Fix proxy Array.from and dynamic Request headers

changelog.d/10280-proxy-value-shapes.md

@@ -0,0 +1,15 @@
+Fix Proxy values in `Array.from` and dynamic `RequestInit.headers` (#10270,
+#10274; OpenCode bring-up tracker #10107).
+
+- Route array proxies through iterator materialization before inspecting heap
+  headers, including mapped `Array.from`, Headers iterable pairs, call spread,
+  and collection constructors. Preserve the proxy receiver when a get trap
+  forwards the default iterator, and safely dispatch array-like proxy indices.
+  Keep concat on trapped indexed reads, preserving
+  holes and ignoring a custom iterator.
+- Convert dynamic Request header records/iterables with
+  `js_headers_init_from_value`; retain the existing inline literal-header path.
+- Keep proxy registry lookups behind the existing proxy-id band predicate;
+  Array.from checks only within its existing small-handle branch.
+- Add compiled regression probes for both issue reproductions, nested proxies,
+  get/ownKeys traps, custom iterators, mapped conversion, and sibling consumers.

crates/perry-codegen/src/lower_call/builtin.rs

@@ -1374,7 +1374,8 @@ pub(super) fn lower_builtin_new<'a>(
                                 if let Some(hprops) = extract_options_fields(ctx, vexpr) {
                                     headers_handle = build_headers_from_object(ctx, &hprops)?;
                                 } else {
-                                    headers_handle = lower_expr(ctx, vexpr)?;
+                                    headers_handle =
+                                        super::options::build_headers_from_value(ctx, vexpr)?;
                                 }
                             }
                             "referrer" => {

crates/perry-codegen/src/lower_call/options/mod.rs

@@ -67,6 +67,27 @@ pub(in crate::lower_call) fn build_headers_from_object(
     })
 }
 
+/// Convert a dynamic HeadersInit with the same helper as `new Headers(init)`.
+/// The literal path stays in `build_headers_from_object`; a runtime value is
+/// not necessarily a Headers registry handle (it may be a record or iterable).
+pub(in crate::lower_call) fn build_headers_from_value(
+    ctx: &mut FnCtx<'_>,
+    init: &Expr,
+) -> Result<String> {
+    with_rooted_group(ctx, 1, |ctx, group| {
+        let h = ctx.block().call(DOUBLE, "js_headers_new", &[]);
+        let h_root = group.adopt_emitted(ctx, Repr::Boxed, &h, true);
+        let value = lower_expr(ctx, init)?;
+        let h = group.reread_emitted(ctx, h_root);
+        ctx.block().call(
+            DOUBLE,
+            "js_headers_init_from_value",
+            &[(DOUBLE, &h), (DOUBLE, &value)],
+        );
+        Ok(group.reread_emitted(ctx, h_root))
+    })
+}
+
 /// Phase 3 compat: extract `{key: value, ...}` pairs from an options
 /// argument in a form that works whether the options literal reached us
 /// as a plain `Expr::Object(props)` (pre-Phase-3 / spread/dynamic shapes)

crates/perry-runtime/src/array/flat_clone.rs

@@ -458,7 +458,7 @@ pub extern "C" fn js_array_clone(src: *const ArrayHeader) -> *mut ArrayHeader {
         let top16 = (src as u64) >> 48;
         if top16 == 0x7FFF {
             true
-        } else if raw_addr >= crate::gc::GC_HEADER_SIZE + 0x1000 {
+        } else if crate::value::addr_class::is_above_handle_band(raw_addr) {
             unsafe {
                 let hdr = (raw_addr as *const u8).sub(crate::gc::GC_HEADER_SIZE)
                     as *const crate::gc::GcHeader;
@@ -478,6 +478,15 @@ pub extern "C" fn js_array_clone(src: *const ArrayHeader) -> *mut ArrayHeader {
     // helper after codegen strips the tag, so ask the generic iterator resolver
     // before treating the id as a non-array and returning [].
     if crate::value::addr_class::is_small_handle(raw_addr) {
+        // #10270: a Proxy id has no GC/ArrayHeader. Only the existing handle
+        // arm probes the registry; plain arrays keep their classification and
+        // copy path. Array.from permits array-like proxies as well as iterables.
+        if let Some(proxy) = array_ptr_as_proxy(raw_addr as *const ArrayHeader) {
+            let undefined = f64::from_bits(crate::value::TAG_UNDEFINED);
+            let result =
+                super::from_concat::array_from_full(undefined, proxy, undefined, undefined);
+            return crate::value::js_nanbox_get_pointer(result) as *mut ArrayHeader;
+        }
         if let Some(dispatch) = crate::object::handle_property_dispatch() {
             let method = b"@@iterator";
             let iter_fn = unsafe { dispatch(raw_addr as i64, method.as_ptr(), method.len()) };

