ITStudio_OUC/OxideJS-New
0
1
Fork 0
mirror of https://github.com/pjh456/OxideJS.git synced 2026-10-25 03:01:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Array @@species 绑定并暴露真 [[Construct]]，隐式返回交付当前 this

Browse Source
This commit is contained in:
彭俊皓
2026-09-20 13:07:38 +00:00
parent 28ccbebd52
commit 1a6feadac4
9 changed files with 335 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/oxide_vm/src/bindings/bind_array.rs
+11
View File
@@ -75,4 +75,15 @@ pub fn bind_array(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
let ctor_ptr = session.builtin_world().array_constructor.as_ptr() as *mut JsObject;
bind_constructor!(core, global, "Array", ctor_ptr, oxide_builtins::array::array_constructor::<crate::vm::Vm>, 1, hash: true);
// Array[Symbol.species] 访问器：getter 返回 receiver，派生类沿静态原型链
// 解析 @@species 得自身构造器（规范不给 class 默认 static @@species，类上
// 无 own 属性）。
super::bind_accessor_getter_key(
core,
session,
unsafe { &mut *ctor_ptr },
oxide_types::private_key::make_well_known_symbol_key(oxide_types::private_key::WELL_KNOWN_SYMBOL_SPECIES),
"get [Symbol.species]",
oxide_builtins::array::array_species_get::<crate::vm::Vm> as *const (),
);
}
crates/oxide_vm/src/bindings/mod.rs
+25 -8
View File
@@ -146,31 +146,48 @@ pub(crate) fn apply_binding_table(
}
}
/// 在原型上绑定一个原生访问器 getter（如 Set/Map 的 `size`），set 恒为 undefined。
/// 在原型上绑定一个字符串键的原生访问器 getter（如 Set/Map 的 `size`），
/// set 恒为 undefined。
///
/// # 步骤
/// 1. 构造一个 native getter 函数对象（name 为 `get <prop>`，length 0）。
/// 2. 为属性名开 shape 槽位并写入访问器 meta。
/// 1. 以 `get <prop>` 为 name 标签委托到 [`Self::bind_accessor_getter_key`]。
///
/// # 注意事项
/// getter 函数对象登记进 world 释放表，与 `bind_method` 的方法 wrapper 同一生命周期约定
/// （session 收尾时统一释放）。
pub(crate) fn bind_accessor_getter(
core: &Arc<KernelCore>, session: &KernelSession, proto: &mut JsObject, name: &str, getter_fn: *const (),
) {
let si = core.perm_interner().intern(name).0;
let getter_name = format!("get {name}");
bind_accessor_getter_key(core, session, proto, si, &getter_name, getter_fn)
}
/// 在原型上按任意属性键（字符串 intern 键或 well-known symbol 键）绑定一个
/// 原生访问器 getter，set 恒为 undefined。
///
/// # 步骤
/// 1. 构造一个 native getter 函数对象（name 为 `getter_label`，length 0）。
/// 2. 为键开 shape 槽位并写入访问器 meta（enumerable=false, configurable=true）。
///
/// # 注意事项
/// getter 函数对象登记进 world 释放表，与 `bind_method` 的方法 wrapper 同一生命周期约定
/// （session 收尾时统一释放）。
pub(crate) fn bind_accessor_getter_key(
core: &Arc<KernelCore>, session: &KernelSession, proto: &mut JsObject, key: u32, getter_label: &str,
getter_fn: *const (),
) {
let shape_forge = core.shape_forge().as_ref();
let string_forge = core.perm_interner().as_ref();
let world = session.builtin_world();
let si = string_forge.intern(name).0;
let getter_name = format!("get {name}");
let si_label = string_forge.intern(&getter_name).0;
let si_label = string_forge.intern(getter_label).0;
// SAFETY: getter_fn 是转成 *const () 的 NativeFn 函数项指针。
let getter_fn_ptr = unsafe { oxide_types::object::NativeFnPtr::from_raw(getter_fn) };
// 选择性重建复用：同家族同槽旧 getter 迁移到新 proto 的访问器槽（proto
// 槽已由重建收尾重指），不再新建对象。
let reuse_key =
oxide_kernel::builtin::FnWrapperKey::new(world.wrapper_family_of(proto as *const JsObject), 0, si, si_label);
oxide_kernel::builtin::FnWrapperKey::new(world.wrapper_family_of(proto as *const JsObject), 0, key, si_label);
let getter_ptr = match world.find_fn_wrapper(reuse_key, getter_fn_ptr, 0) {
