fix: Buffer own-property reads via dynamic key (#6412) and shadowed folded read intrinsic (#6405)

crates/perry-codegen/src/codegen/closure.rs

@@ -907,6 +907,7 @@ pub(super) fn compile_closure(
         native_arena_owner_aliases: HashMap::new(),
         native_arena_ambiguous_owner_aliases: HashSet::new(),
         disable_buffer_fast_path: cross_module.disable_buffer_fast_path,
+        program_shadows_buffer_read_method: cross_module.program_shadows_buffer_read_method,
         min_length_bounds: HashMap::new(),
         bounded_buffer_index_pairs: Vec::new(),
         guarded_buffer_index_pairs: Vec::new(),

crates/perry-codegen/src/codegen/entry.rs

@@ -731,6 +731,7 @@ pub(super) fn compile_module_entry(
             native_arena_owner_aliases: HashMap::new(),
             native_arena_ambiguous_owner_aliases: HashSet::new(),
             disable_buffer_fast_path: cross_module.disable_buffer_fast_path,
+            program_shadows_buffer_read_method: cross_module.program_shadows_buffer_read_method,
             min_length_bounds: HashMap::new(),
             bounded_buffer_index_pairs: Vec::new(),
             guarded_buffer_index_pairs: Vec::new(),
@@ -1298,6 +1299,7 @@ pub(super) fn compile_module_entry(
             native_arena_owner_aliases: HashMap::new(),
             native_arena_ambiguous_owner_aliases: HashSet::new(),
             disable_buffer_fast_path: cross_module.disable_buffer_fast_path,
+            program_shadows_buffer_read_method: cross_module.program_shadows_buffer_read_method,
             min_length_bounds: HashMap::new(),
             bounded_buffer_index_pairs: Vec::new(),
             guarded_buffer_index_pairs: Vec::new(),

crates/perry-codegen/src/codegen/function.rs

@@ -614,6 +614,7 @@ pub(super) fn compile_function(
         native_arena_owner_aliases: HashMap::new(),
         native_arena_ambiguous_owner_aliases: HashSet::new(),
         disable_buffer_fast_path: cross_module.disable_buffer_fast_path,
+        program_shadows_buffer_read_method: cross_module.program_shadows_buffer_read_method,
         min_length_bounds: HashMap::new(),
         bounded_buffer_index_pairs: Vec::new(),
         guarded_buffer_index_pairs: Vec::new(),

crates/perry-codegen/src/codegen/method.rs

@@ -532,6 +532,7 @@ pub(super) fn compile_method(
         native_arena_owner_aliases: HashMap::new(),
         native_arena_ambiguous_owner_aliases: HashSet::new(),
         disable_buffer_fast_path: cross_module.disable_buffer_fast_path,
+        program_shadows_buffer_read_method: cross_module.program_shadows_buffer_read_method,
         min_length_bounds: HashMap::new(),
         bounded_buffer_index_pairs: Vec::new(),
         guarded_buffer_index_pairs: Vec::new(),
@@ -1526,6 +1527,7 @@ pub(super) fn compile_static_method(
         native_arena_owner_aliases: HashMap::new(),
         native_arena_ambiguous_owner_aliases: HashSet::new(),
         disable_buffer_fast_path: cross_module.disable_buffer_fast_path,
+        program_shadows_buffer_read_method: cross_module.program_shadows_buffer_read_method,
         min_length_bounds: HashMap::new(),
         bounded_buffer_index_pairs: Vec::new(),
         guarded_buffer_index_pairs: Vec::new(),

crates/perry-codegen/src/codegen/mod.rs

@@ -1578,6 +1578,8 @@ pub fn compile_module(hir: &HirModule, opts: CompileOptions) -> Result<Vec<u8>>
         compiler_private_async_i32_control_locals,
         compiler_private_async_i1_control_locals,
         disable_buffer_fast_path,
+        program_shadows_buffer_read_method:
+            crate::lower_call::buffer_intrinsic::module_shadows_buffer_read_method(hir),
         flat_const_arrays: {
             // Issue #50: fold module-level `const X: number[][] = [[int, ...], ...]`
             // into a flat `[N x i32]` LLVM constant so `X[i][j]` / `krow[j]` can

crates/perry-codegen/src/codegen/opts.rs

@@ -812,6 +812,10 @@ pub(crate) struct CrossModuleCtx {
     /// Debug/benchmark switch that forces Buffer/Uint8Array accesses through
     /// the generic helper path.
     pub disable_buffer_fast_path: bool,
+    /// #6405: set when this module assigns a Buffer numeric read-method name as
+    /// an own property (`buf.readUInt8 = fn`). Threaded into every FnCtx so the
+    /// inline read intrinsic deopts to own-prop-aware runtime dispatch.
+    pub program_shadows_buffer_read_method: bool,
     /// (Issue #50) Module-level `const` 2D int arrays folded into flat
     /// `[N x i32]` LLVM constants. Maps local_id → info. Populated by
     /// scanning `hir.init`; threaded through every FnCtx so the IndexGet

crates/perry-codegen/src/expr/mod.rs

@@ -997,6 +997,12 @@ pub(crate) struct FnCtx<'a> {
     /// Benchmark/debug switch that forces tracked buffers through the existing
     /// helper fallback instead of native GEP/load/store lowering.
     pub disable_buffer_fast_path: bool,
+    /// #6405: this module assigns a Buffer numeric read-method name as an own
+    /// property somewhere (`buf.readUInt8 = fn`), so an own prop may shadow the
+    /// prototype method. When set, `try_emit_buffer_read_intrinsic` deopts the
+    /// inline byte-load fold to the own-prop-aware runtime dispatch. False for
+    /// every program that never shadows a Buffer method (the common case).
+    pub program_shadows_buffer_read_method: bool,
     /// LocalId facts of the form `n = min(src.length, dst.length)`.
     pub min_length_bounds: std::collections::HashMap<u32, Vec<u32>>,
     /// Loop-local facts proving a buffer index is bounded inside the current