crates/perry-runtime/src/array/from_concat.rs

@@ -555,6 +555,25 @@ enum IterSourceKind {
 /// class id (so a direct symbol read returns `undefined`) but which still
 /// drive `.next()`. Mirrors the iterable detection in `js_array_clone`.
 fn items_is_iterable(items: f64) -> bool {
+    if let Some(proxy) = crate::array::array_ptr_as_proxy(
+        crate::value::js_nanbox_get_pointer(items) as *const ArrayHeader,
+    ) {
+        // A proxy can replace or remove @@iterator even when IsArray is true,
+        // or add it to a record. Array.from falls back to indexed reads only
+        // when GetMethod is nullish; a non-callable method must still throw.
+        let symbol = crate::symbol::well_known_symbol("iterator");
+        let method = unsafe {
+            crate::symbol::js_object_get_symbol_property(
+                proxy,
+                crate::value::js_nanbox_pointer(symbol as i64),
+            )
+        };
+        if matches!(method.to_bits(), TAG_UNDEFINED | TAG_NULL) {
+            return false;
+        }
+        resolve_callable(method);
+        return true;
+    }
     if crate::collection_iter::is_iterable(items) {
         return true;
     }
@@ -579,6 +598,15 @@ fn items_is_iterable(items: f64) -> bool {
 }
 
 fn classify_iter_source(items: f64) -> IterSourceKind {
+    // IsArray unwraps proxies; LiveArray would read the id as an ArrayHeader
+    // and skip a trapped @@iterator. The band test excludes ordinary arrays.
+    if crate::array::array_ptr_as_proxy(
+        crate::value::js_nanbox_get_pointer(items) as *const ArrayHeader
+    )
+    .is_some()
+    {
+        return IterSourceKind::Generic;
+    }
     if jsv_is_array(items) {
         return IterSourceKind::LiveArray;
     }
@@ -1037,8 +1065,10 @@ unsafe fn try_append_spread_array_dense(
     src: *const ArrayHeader,
 ) -> Option<*mut ArrayHeader> {
     // A masked proxy id is not a dereferenceable ArrayHeader.
-    if crate::array::array_ptr_as_proxy(src).is_some() {
-        return None;
+    if let Some(proxy) = crate::array::array_ptr_as_proxy(src) {
+        // Concat uses HasProperty/Get, never @@iterator. Resolve this inside
+        // the existing proxy guard so the ordinary bulk-copy path is unchanged.
+        return Some(append_concat_proxy(result, proxy));
     }
     let src = clean_arr_ptr(src);
     if src.is_null() {
@@ -1131,6 +1161,30 @@ unsafe fn try_append_spread_array_dense(
     Some(result)
 }
 
+/// Indexed concat of a proxy, preserving holes and observing its traps.
+unsafe fn append_concat_proxy(result: *mut ArrayHeader, proxy: f64) -> *mut ArrayHeader {
+    let scope = crate::gc::RuntimeHandleScope::new();
+    let result = scope.root_raw_mut_ptr(result);
+    let proxy = scope.root_nanbox_f64(proxy);
+    let len = array_like_length(proxy.get_nanbox_f64());
+    for index in 0..len {
+        let entry_scope = crate::gc::RuntimeHandleScope::new();
+        let name = index.to_string();
+        let key = crate::string::js_string_from_bytes(name.as_ptr(), name.len() as u32);
+        let key = entry_scope.root_nanbox_f64(crate::value::js_nanbox_string(key as i64));
+        let present =
+            crate::object::js_object_has_property(proxy.get_nanbox_f64(), key.get_nanbox_f64());
+        let value = if crate::value::js_is_truthy(present) != 0 {
+            crate::proxy::js_proxy_get(proxy.get_nanbox_f64(), key.get_nanbox_f64())
+        } else {
+            f64::from_bits(crate::value::TAG_HOLE)
+        };
+        let grown = js_array_push_f64(result.get_raw_mut_ptr(), value);
+        result.set_raw_mut_ptr(grown);
+    }
+    result.get_raw_mut_ptr()
+}
+
 /// Append every element of the (already-materializable) source array `src`
 /// into `result`, returning the (possibly reallocated) result. `src` is
 /// materialized via `js_array_clone` so sets/maps/typed-arrays/buffers spread

crates/perry-runtime/src/array/iterator.rs

@@ -102,6 +102,13 @@ pub extern "C" fn js_for_of_to_array(val_f64: f64) -> f64 {
         throw_not_iterable(val_f64);
     }
 
