6 +410,11 @@ pub(crate) fn set_field_by_name_object_tail(
             let obj = obj_handle.get_raw_mut_ptr::<ObjectHeader>();
             let value = value_handle.get_nanbox_f64();
             match key_str.as_str() {
+                "origin" | "searchParams" => return,
+                "host" => {
+                    crate::url::js_url_set_host(obj, value);
+                    return;
+                }
                 "pathname" => {
                     crate::url::js_url_set_pathname(obj, value);
                     return;
@@ -488,7 +493,7 @@ pub(crate) fn set_field_by_name_object_tail(
         // transition-cache fast path, whose `prev_shape_id` is read AFTER
         // this — then appends at the floor. Seeding allocates, so every raw
         // local is re-read through its handle.
-        if keys.is_null() && crate::object::reserved_slot_floor_for_class_id((*obj).class_id) != 0 {
+        if keys.is_null() && crate::object::reserved_slot_floor_for_object(obj) != 0 {
             let seeded = crate::object::ensure_reserved_floor_keys(obj);
             refresh_roots_after_alloc!();
             keys = crate::object::object_keys_array(obj);

crates/perry-runtime/src/object/global_this/proto_methods.rs

@@ -1277,19 +1277,18 @@ pub(crate) fn populate_builtin_prototype_methods(builtin_name: &str, proto_obj:
             // is wired alongside the `OBJ_FLAG_TYPED_ARRAY_PROTO` flag so the
             // generic property-get chain walk resolves the inherited methods.
         }
-        // #10555: these Web API types install NO methods here (their surface
-        // is either type-directed static dispatch or the small-int/handle
-        // dispatch tables), but each still needs its `.prototype`'s own
-        // `Symbol.toStringTag` descriptor for reflection -- see
-        // `install_web_builtin_to_string_tag`'s doc comment. `URLSearchParams`
-        // used to be listed here too; #10759 moved it to its own arm above
-        // (still calling `install_web_builtin_to_string_tag`) once a VALUE
-        // read of one of its prototype methods turned out to need real
-        // reified closures, not just the toStringTag descriptor. The other
-        // six members of this group (`URL`, `AbortController`,
-        // `AbortSignal`, `EventTarget`, `Event`, `CustomEvent`) have not been
-        // audited for the same "read as a value" gap -- see #10759's PR body.
-        "URL" => unsafe { install_web_builtin_to_string_tag(proto_obj, "URL") },
+        // #10555: these Web API types expose their prototype toStringTag for
+        // reflection. URL additionally installs WebIDL component accessors;
+        // its methods still use type-directed dispatch. The remaining five
+        // types have not been audited for methods read as values.
+        "URL" => {
+            let scope = crate::gc::RuntimeHandleScope::new();
+            let proto_h = scope.root_nanbox_f64(crate::value::js_nanbox_pointer(proto_obj as i64));
+            unsafe { install_web_builtin_to_string_tag(proto_obj, "URL") };
+            let proto =
+                crate::value::js_nanbox_get_pointer(proto_h.get_nanbox_f64()) as *mut ObjectHeader;
+            crate::url::prototype::install_url_prototype_accessors(proto);
+        }
         "AbortController" => unsafe {
             install_web_builtin_to_string_tag(proto_obj, "AbortController")
         },

crates/perry-runtime/src/object/mod.rs

@@ -191,7 +191,9 @@ pub(crate) use shapes::ShapeTable;
 mod prototype_helpers;
 mod reflect_support;
 mod reserved_floor;
-pub(crate) use reserved_floor::{ensure_reserved_floor_keys, reserved_slot_floor_for_class_id};
+pub(crate) use reserved_floor::{
+    ensure_reserved_floor_keys, reserved_slot_floor_for_class_id, reserved_slot_floor_for_object,
+};
 #[cfg(feature = "regex-engine")]
 pub(crate) mod regex_canonical;
 pub(crate) mod regex_proto_thunks;

