codegen: scalar replacement drops runtime-installed own properties — class X extends EventEmitter { a = 1 } reads typeof x.emit as undefined #6343

Summary

Escape analysis scalar-replaces a class instance that "never escapes", but the promotion is blind to own properties installed at runtime by the native base's subclass-init. Reading a declared field alongside a native method makes the method read undefined.

Confirmed on clean origin/main. No override, no indirection — a direct extends EventEmitter with one field is enough.

Repro

import { EventEmitter } from "node:events";

class X extends EventEmitter {
  a = 1;                       // <- a declared field is load-bearing
}

const x = new X();
console.log("field:", x.a, "typeof emit:", typeof x.emit, "typeof on:", typeof x.on);

Drop the field (class X extends EventEmitter {}) and the methods reappear — the instance then escapes / isn't promoted.

Mechanism

EventEmitter (and the node:stream classes) install their method surface as own properties on the instance at subclass-init time (install_methods_on_existing_object -> js_object_set_field_by_name(obj, "emit", <native closure>)), rather than on a prototype.

When the instance is proven non-escaping, scalar replacement promotes its declared fields to scalars — and a runtime-installed own property has no declared slot, so it simply isn't in the promoted set. The subsequent x.emit read resolves against the scalarized object and finds nothing.

Relationship to other issues

• compile-smoke broken on main: issue-945 scalar-method IR guard fails (ownMethodWrite scalarized) — suspect #5466 #5872 / PR fix(codegen): scalar replacement ignored own-method writes and prototype mutation (#5872) #6324 fixed a sibling defect in the same analysis: scalar replacement ignored own-method writes and prototype mutation. This is the third member of that family — runtime-installed native surface — and is not covered by that fix.
• runtime: a subclass method overriding a native base method (EventEmitter.emit) is silently bypassed — override never runs #6316 / PR fix(runtime): a subclass override of a native base method must win over the native surface (#6316) #6322 (subclass override bypassed) and the native-base chain work in PR fix(codegen): resolve a native base class by class CHAIN, not by extends name (#6325, #6326, #6336) #6342 are orthogonal: this reproduces with no override and on a direct subclass.

Fix direction

The escape/scalar-replacement decision must treat "this class's chain reaches a native base that installs an instance surface" as a disqualifier (or the promoted set must include runtime-installed own keys). Note PR #6324's guard is precise rather than a blanket disable — follow that shape; do not simply switch scalar replacement off, which would give back a real perf win.

The scripts/run_issue_945_scalar_method_ir_guard.sh IR guard and test-files/test_issue_945_scalar_method_guards.ts are the existing harness for this analysis.