runtime/array: fix Array instance prototype, length, and indexed-property semantics

[andrewtdiz]

Summary

Current Test262 (c262) launch triage still shows arrays failing on core runtime semantics: Array() / new Array() / array literals do not consistently behave like real Array exotic objects. This shows up as wrong length, missing indexed own properties, missing Array.prototype behavior, and incorrect prototype/class checks.

Evidence

Run from origin/main at 1f6d20e19 on 2026-06-01, Node v25.9.0, Test262 4249661388e5d3f92a85186213da140a6481490f:

scripts/test262_subset.py --root /tmp/perry-test262-4249661 --dir built-ins/Array --max 180 --timeout 10 --sample-cap 50 --report /tmp/perry-c262-builtins-array.json
scripts/test262_subset.py --root /tmp/perry-test262-4249661 --dir language/expressions --max 250 --timeout 10 --sample-cap 40 --report /tmp/perry-c262-language-expressions.json

Observed:

• built-ins/Array: 76 pass, 104 runtime-fail, 0 compile-fail, 42.2% sample parity.
• language/expressions: 195 pass, 51 runtime-fail, 4 compile-fail, 78.0% sample parity; many failures are array-literal/prototype fallout.

Representative failures:

• built-ins/Array/S15.4.1_A2.1_T1.js: Array(0, 1, 0, 1).length expected 4, Perry reports 0.
• built-ins/Array/15.4.5.1-5-2.js: a.length expected 3, Perry reports 193.
• built-ins/Array/S15.4.1_A1.1_T2.js: Array().toString() expected [object Array], Perry reports empty string.
• language/expressions/array/S11.1.4_A1.1.js: array literal .toString === Array.prototype.toString, Perry reports undefined.
• built-ins/Array/isArray/15.4.3.2-0-5.js: Array.isArray(Array.prototype) expected true, Perry reports false.

Product triage

User outcome: ordinary package and app code can trust arrays for construction, reflection, serialization, indexed writes, and length-sensitive logic.

Shortest path: fix Array exotic object allocation and update rules first, before widening into every Array prototype method tail.

Manual/narrow assumptions to test: a small c262 slice plus hand probes for Array(), new Array(), literals, holes, 4294967295, non-index properties, hasOwnProperty, toString, and Array.isArray(Array.prototype) should catch the main regression class.

Core vs nice: core is prototype identity, length/index invariants, own indexed property visibility, and array-literal parity. Nice later work is method-specific descriptor polish already tracked separately.

Keep flexible: the fix should leave room for shared exotic-object hooks used by TypedArray/String wrappers instead of baking all behavior into codegen call sites.

Suggested scope

• Allocate Array() / new Array() / array literals with Array.prototype and the correct object tag/prototype chain.
• Implement array length/index rules for numeric index writes, holes, non-index keys, and the 2^32 - 1 boundary.
• Ensure indexed elements and non-index properties are visible through hasOwnProperty, Object.getOwnPropertyDescriptor, and normal property lookup.
• Keep iterator abrupt-completion work linked to runtime: propagate abrupt completions through array spread iteration #3565 and builtin name/length descriptor work linked to runtime: complete own name/length descriptors on builtins (follow-on to closed #3143) #3655 rather than hiding those in this fix.

Acceptance criteria

• The representative rows above pass under the Test262 differential.
• built-ins/Array --max 180 improves materially without relying on skiplist changes.
• Existing Perry parity fixtures for normal arrays continue to pass.

[proggeramlug]

Partial fix in #4013 (v0.5.1078): the multi-arg Array(...) / new Array(...) element-list form now works.

Array(0,1,0,1) and new Array(1,2,3) returned a length-0 array — lower_builtin_new's Array arm handled empty/single-number/single-value but returned Ok(None) for ≥2 args, falling back to a generic path that produced an empty array. It now delegates multi-arg to the array-literal lowering, so Array(0,1,0,1) → [0,1,0,1], new Array(1,2,3) → [1,2,3] (both call and new forms), matching Node. Array(5) (sparse length), Array(), and Array("only") are unchanged.

Still open here (the foundational Array-exotic-object rework): prototype identity ([].toString === Array.prototype.toString → currently false), Array.isArray(Array.prototype) → currently false, and the length/index/own-property invariants for the exotic-object semantics.