crates/perry-runtime/src/object/object_ops/keys_array.rs

@@ -78,7 +78,7 @@ unsafe fn ensure_key_in_keys_array_inner(
         // accessor installs, which claim a keys slot with no data write)
         // can never take a raw internal field's index. The seeded receiver
         // then falls through to the ordinary existing-keys append below.
-        if crate::object::reserved_slot_floor_for_class_id((*obj).class_id) != 0 {
+        if crate::object::reserved_slot_floor_for_object(obj) != 0 {
             let seeded = crate::object::ensure_reserved_floor_keys(obj);
             refresh_define_property_roots!();
             keys = crate::object::object_keys_array(obj);

crates/perry-runtime/src/object/reserved_floor.rs

@@ -50,6 +50,16 @@ pub(crate) fn reserved_slot_floor_for_class_id(class_id: u32) -> u32 {
     }
 }
 
+/// URL uses class_id 0 but reserves the same twelve numbered slots as a
+/// built-in iterator. Inspect it only on the first named-property write.
+pub(crate) unsafe fn reserved_slot_floor_for_object(obj: *mut ObjectHeader) -> u32 {
+    if (*obj).class_id == 0 && crate::url::is_url_object_shape(obj) {
+        crate::url::parse::URL_FIELD_COUNT
+    } else {
+        reserved_slot_floor_for_class_id((*obj).class_id)
+    }
+}
+
 /// Install the reserved-floor keys array on a keys-less receiver whose class
 /// id reserves raw field slots: `floor` leading `TAG_HOLE` slots, published
 /// as a shape whose `hole_count` matches the physical holes, preserving the
@@ -61,8 +71,11 @@ pub(crate) fn reserved_slot_floor_for_class_id(class_id: u32) -> u32 {
 /// # Safety
 /// `obj` must be a live `GC_TYPE_OBJECT` allocation.
 pub(crate) unsafe fn ensure_reserved_floor_keys(obj: *mut ObjectHeader) -> bool {
-    let floor = reserved_slot_floor_for_class_id((*obj).class_id);
-    if floor == 0 || !super::object_keys_array(obj).is_null() {
+    if !super::object_keys_array(obj).is_null() {
+        return false;
+    }
+    let floor = reserved_slot_floor_for_object(obj);
+    if floor == 0 {
         return false;
     }
     // NaN-boxed handles rather than `root_raw_*_ptr`, so every reload is a

crates/perry-runtime/src/url/mod.rs

@@ -1,7 +1,8 @@
 //! URL operations runtime support
 //!
 //! Provides JavaScript URL functionality for parsing and working with URLs.
-//! URLs are represented as regular JavaScript objects with string fields.
+//! URLs use ordinary GC objects with numbered component slots and accessors
+//! on `URL.prototype`.
 
 use crate::array::{js_array_alloc, js_array_push_f64};
 use crate::object::{js_object_set_field_f64, js_object_set_keys};
@@ -10,6 +11,7 @@ use crate::{js_object_alloc, js_string_from_bytes, ArrayHeader, ObjectHeader, St
 pub mod abort;
 pub mod node_compat;
 pub mod parse;
+pub(crate) mod prototype;
 pub mod search_params;
 pub mod url_class;
 pub mod url_pattern;
@@ -48,7 +50,7 @@ pub use self::url_class::{
     js_url_can_parse, js_url_can_parse_with_base, js_url_get_hash, js_url_get_host,
     js_url_get_hostname, js_url_get_href, js_url_get_origin, js_url_get_pathname, js_url_get_port,
     js_url_get_protocol, js_url_get_search, js_url_get_search_params, js_url_new,
-    js_url_new_with_base, js_url_parse, js_url_parse_with_base, js_url_set_hash,
+    js_url_new_with_base, js_url_parse, js_url_parse_with_base, js_url_set_hash, js_url_set_host,
     js_url_set_hostname, js_url_set_href, js_url_set_password, js_url_set_pathname,
     js_url_set_port, js_url_set_protocol, js_url_set_search, js_url_set_username,
 };

crates/perry-runtime/src/url/parse.rs

@@ -398,52 +398,57 @@ pub(crate) fn create_url_object(url_string: &str) -> *mut ObjectHeader {
     // Allocate object with URL_FIELD_COUNT fields
     // Using class_id 0 for now (generic object)
     let obj = js_object_alloc(0, URL_FIELD_COUNT);
+    let scope = crate::gc::RuntimeHandleScope::new();
+    let obj_h = scope.root_nanbox_f64(crate::value::js_nanbox_pointer(obj as i64));
 
