Fix .prototype pollution on JSC by passing JSClass to JSObjectMakeConstructor

[bghgary]

[Created by Copilot on behalf of @bghgary]

Context

Closes #172.

JSC's JSObjectMakeConstructor defaults the constructor's .prototype property to the global Object.prototype when invoked with a null JSClassRef, then installs it with the ReadOnly attribute. That gives us two distinct bugs:

1. Pollution. Every napi-defined class shares Object.prototype. Writing to Foo.prototype.x mutates Object.prototype.x; {} instanceof Foo returns true for every class.
2. Silent failure on retry. The ReadOnly bit means JSObjectSetProperty(constructor, "prototype", ...) cannot overwrite the default afterward — the write is silently dropped (or throws in strict mode).

Fix

Pass the existing per-constructor JSClassRef — the one we already create for the sentinel — into JSObjectMakeConstructor. WebKit then assigns a fresh per-class JSCallbackObject (built from the class's auto-generated prototypeClass) as .prototype, sidestepping both bugs at the source.

The vestigial "extra prototype" hack in ConstructorInfo::Create — kept since #101 with a TODO to remove — goes away. Two ancillary call sites needed a small update because they were reading the [[Prototype]] internal slot when they meant the .prototype property:

• CallAsConstructor chains instance.__proto__ from constructor.prototype (the property), not constructor.__proto__ (the slot = Function.prototype).
• napi_define_class installs instance properties on constructor.prototype via napi_get_named_property. napi_get_prototype keeps its N-API-spec contract of returning the [[Prototype]] slot and is unchanged.

Tests

Added a napi class prototype isolation describe block using Blob (a napi-defined class available on every engine). Six invariants — all standard JS semantics that V8/Chakra already satisfy and that JSC fails today:

• Blob.prototype !== Object.prototype
• Object.getPrototypeOf(Blob.prototype) === Object.prototype
• Blob.prototype.constructor === Blob
• Object.getPrototypeOf(new Blob([])) === Blob.prototype (and instanceof true)
• ({} instanceof Blob) === false
• Writes to Blob.prototype do not appear on {}

Lifecycle note

JSCallbackConstructor does not invoke the JSClass finalize callback; only JSCallbackObject does. The auto-prototype WebKit builds from _class->prototype() uses a separate prototypeClass that explicitly clears finalize. So sharing _class between the constructor, the sentinel, and the auto-prototype carries no double-free risk — only the sentinel ever calls Finalize on our info pointer.

[Copilot]

Pull request overview

This PR fixes a JavaScriptCore-specific N-API class constructor bug where JSObjectMakeConstructor (when passed a null JSClassRef) causes all N-API constructors to share Object.prototype as their .prototype, leading to global prototype pollution and incorrect instanceof behavior. The change ensures each N-API-defined class gets a fresh per-class .prototype object, and updates call sites that incorrectly used the constructor’s [[Prototype]] slot instead of the .prototype property.

Changes:

• Create JSC constructors with a non-null JSClassRef so .prototype is per-class (fixes pollution + read-only .prototype issue).
• Fix instance creation and napi_define_class to use constructor.prototype (property) rather than constructor.__proto__ / [[Prototype]] (slot).
• Add regression tests asserting per-class prototype isolation using Blob.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
Tests/UnitTests/Scripts/tests.ts	Adds regression tests for per-class .prototype isolation and correct instanceof behavior.
Core/Node-API/Source/js_native_api_javascriptcore.cc	Fixes JSC constructor creation to produce a fresh .prototype, and updates prototype usage in constructor calls and napi_define_class.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.