[GR-64696] Backport to 24.2: Correction of Array.prototype.flat() producing a foreign array.

PullRequest: js/3496

Author: OracleLabsAutomation

graal-js/src/com.oracle.truffle.js.test/js/GR-64108.js

@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
+ */
+
+load("./assert.js")
+
+// Original test-case from the fuzzer
+function f0() {
+    return f0;
+}
+const v1 = [64,-16952,591226145];
+v1[5] = f0;
+v1[3] = v1;
+const v4 = this.Java.to(v1);
+const v5 = v4.flat();
+function f6(a7, a8) {
+    return v4;
+}
+function f9(a10) {
+    return v4;
+}
+f6[Symbol.species] = f9;
+v5.constructor = f6;
+assertThrows(() => v5.flat(), TypeError);
+
+// Simplified test-case
+Object.defineProperty(Array, Symbol.species, { value: Java.type('java.util.ArrayList') });
+assertSameContent([42, 211, -1], [[42, 211], -1].flat());

graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/builtins/ArrayPrototypeBuiltins.java

@@ -2444,7 +2444,7 @@ private static final class InnerFlattenCallNode extends JavaScriptRootNode {
             @Override
             public Object execute(VirtualFrame frame) {
                 Object[] arguments = frame.getArguments();
-                JSDynamicObject resultArray = (JSDynamicObject) arguments[0];
+                Object resultArray = arguments[0];
                 Object element = arguments[1];
                 long elementLen = (long) arguments[2];
                 long targetIndex = (long) arguments[3];