-    // Create the keys array with property names (order must match field indices)
-    let mut keys = js_array_alloc(URL_FIELD_COUNT);
-    keys = js_array_push_f64(keys, create_string_f64("href")); // 0
-    keys = js_array_push_f64(keys, create_string_f64("protocol")); // 1
-    keys = js_array_push_f64(keys, create_string_f64("host")); // 2
-    keys = js_array_push_f64(keys, create_string_f64("hostname")); // 3
-    keys = js_array_push_f64(keys, create_string_f64("port")); // 4
-    keys = js_array_push_f64(keys, create_string_f64("pathname")); // 5
-    keys = js_array_push_f64(keys, create_string_f64("search")); // 6
-    keys = js_array_push_f64(keys, create_string_f64("hash")); // 7
-    keys = js_array_push_f64(keys, create_string_f64("origin")); // 8
-    keys = js_array_push_f64(keys, create_string_f64("searchParams")); // 9
-    keys = js_array_push_f64(keys, create_string_f64("username")); // 10
-    keys = js_array_push_f64(keys, create_string_f64("password")); // 11
-    js_object_set_keys(obj, keys);
+    // The numbered fields are internal URL state. Named properties live on
+    // URL.prototype; an expando write seeds twelve tombstone keys before its
+    // first append so it cannot overwrite these fields.
 
     // Set all the URL properties
-    js_object_set_field_f64(obj, URL_HREF, create_string_f64(&href));
-    js_object_set_field_f64(obj, URL_PROTOCOL, create_string_f64(&protocol));
-    js_object_set_field_f64(obj, URL_HOST, create_string_f64(&host));
-    js_object_set_field_f64(obj, URL_HOSTNAME, create_string_f64(&hostname));
-    js_object_set_field_f64(obj, URL_PORT, create_string_f64(&port));
-    js_object_set_field_f64(obj, URL_PATHNAME, create_string_f64(&pathname));
-    js_object_set_field_f64(obj, URL_SEARCH, create_string_f64(&search));
-    js_object_set_field_f64(obj, URL_HASH, create_string_f64(&hash));
-    js_object_set_field_f64(obj, URL_ORIGIN, create_string_f64(&origin));
-    js_object_set_field_f64(obj, URL_USERNAME, create_string_f64(&username));
-    js_object_set_field_f64(obj, URL_PASSWORD, create_string_f64(&password));
+    let set_string = |field, text: &str| {
+        let value = create_string_f64(text);
+        let obj = crate::value::js_nanbox_get_pointer(obj_h.get_nanbox_f64()) as *mut ObjectHeader;
+        js_object_set_field_f64(obj, field, value);
+    };
+    set_string(URL_HREF, &href);
+    set_string(URL_PROTOCOL, &protocol);
+    set_string(URL_HOST, &host);
+    set_string(URL_HOSTNAME, &hostname);
+    set_string(URL_PORT, &port);
+    set_string(URL_PATHNAME, &pathname);
+    set_string(URL_SEARCH, &search);
+    set_string(URL_HASH, &hash);
+    set_string(URL_ORIGIN, &origin);
+    set_string(URL_USERNAME, &username);
+    set_string(URL_PASSWORD, &password);
     // Build a real URLSearchParams object from the search string (parsed
     // lazily below). Storing a string here would break `url.searchParams.get()`
     // because the URLSearchParams method runtime functions interpret the
     // receiver as `*mut ObjectHeader` and would deref a StringHeader
     // instead — see issue #111.
     let params_entries = parse_query_string(&search);
     let params_obj = create_url_search_params_object(params_entries);
-    let params_f64 = crate::value::js_nanbox_pointer(params_obj as i64);
-    js_object_set_field_f64(obj, URL_SEARCH_PARAMS, params_f64);
+    let params_h = scope.root_nanbox_f64(crate::value::js_nanbox_pointer(params_obj as i64));
+    let obj = crate::value::js_nanbox_get_pointer(obj_h.get_nanbox_f64()) as *mut ObjectHeader;
+    js_object_set_field_f64(obj, URL_SEARCH_PARAMS, params_h.get_nanbox_f64());
     // Adopt: subsequent mutations on `url.searchParams` should sync back.
+    let params_obj =
+        crate::value::js_nanbox_get_pointer(params_h.get_nanbox_f64()) as *mut ObjectHeader;
     js_object_set_field_f64(
         params_obj,
         super::search_params::URL_SEARCH_PARAMS_OWNER,
-        crate::value::js_nanbox_pointer(obj as i64),
+        obj_h.get_nanbox_f64(),
     );
 
