Object: separate internal property descriptors from user conversion objects

[chrisbbreuer]

Parent: #465. Follow-up to #811's descriptor conversion/caller audit.

Engine-internal Property Descriptor records must not be reinterpreted as user
objects by ToPropertyDescriptor. Several helpers currently construct an object
with own value/writable/enumerable/configurable fields, then call
builtins.defineOneResult, which observes inherited get/set fields. That adds
user-code execution to CreateDataProperty / internal descriptor application.

Confirmed on 0ad2b5d and the local #811 candidate; Node returns true, zig-js
returns ERR 123:

(function () {
  var calls = 0;
  Object.defineProperty(Object.prototype, 'get', {
    get() { calls++; throw 123; }, configurable: true
  });
  try {
    var result = JSON.parse('{"a":1}', function (k, v) { return v; });
    return result.a === 1 && calls === 0;
  } finally { delete Object.prototype.get; }
})()

Audit internal callers including createDataIndexOrThrow, internalizeStore,
array result publication, ordinary receiver DefineOwnProperty paths, and
setterIgnoringProto. Public Object/Reflect.defineProperty must still perform
ToPropertyDescriptor exactly once; internal records must go directly to the
descriptor-application path, including through nested Proxy forwarding.

Use a clear internal record/API boundary, not prototype mutation, pinning,
suppression, or exception recovery. Add inherited-field ordering/abrupt controls,
both execution tiers, actual-moving witnesses where callbacks remain required,
allocation-failure restoration, and affected test262/TSan checks.

Local reproduction and baseline/candidate logs:
/Users/chris/.cache/zig-js-reflection.iP8bKP/followup-internal-descriptor-read.js.

[chrisbbreuer]

Baseline audit at 81978f7:

• 13/20 focused semantic probes fail with the inherited descriptor getter's sentinel; Node passes 20/20. Affected paths: JSON reviver stores, Array.from/of/custom species, Proxy class fields, both legacy accessor dispatch paths, and ordinary/typed-array Reflect.set receivers.
• Seven controls already pass: public inherited conversion/abrupt completion/field order, partial and accessor trap record publication, ignored JSON define rejection, and required trap exceptions.
• Eight moving-nursery witnesses added before the implementation: three pass; ordinary and typed-array receiver metadata and Array.from fail; legacy getter/setter ToPropertyKey witnesses abort. Each successful witness requires an actual move, in both forced execution modes.

Implementation in progress: a native PropertyDescriptor with optional typed fields, invocation-local precise payload roots, a separate user ToPropertyDescriptor boundary, and FromPropertyDescriptor materialization only for JavaScript-visible output/trap arguments. Internal callers are migrated rather than changing prototypes or masking inherited fields. Receiver/key-coercion and synchronous array-result lifetimes are being fixed with explicit roots; no Promise/Worker/native job implementation changes.

Current corrected-source validation:

• 20/20 semantic probes pass (13 fixes), agreeing with Node. Checked-in cases force tree-walker and required VM with zero plain-function fallback.
• Eleven moving witnesses pass in both modes (22 actual moves), including the eight baseline cases and additional Array.of, iterable Array.from and inherited Iterator setter lifetimes.
• Seven every-allocation-failure sweeps pass with root/environment/depth restoration.
• Four shared no-GIL lanes x 32 iterations pass. The initial fixture accidentally exposed a poisoned inherited Proxy handler.get; the final fixture explicitly sets handler.get to undefined so it isolates descriptor conversion while retaining legitimate Proxy behavior.
• Corrected unsuppressed ReleaseSafe+TSan passes all 74 selected tests: 14 internal descriptor, 33 Object reflection, 26 Proxy metadata, and the existing Object.prototype/valueOf control. Zero failures/leaks/race reports, no suppressions.
• 23 before/after Test262 subtrees are byte-identical: 13,755 passes, zero flips/regressions in this measured scope.