+    // Proxy ids are not heap headers. Use the same trapped iterator as spread.
+    if let Some(proxy) = array_ptr_as_proxy(raw_ptr as *const ArrayHeader) {
+        return js_nanbox_pointer(
+            js_iterator_to_array(crate::symbol::js_get_iterator(proxy)) as i64
+        );
+    }
+
     // Inspect the GC header's object kind to dispatch Array / Map / Set
     // without consulting any static type.
     let obj_type = unsafe {

crates/perry-runtime/src/collection_iter.rs

@@ -254,6 +254,13 @@ pub(crate) fn constructor_iter(value: f64) -> ConstructorIter {
     let jsv = JSValue::from_bits(value.to_bits());
     let is_array = crate::array::js_array_is_array(value).to_bits() == crate::value::TAG_TRUE;
     if is_array {
+        if crate::array::array_ptr_as_proxy(
+            js_nanbox_get_pointer(value) as *const crate::array::ArrayHeader
+        )
+        .is_some()
+        {
+            return ConstructorIter::Iterator(crate::symbol::js_get_iterator(value));
+        }
         return ConstructorIter::Array(value);
     }
     if jsv.is_any_string() {

crates/perry-runtime/src/object/arguments.rs

@@ -717,7 +717,9 @@ pub extern "C" fn js_array_like_to_array(value: f64) -> *mut ArrayHeader {
         // sticky flag that is false until user code writes the prototype slot,
         // so the fast path is untouched in every ordinary program.
         if crate::array::js_array_is_array(value).to_bits() == crate::value::TAG_TRUE {
-            if crate::array::array_proto_iterator_modified() {
+            if crate::array::array_proto_iterator_modified()
+                || crate::array::array_ptr_as_proxy(raw as *const ArrayHeader).is_some()
+            {
                 return crate::array::js_array_clone_for_spread(value);
             }
             return crate::array::clean_arr_ptr(raw as *const ArrayHeader) as *mut ArrayHeader;

crates/perry-runtime/src/object/polymorphic_index.rs

@@ -174,7 +174,15 @@ pub extern "C" fn js_object_get_index_polymorphic(obj_handle: i64, idx: f64) ->
     } else {
         obj_handle as u64
     };
-    if raw < 0x1000 {
+    // Array.from's array-like fallback can receive a Proxy record. Its id is
+    // not a heap header; route it inside the existing low-address guard so
+    // ordinary heap receivers do not perform a proxy registry lookup.
+    if crate::value::addr_class::is_handle_band(raw as usize) {
+        if let Some(proxy) =
+            crate::array::array_ptr_as_proxy(raw as *const crate::array::ArrayHeader)
+        {
+            return crate::proxy::js_proxy_get(proxy, idx);
+        }
         return f64::from_bits(crate::value::TAG_UNDEFINED);
     }
     // Symbols share GC_TYPE_STRING storage for tracing, but they are primitive

crates/perry-runtime/src/symbol/get.rs

@@ -1141,22 +1141,19 @@ pub unsafe extern "C" fn js_object_get_symbol_property(obj_f64: f64, sym_f64: f6
             }
         }
     }
-    // #321: arrays expose `Symbol.iterator`. perry has no standalone array
-    // iterator object (for-of is special-cased), but `arr[Symbol.iterator]`
-    // must resolve to a callable so `Symbol.iterator in arr` is true
-    // (effect's `Predicate.isIterable`) and `typeof arr[Symbol.iterator]` is
-    // "function". Bind the array's `values` method as that callable. Pre-fix
-    // the symbol key fell through to the numeric/string paths and read back a
-    // number, so `isIterable([...])` was false and `Effect.all`'s
-    // predicate-`dual` `forEach` went data-last (returned a function).
+    // Return the actual prototype iterator, whose thunk reads call-time this.
+    // Binding `values` to this array makes a Proxy get trap returning
+    // target[Symbol.iterator] iterate the target, bypassing length/index traps
+    // even when GetIterator calls the method with the Proxy receiver (#10270).
     if crate::array::js_array_is_array(obj_f64).to_bits() == crate::value::TAG_TRUE {
         let iter_wk = well_known_symbol("iterator");
         if !iter_wk.is_null() {
             let iter_f64 =
                 f64::from_bits(crate::value::JSValue::pointer(iter_wk as *const u8).bits());
             if sym_key_from_f64(sym_f64) == sym_key_from_f64(iter_f64) {
-                let mname = b"values";
-                return crate::object::js_class_method_bind(obj_f64, mname.as_ptr(), mname.len());
+                let proto = crate::object::builtin_prototype_value("Array");
+                return own_symbol_property(proto, sym_f64)
+                    .unwrap_or(f64::from_bits(crate::value::TAG_UNDEFINED));
             }
         }
     }

