fix: honor V8 native instance prototype accessors

DjDeveloperr · DjDeveloperr · commit dc038a4fe0cc · 2026-06-30T03:57:54.000-04:00
diff --git a/NativeScript/ffi/v8/NativeApiV8HostObjects.mm b/NativeScript/ffi/v8/NativeApiV8HostObjects.mm
@@ -47,6 +47,101 @@ void emplace(size_t index, Value&& value) {
   alignas(Value) unsigned char inlineStorage_[sizeof(Value) * InlineCount];
 };
 
+bool findPrototypeDescriptor(Runtime& runtime, v8::Local<v8::Object> object,
+                             v8::Local<v8::Name> property,
+                             v8::Local<v8::Object>* descriptorOut) {
+  v8::TryCatch tryCatch(runtime.isolate());
+  v8::Local<v8::Value> currentValue = object->GetPrototypeV2();
+  for (size_t depth = 0; depth < 64 && currentValue->IsObject(); depth++) {
+    v8::Local<v8::Object> current = currentValue.As<v8::Object>();
+    v8::Local<v8::Value> descriptorValue;
+    if (!current->GetOwnPropertyDescriptor(runtime.context(), property)
+             .ToLocal(&descriptorValue)) {
+      throw JSError(runtime,
+                    currentExceptionMessage(runtime.isolate(), tryCatch));
+    }
+    if (descriptorValue->IsObject()) {
+      *descriptorOut = descriptorValue.As<v8::Object>();
+      return true;
+    }
+    currentValue = current->GetPrototypeV2();
+  }
+  return false;
+}
+
+bool tryResolvePrototypeGet(Runtime& runtime, v8::Local<v8::Object> object,
+                            v8::Local<v8::Object> receiver,
+                            v8::Local<v8::Name> property,
+                            v8::Local<v8::Value>* resultOut) {
+  v8::Local<v8::Object> descriptor;
+  if (!findPrototypeDescriptor(runtime, object, property, &descriptor)) {
+    return false;
+  }
+
+  v8::TryCatch tryCatch(runtime.isolate());
+  v8::Local<v8::String> getKey = makeV8String(runtime.isolate(), "get");
+  v8::Local<v8::Value> getterValue;
+  if (!descriptor->Get(runtime.context(), getKey).ToLocal(&getterValue)) {
+    throw JSError(runtime, currentExceptionMessage(runtime.isolate(), tryCatch));
+  }
+  if (getterValue->IsFunction()) {
+    v8::Local<v8::Value> result;
+    if (!getterValue.As<v8::Function>()
+             ->Call(runtime.context(), receiver, 0, nullptr)
+             .ToLocal(&result)) {
+      throw JSError(runtime,
+                    currentExceptionMessage(runtime.isolate(), tryCatch));
+    }
+    *resultOut = result;
+    return true;
+  }
+
+  v8::Local<v8::String> valueKey = makeV8String(runtime.isolate(), "value");
+  bool hasValue =
+      descriptor->HasOwnProperty(runtime.context(), valueKey).FromMaybe(false);
+  if (hasValue) {
+    v8::Local<v8::Value> value;
+    if (!descriptor->Get(runtime.context(), valueKey).ToLocal(&value)) {
+      throw JSError(runtime,
+                    currentExceptionMessage(runtime.isolate(), tryCatch));
+    }
+    *resultOut = value;
+    return true;
+  }
+
+  *resultOut = v8::Undefined(runtime.isolate());
+  return true;
+}
+
+bool tryInvokePrototypeSetter(Runtime& runtime, v8::Local<v8::Object> object,
+                              v8::Local<v8::Object> receiver,
+                              v8::Local<v8::Name> property,
+                              v8::Local<v8::Value> value) {
+  v8::Local<v8::Object> descriptor;
+  if (!findPrototypeDescriptor(runtime, object, property, &descriptor)) {
+    return false;
+  }
+
+  v8::TryCatch tryCatch(runtime.isolate());
+  v8::Local<v8::String> setKey = makeV8String(runtime.isolate(), "set");
+  v8::Local<v8::Value> setterValue;
+  if (!descriptor->Get(runtime.context(), setKey).ToLocal(&setterValue)) {
+    throw JSError(runtime, currentExceptionMessage(runtime.isolate(), tryCatch));
+  }
+  if (!setterValue->IsFunction()) {
+    return false;
+  }
+
+  v8::Local<v8::Value> args[] = {value};
+  v8::Local<v8::Value> ignored;
+  if (!setterValue.As<v8::Function>()
+           ->Call(runtime.context(), receiver, 1, args)
+           .ToLocal(&ignored)) {
+    throw JSError(runtime, currentExceptionMessage(runtime.isolate(), tryCatch));
+  }
+  return true;
+}
+
 v8::Local<v8::ObjectTemplate> hostObjectTemplate(Runtime& runtime) {
   auto state = runtime.state();
   if (state->hostObjectTemplate.IsEmpty()) {
@@ -251,6 +346,15 @@ void emplace(size_t index, Value&& value) {
             if (*utf8 == nullptr) {
               return v8::Intercepted::kNo;
             }
+            v8::Local<v8::Object> holderObject = info.Holder();
+            v8::Local<v8::Object> receiver =
+                info.This()->IsObject() ? info.This().As<v8::Object>() : holderObject;
+            v8::Local<v8::Value> prototypeResult;
+            if (tryResolvePrototypeGet(runtime, holderObject, receiver,
+                                       property, &prototypeResult)) {
+              info.GetReturnValue().Set(prototypeResult);
+              return v8::Intercepted::kYes;
+            }
             Value result = holder->hostObject->get(
                 runtime, PropNameID(std::string(*utf8, utf8.length())));
             if (!result.isUndefined()) {
@@ -280,6 +384,13 @@ void emplace(size_t index, Value&& value) {
             if (*utf8 == nullptr) {
               return v8::Intercepted::kNo;
             }
+            v8::Local<v8::Object> holderObject = info.Holder();
+            v8::Local<v8::Object> receiver =
+                info.This()->IsObject() ? info.This().As<v8::Object>() : holderObject;
+            if (tryInvokePrototypeSetter(runtime, holderObject, receiver,
+                                         property, value)) {
+              return v8::Intercepted::kYes;
+            }
             bool handled = holder->hostObject->set(
                 runtime, PropNameID(std::string(*utf8, utf8.length())),
                 Value(runtime, value));
diff --git a/PROGRESS.md b/PROGRESS.md
@@ -17,6 +17,45 @@ TypeScript/UI worklets.
 
