Two levels of dynamic parent (mixin of a mixin) with an own constructor SIGSEGVs #9079

Two levels of dynamic parent — a mixin applied to a mixin — SIGSEGVs when the leaf class has its own constructor.

Reproducer

class Root { r = 1; }
function mixin(Base: any) { return class extends Base { m() { return 1; } }; }
const Mixed  = mixin(Root);
const Mixed2 = mixin(Mixed);          // second level is what breaks it
class Deep extends Mixed2 { d = 4; constructor() { super(); } }
console.log(new Deep().d);

node:  4
perry: exit 139 (SIGSEGV)

One level works. class Leaf extends mixin(Root) { d = 4; constructor() { super(); } } is correct as of #9073.

Pre-existing, not #9073

Found while auditing #9073 (which fixes single-level dynamic-parent double field initialization), so I A/B'd before attributing. Both --profile perry-dev builds of -p perry -p perry-runtime-static -p perry-stdlib-static, compiled with PERRY_NO_AUTO_OPTIMIZE=1:

So #9073 neither causes nor worsens it; it fixes the one-level case and does not extend to the recursive one.

Why it matters

Mixin composition is normally written as a chain — compose(A, B, C) or A(B(C(Base))) — so the two-level shape is the common case in real code rather than an edge case, and one level working makes the failure look arbitrary. It is also a crash rather than a wrong value, so it is not silently survivable.

Not investigated: whether the crash needs the leaf's own constructor (as in #9073's cause), whether it needs a field initializer, or how it interacts with private fields and brands. Those are the first things to vary.

Node oracle is the pinned v26.5.1.