crates/perry-stdlib/src/fetch/headers.rs

@@ -293,7 +293,13 @@ unsafe fn materialize_header_pair(
     if !is_headers_init_iterable(pair_value) {
         headers_init_type_error("Headers constructor: expected name/value pair");
     }
-    let pair_array_value = if perry_runtime::js_array_is_array(pair_value).to_bits() == TAG_TRUE {
+    // IsArray also accepts proxy ids and object-backed Array subclasses; only
+    // a real array header may bypass iterable materialization (#10270).
+    let raw = perry_runtime::js_nanbox_get_pointer(pair_value);
+    let pair_array_value = if matches!(
+        gc_type_for_raw_ptr(raw),
+        Some(perry_runtime::gc::GC_TYPE_ARRAY | perry_runtime::gc::GC_TYPE_LAZY_ARRAY)
+    ) {
         pair_value
     } else {
         perry_runtime::array::js_for_of_to_array(pair_value)

crates/perry/tests/issue_10270_proxy_array_from.rs

@@ -0,0 +1,63 @@
+//! #10270: IsArray is not proof that a Proxy id is an ArrayHeader.
+
+mod support {
+    include!("support/proxy_value_probe.rs");
+}
+
+const SOURCE: &str = r#"
+const t = (name: string, f: () => any) => { try { console.log(name, JSON.stringify(f())) } catch (e: any) { console.log(name, "THROW", e.message) } }
+const pa = () => new Proxy([["x-a", "1"]], {})
+t("Q1 [...proxyOverArray]", () => [...(pa() as any)].length)
+t("Q2 for..of proxyOverArray", () => { let n = 0; for (const _ of pa() as any) n++; return n })
+t("Q3 Array.isArray(proxyOverArray)", () => Array.isArray(pa()))
+t("Q4 proxy[Symbol.iterator] typeof", () => typeof (pa() as any)[Symbol.iterator])
+t("Q5 Array.from(proxyOverArray)", () => Array.from(pa() as any).length)
+t("nested", () => Array.from(new Proxy(new Proxy([1, 2], {}), {})))
+t("trapped indices", () => Array.from(new Proxy([1, 2], { get(t: any, k: any) { return k === "0" ? 9 : t[k]; } })))
+t("custom iterator", () => Array.from(new Proxy([1, 2], { get(t: any, k: any) { return k === Symbol.iterator ? () => [7, 8, 9].values() : t[k]; } })))
+t("mapped", () => Array.from(new Proxy([1, 2], {}), (v: number, i: number) => v + i))
+t("mapped custom iterator", () => Array.from(new Proxy([1, 2], { get(t: any, k: any) { return k === Symbol.iterator ? () => [7, 8, 9].values() : t[k]; } }), (v: number) => v * 2))
+t("arraylike", () => Array.from(new Proxy({ 0: "a", 1: "b", length: 2 }, {})))
+t("removed iterator", () => Array.from(new Proxy([1, 2], { get(t: any, k: any) { return k === Symbol.iterator ? undefined : t[k]; } })))
+t("record iterator", () => Array.from(new Proxy({}, { get(t: any, k: any) { return k === Symbol.iterator ? () => [5, 6].values() : t[k]; } })))
+t("headers outer", () => new Headers(new Proxy([["x-a", "1"]], {}) as any).get("x-a"))
+t("headers pair", () => new Headers([new Proxy(["x-a", "1"], {})] as any).get("x-a"))
+t("plain array", () => Array.from([3, 4]))
+t("of preserves proxy", () => { const p = new Proxy([1, 2], {}); return Array.of(p)[0] === p; })
+t("concat indices", () => [0].concat(new Proxy([1, 2], { get(t: any, k: any) { return k === Symbol.iterator ? () => [9].values() : k === "0" ? 7 : t[k]; } })))
+t("concat holes", () => { const a = [0].concat(new Proxy([, 2], {})); return [a.length, 1 in a, a[2]]; })
+t("call spread", () => { const count = (...xs: any[]) => xs.length; return count(...new Proxy([1, 2], {})); })
+t("set iterator", () => Array.from(new Set(new Proxy([1, 2], { get(t: any, k: any) { return k === Symbol.iterator ? () => [7, 8].values() : t[k]; } }))))
+Promise.all(new Proxy([Promise.resolve(1), Promise.resolve(2)], {})).then(v => console.log("all", JSON.stringify(v)))
+"#;
+
+#[test]
+fn proxy_array_from_and_headers_iterables() {
+    assert_eq!(
+        support::compile_and_run(SOURCE),
+        concat!(
+            "Q1 [...proxyOverArray] 1\n",
+            "Q2 for..of proxyOverArray 1\n",
+            "Q3 Array.isArray(proxyOverArray) true\n",
+            "Q4 proxy[Symbol.iterator] typeof \"function\"\n",
+            "Q5 Array.from(proxyOverArray) 1\n",
+            "nested [1,2]\n",
+            "trapped indices [9,2]\n",
+            "custom iterator [7,8,9]\n",
+            "mapped [1,3]\n",
+            "mapped custom iterator [14,16,18]\n",
+            "arraylike [\"a\",\"b\"]\n",
+            "removed iterator [1,2]\n",
+            "record iterator [5,6]\n",
+            "headers outer \"1\"\n",
+            "headers pair \"1\"\n",
+            "plain array [3,4]\n",
+            "of preserves proxy true\n",
+            "concat indices [0,7,2]\n",
+            "concat holes [3,false,2]\n",
+            "call spread 2\n",
+            "set iterator [7,8]\n",
+            "all [1,2]\n",
+        )
+    );
+}