 ## Latest Update - 2026-06-30
 
+### 2026-06-30 03:57 EDT - V8 native instance interceptors honor JS prototype accessors
+
+- Scope check:
+  - Still generic NativeScript runtime behavior required by the RN-module
+    branch. No RNS-specific native implementation and no direct-engine backend
+    refactor work.
+  - Simulator-only rule remains active; no physical devices were used.
+- CI finding:
+  - GitHub Actions run `28427007755` on `30871198` kept setup, FFI boundary
+    check, native build, CLI build, and macOS tests green.
+  - iOS still had the same single failure:
+    `ApiTests.js SpecialCaseProperty_When_CustomSelector_ImplementedInJS`.
+  - The shared host-object prototype fallback did not affect the V8 native
+    instance path. V8 native instances use `kNonMasking` named property
+    interceptors, so that interceptor must explicitly honor JS prototype
+    accessors before dispatching into the native host object.
+- Change:
+  - `NativeApiV8HostObjects.mm` now walks the native instance JS prototype
+    chain with `GetOwnPropertyDescriptor`.
+  - The native object named getter calls a JS prototype getter, or returns a
+    prototype data descriptor value, before falling back to
+    `holder->hostObject->get`.
+  - The native object named setter calls a JS prototype setter before falling
+    back to `holder->hostObject->set`.
+  - Source coverage now guards that this precedence is attached to the V8
+    native object template, not the generic host object template.
+- Verification:
+  - Focused V8/native-interceptor source guard passed:
+    `node packages/react-native/test/runtime-instance-selector-base-dispatch.test.js`.
+  - Runtime RN JS tests passed:
+    `for f in packages/react-native/test/*.test.js; do node "$f" || exit 1; done`.
+  - `git diff --check` passed.
+  - `npm run check:ffi-boundaries` passed.
+  - Existing generated macOS project compile/link passed with
+    `xcodebuild -project dist/intermediates/macos/NativeScript.xcodeproj ...`.
+- Still next:
+  - Commit/push this V8 native-interceptor fix and watch fresh PR CI. If iOS
+    goes green, resume the RNS simulator parity sweep from this handoff.
+
 ### 2026-06-30 03:12 EDT - JS subclass accessors use registered class prototype fallback
 