-    obj
+    let proto = crate::object::builtin_prototype_value("URL");
+    if proto.to_bits() != crate::value::TAG_UNDEFINED {
+        crate::object::prototype_chain::object_link_class_default_prototype(
+            crate::value::js_nanbox_get_pointer(obj_h.get_nanbox_f64()) as usize,
+            proto.to_bits(),
+        );
+    }
+    crate::value::js_nanbox_get_pointer(obj_h.get_nanbox_f64()) as *mut ObjectHeader
 }
 
 /// Build and throw a `TypeError` matching Node's WHATWG-URL parser's

crates/perry-runtime/src/url/prototype.rs

@@ -0,0 +1,146 @@
+//! WebIDL URL accessors. The URL's numbered fields are private storage;
+//! property lookup and reflection use these descriptors on URL.prototype.
+
+use super::parse::*;
+use super::url_class::*;
+use super::*;
+
+fn require_url_receiver(name: &str) -> *mut ObjectHeader {
+    let this = crate::object::js_implicit_this_get();
+    if let Some(obj) = object_from_f64(this) {
+        if is_url_object_shape(obj) {
+            return obj;
+        }
+    }
+    let message = format!("Value of URL.prototype.{name} called on an incompatible receiver");
+    let msg = js_string_from_bytes(message.as_ptr(), message.len() as u32);
+    let err = crate::error::js_typeerror_new(msg);
+    crate::exception::js_throw(crate::value::js_nanbox_pointer(err as i64));
+}
+
+macro_rules! url_getter {
+    ($fn_name:ident, $name:literal, $slot:expr) => {
+        extern "C" fn $fn_name(_closure: *const crate::closure::ClosureHeader) -> f64 {
+            let obj = require_url_receiver($name);
+            crate::object::js_object_get_field_f64(obj, $slot)
+        }
+    };
+}
+
+macro_rules! url_setter {
+    ($fn_name:ident, $name:literal, $setter:path) => {
+        extern "C" fn $fn_name(_closure: *const crate::closure::ClosureHeader, value: f64) -> f64 {
+            let obj = require_url_receiver($name);
+            $setter(obj, value);
+            f64::from_bits(crate::value::TAG_UNDEFINED)
+        }
+    };
+}
+
+url_getter!(get_href, "href", URL_HREF);
+url_getter!(get_protocol, "protocol", URL_PROTOCOL);
+url_getter!(get_host, "host", URL_HOST);
+url_getter!(get_hostname, "hostname", URL_HOSTNAME);
+url_getter!(get_port, "port", URL_PORT);
+url_getter!(get_pathname, "pathname", URL_PATHNAME);
+url_getter!(get_search, "search", URL_SEARCH);
+url_getter!(get_hash, "hash", URL_HASH);
+url_getter!(get_origin, "origin", URL_ORIGIN);
+url_getter!(get_search_params, "searchParams", URL_SEARCH_PARAMS);
+url_getter!(get_username, "username", URL_USERNAME);
+url_getter!(get_password, "password", URL_PASSWORD);
+url_setter!(set_href, "href", js_url_set_href);
+url_setter!(set_protocol, "protocol", js_url_set_protocol);
+url_setter!(set_host, "host", js_url_set_host);
+url_setter!(set_hostname, "hostname", js_url_set_hostname);
+url_setter!(set_port, "port", js_url_set_port);
+url_setter!(set_pathname, "pathname", js_url_set_pathname);
+url_setter!(set_search, "search", js_url_set_search);
+url_setter!(set_hash, "hash", js_url_set_hash);
+url_setter!(set_username, "username", js_url_set_username);
+url_setter!(set_password, "password", js_url_set_password);
+
+pub(crate) fn install_url_prototype_accessors(proto: *mut ObjectHeader) {
+    let entries: &[(&str, *const u8, Option<*const u8>)] = &[
+        ("href", get_href as *const u8, Some(set_href as *const u8)),
+        ("origin", get_origin as *const u8, None),
+        (
+            "protocol",
+            get_protocol as *const u8,
