fix: pending_length_exception 登记 GC 根遍历与搬移重写

crates/oxide_vm/src/session_gc/tests.rs

@@ -40,6 +40,17 @@ fn uncaught_value_is_gc_root() {
     assert!(has_ptr(&roots, session));
 }
 
+#[test]
+fn pending_length_exception_is_gc_root() {
+    let mut vm = Vm::new();
+    let obj = plain_object(&mut vm);
+    let session = vm.promote_object(obj);
+    vm.pending_length_exception = Some(JsValue::from_js_object(session));
+    let mut roots = Vec::new();
+    vm.for_each_root(|v| roots.push(v));
+    assert!(has_ptr(&roots, session));
+}
+
 #[test]
 fn suspended_signal_fields_are_roots() {
     let mut vm = Vm::new();

crates/oxide_vm/src/vm/gc_hooks.rs

@@ -53,6 +53,7 @@ impl Vm {
         f(self.exception_value.unwrap_or(JsValue::undefined()));
         f(self.pending_exception.unwrap_or(JsValue::undefined()));
         f(self.last_uncaught_value.unwrap_or(JsValue::undefined()));
+        f(self.pending_length_exception.unwrap_or(JsValue::undefined()));
         // 悬挂的 return 完成持有返回值，是 GC 根。
         if let Some(Completion::Return { value, .. }) = self.pending_completion {
             f(value);
@@ -118,6 +119,7 @@ impl Vm {
         self.exception_value = self.exception_value.map(&mut rewrite);
         self.pending_exception = self.pending_exception.map(&mut rewrite);
         self.last_uncaught_value = self.last_uncaught_value.map(&mut rewrite);
+        self.pending_length_exception = self.pending_length_exception.map(&mut rewrite);
         for cached in self.template_objects.values_mut() {
             *cached = rewrite(*cached);
         }