 - Scope check:
diff --git a/packages/react-native/test/runtime-instance-selector-base-dispatch.test.js b/packages/react-native/test/runtime-instance-selector-base-dispatch.test.js
@@ -204,6 +204,63 @@ for (const relativePath of [
   );
 }
 
+{
+  const relativePath = "NativeScript/ffi/v8/NativeApiV8HostObjects.mm";
+  const source = fs.readFileSync(path.join(repoRoot, relativePath), "utf8");
+  const hostTemplateStart = source.indexOf(
+    "v8::Local<v8::ObjectTemplate> hostObjectTemplate",
+  );
+  const hostTemplateEnd = source.indexOf(
+    "state->hostObjectTemplate.Reset",
+    hostTemplateStart,
+  );
+  const nativeTemplateStart = source.indexOf(
+    "v8::Local<v8::ObjectTemplate> nativeObjectTemplate",
+  );
+  const nativeTemplateEnd = source.indexOf(
+    "state->nativeObjectTemplate.Reset",
+    nativeTemplateStart,
+  );
+  const hostTemplate = source.slice(hostTemplateStart, hostTemplateEnd);
+  const nativeTemplate = source.slice(nativeTemplateStart, nativeTemplateEnd);
+  const getterIndex = nativeTemplate.indexOf(
+    "tryResolvePrototypeGet(runtime, holderObject, receiver",
+  );
+  const nativeGetIndex = nativeTemplate.indexOf(
+    "holder->hostObject->get",
+    getterIndex,
+  );
+  const setterIndex = nativeTemplate.indexOf(
+    "tryInvokePrototypeSetter(runtime, holderObject, receiver",
+  );
+  const nativeSetIndex = nativeTemplate.indexOf(
+    "holder->hostObject->set",
+    setterIndex,
+  );
+
+  assert(
+    source.includes("GetPrototypeV2") &&
+      source.includes("GetOwnPropertyDescriptor") &&
+      source.includes("tryResolvePrototypeGet") &&
+      source.includes("tryInvokePrototypeSetter") &&
+      nativeTemplate.includes("v8::PropertyHandlerFlags::kNonMasking"),
+    `${relativePath}: V8 native object interceptors should inspect JS prototype descriptors despite kNonMasking handlers`,
+  );
+  assert(
+    getterIndex !== -1 &&
+      nativeGetIndex !== -1 &&
+      getterIndex < nativeGetIndex &&
+      setterIndex !== -1 &&
+      nativeSetIndex !== -1 &&
+      setterIndex < nativeSetIndex,
+    `${relativePath}: V8 native object interceptors should honor JS prototype accessors before native host dispatch`,
+  );
+  assert(
+    !hostTemplate.includes("tryResolvePrototypeGet(runtime, holderObject, receiver"),
+    `${relativePath}: JS prototype accessor precedence should be scoped to native object instances, not generic host objects`,
+  );
+}
+
 for (const relativePath of [
   "NativeScript/ffi/shared/bridge/HostObjects.mm",
   "packages/react-native/native-api/ffi/shared/bridge/HostObjects.mm",