+            Some(set_protocol as *const u8),
+        ),
+        (
+            "username",
+            get_username as *const u8,
+            Some(set_username as *const u8),
+        ),
+        (
+            "password",
+            get_password as *const u8,
+            Some(set_password as *const u8),
+        ),
+        ("host", get_host as *const u8, Some(set_host as *const u8)),
+        (
+            "hostname",
+            get_hostname as *const u8,
+            Some(set_hostname as *const u8),
+        ),
+        ("port", get_port as *const u8, Some(set_port as *const u8)),
+        (
+            "pathname",
+            get_pathname as *const u8,
+            Some(set_pathname as *const u8),
+        ),
+        (
+            "search",
+            get_search as *const u8,
+            Some(set_search as *const u8),
+        ),
+        ("searchParams", get_search_params as *const u8, None),
+        ("hash", get_hash as *const u8, Some(set_hash as *const u8)),
+    ];
+    let scope = crate::gc::RuntimeHandleScope::new();
+    let proto_h = scope.root_nanbox_f64(crate::value::js_nanbox_pointer(proto as i64));
+    for &(name, getter, setter) in entries {
+        unsafe {
+            crate::closure::js_register_closure_arity(getter, 0);
+            let get = crate::closure::js_closure_alloc(getter, 0);
+            let get_h = scope.root_nanbox_f64(crate::value::js_nanbox_pointer(get as i64));
+            crate::object::native_module::set_bound_native_closure_name(
+                get,
+                &format!("get {name}"),
+            );
+            let get = crate::value::js_nanbox_get_pointer(get_h.get_nanbox_f64()) as usize;
+            crate::object::native_module::set_builtin_closure_length(get, 0);
+            crate::object::native_module::set_builtin_closure_non_constructable(get);
+            let set_h = setter.map(|func| {
+                crate::closure::js_register_closure_arity(func, 1);
+                let set = crate::closure::js_closure_alloc(func, 0);
+                let handle = scope.root_nanbox_f64(crate::value::js_nanbox_pointer(set as i64));
+                crate::object::native_module::set_bound_native_closure_name(
+                    set,
+                    &format!("set {name}"),
+                );
+                let set = crate::value::js_nanbox_get_pointer(handle.get_nanbox_f64()) as usize;
+                crate::object::native_module::set_builtin_closure_length(set, 1);
+                crate::object::native_module::set_builtin_closure_non_constructable(set);
+                handle
+            });
+            let proto =
+                crate::value::js_nanbox_get_pointer(proto_h.get_nanbox_f64()) as *mut ObjectHeader;
+            let get_bits = get_h.get_nanbox_f64().to_bits();
+            crate::object::install_builtin_getter(proto, name, get_bits);
+            let proto =
+                crate::value::js_nanbox_get_pointer(proto_h.get_nanbox_f64()) as *mut ObjectHeader;
+            crate::object::set_builtin_accessor_descriptor(
+                proto as usize,
+                name.to_string(),
+                crate::object::AccessorDescriptor {
+                    get: get_h.get_nanbox_f64().to_bits(),
+                    set: set_h.as_ref().map_or(0, |h| h.get_nanbox_f64().to_bits()),
+                },
+                crate::object::PropertyAttrs::new(true, true, true),
+            );
+        }
+    }
+}