The first full Debug run caught an accidentally removed adjacent valueOf dispatch branch during migration. That branch was restored verbatim; its focused Debug/TSan checks and the restarted full-suite case pass. The restarted complete Debug suite and final seeded fuzz remain pending. Disk exhaustion interrupted a corpus log and one fuzz compilation; those are not counted as passes. The missing corpus subtree was rerun and its denominator verified. No completion or full-CI claim yet.

[chrisbbreuer]

Implemented on origin/main in 209201ae — chore: wip. Another actor committed the exact prepared three-file patch; Chris is author and committer, with no trailers. The pushed commit is preserved, not amended or rewritten. Reverse-apply verification confirms every prepared hunk is present.

The implementation separates the native PropertyDescriptor record from user ToPropertyDescriptor conversion. Optional typed fields preserve absence versus undefined; invocation-local precise roots retain payloads through callbacks. Internal callers and nested Proxy forwarding apply records directly. JavaScript descriptor objects are materialized only for observable output/trap arguments. Public conversion order, accessor validation, partial descriptors, ignored JSON define rejection and required abrupt completions remain exact. Synchronous Array.from/of, legacy accessor and receiver-definition callers retain their continued operands through moving collection. No native stack/queue/job/Promise/Worker implementation changes.

Final local evidence for the exact prepared revision (81978f7 plus this descriptor patch):

• Twenty standalone semantic probes: 7/20 -> 20/20; Node independently agrees. Checked-in tests force both tree-walker and required bytecode with zero plain-function fallback.
• Eleven actual-moving witnesses in both tiers: 22 verified relocations, including receiver metadata, accessor-key coercion, Array.from/of, class/species publication and inherited Iterator setters.
• Seven fail-every-allocation sweeps restore precise roots, environment and call depth. Four shared no-GIL lanes complete 32 descriptor operations each.
• Unsuppressed ReleaseSafe+TSan: 74/74 selected tests pass, zero failures/leaks/race reports (14 descriptors, 33 reflection, 26 Proxy metadata, one existing valueOf control).
• Native full Debug test-parallel: 2,115 passed, one platform skip, zero failures/leaks, all 2,116 linked tests accounted for; 2,276.4 seconds across four timing-balanced shards.
• Twenty-three disjoint affected Test262 reports are byte-identical: 13,755 pass / zero fail before and after; zero measured upstream flips/regressions. Local inherited-field gains are not counted as upstream corpus gains.
• Debug seed-one threadfuzz: 400 default + 300 verify programs, zero failures (100,164 ms / 31,095 ms). These verification timings are not performance claims.

The first interrupted full run, accidental valueOf branch deletion (restored verbatim), initial incorrect no-GIL fixture and ENOSPC-interrupted runs remain explicitly excluded from successful evidence.

The local binaries above predate the eight intervening string/error commits. Complete combined-main integration is tracked separately in CI 33187071120; keeping this issue open until that gate completes. The preceding #811 integration is fully green (53 executed jobs), and its ten implemented dependent issues are closed.

Evidence, source/binary hashes, fixtures and full shard logs: /Users/chris/.cache/zig-js-descriptors.i1IFHx. All completed compiler caches are removed; saved binaries are losslessly compressed where appropriate. Retained evidence is about 146 MB. User-owned .codex/ is untouched.

[chrisbbreuer]

Combined-main CI 33187071120 finished 52 jobs successfully with no failed jobs, but its final private-abi-boundary job was cancelled when a newer main run superseded it. This is not a complete green run. The descriptor implementation remains landed and locally validated as recorded above; this issue stays open for terminal combined-main CI. New main 61310f6 also contains the separately tracked Symbol ownership prerequisite #816.

[chrisbbreuer]

Closing with terminal combined-main integration evidence: CI 33211154123 at e24c4fa completed successfully: 53 successful checks, one skipped nightly-only check, zero failed/cancelled checks. The implementation chore: wip is in that revision. This completes the pending integration condition alongside the scoped local/conformance evidence recorded above. Separately discovered Error-intrinsic, Array-realm, prototype-type and restriction-path defects remain open in #823, #824, #825 and #826; this closure does not claim those are fixed.