crates/perry/tests/issue_10274_request_proxy_headers.rs

@@ -0,0 +1,43 @@
+//! #10274: a dynamic HeadersInit in a literal RequestInit needs conversion.
+
+mod support {
+    include!("support/proxy_value_probe.rs");
+}
+
+const SOURCE: &str = r#"
+const dump = (h: any) => { const out: string[] = []; h.forEach((v: string, k: string) => out.push(k + "=" + v)); return out.sort() }
+const proxy = new Proxy({ "x-a": "1" }, {})
+console.log("direct", JSON.stringify(dump(new Headers(proxy as any))))
+console.log("request", JSON.stringify(dump(new Request("https://x.dev", { headers: proxy as any }).headers)))
+function make(headers: any) { return new Request("https://x.dev", { headers }).headers; }
+function init(headers: any): any { return { headers }; }
+console.log("parameter", JSON.stringify(dump(make(proxy))))
+console.log("runtime init", JSON.stringify(dump(new Request("https://x.dev", init(proxy)).headers)))
+const trapped = new Proxy({ "authorization": "secret", "x-hidden": "hidden" }, {
+  ownKeys() { return ["authorization"]; },
+  get(t: any, k: any) { return k === "authorization" ? "Bearer token" : t[k]; }
+});
+console.log("traps", JSON.stringify(dump(make(trapped))))
+console.log("record", JSON.stringify(dump(make({ "x-a": "1" }))))
+console.log("pairs", JSON.stringify(dump(make([["x-a", "1"], ["x-a", "2"]]))))
+console.log("handle", JSON.stringify(dump(make(new Headers({ "x-a": "1" })))))
+console.log("literal", JSON.stringify(dump(new Request("https://x.dev", { headers: { "x-a": "1" } }).headers)))
+"#;
+
+#[test]
+fn request_converts_dynamic_headers_init() {
+    assert_eq!(
+        support::compile_and_run(SOURCE),
+        concat!(
+            "direct [\"x-a=1\"]\n",
+            "request [\"x-a=1\"]\n",
+            "parameter [\"x-a=1\"]\n",
+            "runtime init [\"x-a=1\"]\n",
+            "traps [\"authorization=Bearer token\"]\n",
+            "record [\"x-a=1\"]\n",
+            "pairs [\"x-a=1, 2\"]\n",
+            "handle [\"x-a=1\"]\n",
+            "literal [\"x-a=1\"]\n",
+        )
+    );
+}