Some(ptr) => ptr,
None => {
@@ -203,7 +220,7 @@ pub(crate) fn bind_accessor_getter(
};
let getter_val = JsValue::from_js_object(getter_ptr);
let new_shape = shape_forge.make_shape(proto.shape_id(), si);
let new_shape = shape_forge.make_shape(proto.shape_id(), key);
proto.set_shape_id(new_shape);
let pos = proto.push_prop(JsValue::undefined());
proto.set_accessor_meta(pos, getter_val, JsValue::undefined(), PropAttributes::new(true, false, true));
crates/oxide_vm/src/dispatch/call.rs
+15 -23
View File
@@ -580,14 +580,14 @@ impl Vm {
}
if super_obj.native_fn().is_some() {
self.regs[253] = derived_this;
self.regs[254] = super_ctor; // bind_dispatcher 把 regs[254] 当作包装 callee 读取
let (args_buf, len) = Self::build_native_args(first_arg_reg, arg_count, 253);
// SAFETY: native_fn 经 set_native_fn 以合法 NativeFn 指针设置；
// native_fn_ptr_to_fn 是 NativeFnPtr → NativeFn 的唯一强制转换点。
let func: NativeFn = unsafe { native_fn_ptr_to_fn(super_obj.native_fn().unwrap()) };
match func(self, &args_buf[..len]) {
NativeResult::Ok(val) => {
// 实参先物化再走同步调用收口：native 调用协议把 253/254 槽固定为
// receiver/callee，实参寄存器（颜色 ≤253）占位 253 时裸引用会被覆写
// （与 SUPER_CALL_SPREAD 路径同形）。
let args: Vec<JsValue> = (0..arg_count)
.map(|i| self.regs[first_arg_reg.wrapping_add(i as u8) as usize])
.collect();
match self.call_function_sync(super_ctor, derived_this, &args) {
Ok(val) => {
// super() 返回实例的 [[Prototype]] 须设为 new.target.prototype
//（native 构造器不知道 new.target，由调用方设置）。
let instance = if val.is_object() { val } else { derived_this };
@@ -598,26 +598,18 @@ impl Vm {
self.regs[rd] = self.regs[254];
self.mark_super_called();
}
NativeResult::Err(err_val) => {
self.exception_value = Some(err_val);
self.pending_error_kind = Some(self.thrown_error_kind(err_val));
Err(_) => {
let exc = self
.last_uncaught_value
.take()
.unwrap_or_else(|| oxide_builtins::error::create_error(self, "super() call failed"));
self.exception_value = Some(exc);
self.pending_error_kind = Some(self.thrown_error_kind(exc));
match self.unwind() {
Ok(()) => return Ok(true),
Err(e) => return Err(e),
}
}
NativeResult::TailCall { callee, this, args } => {
// 如 bound 函数：解析尾调用，用其返回值作为构造实例
// （或回退到 derived_this）。
let val = self.call_function_sync(callee, this, &args)?;
let instance = if val.is_object() { val } else { derived_this };
if instance.is_object() {
self.set_constructed_proto(instance, new_target_obj)?;
}
self.regs[254] = instance;
self.regs[rd] = self.regs[254];
self.mark_super_called();
}
}
} else if super_obj.sub_module_index() > 0 {
let sub_idx = super_obj.sub_module_index() as usize;
crates/oxide_vm/src/promise/constructor.rs
+5 -1
View File
@@ -42,7 +42,11 @@ impl Vm {
/// 构造调用（Construct(C, args)）：native 构造器值传递调用，bytecode 构造器
/// 压构造帧执行（含 derived 构造器 super() 语义），返回值非对象时回退到新对象。
pub(super) fn construct_ctor(&mut self, ctor: JsValue, args: &[JsValue]) -> Result<JsValue, JsValue> {
///
/// # 边界与前提
/// - `ctor` 非可构造值（箭头 / 非构造 native / 普通值）返回 TypeError 的 `Err`；
/// 消费 `last_uncaught_value`，调用方不得再取槽。
pub(crate) fn construct_ctor(&mut self, ctor: JsValue, args: &[JsValue]) -> Result<JsValue, JsValue> {
// IsConstructor 校验：arrow / 非构造 native / 普通值拒绝。
if !is_constructor_value(ctor) {
return Err(oxide_builtins::error::create_type_error(self, "constructor is not a constructor"));
crates/oxide_vm/src/vm/vmhost.rs
+3
View File
@@ -130,6 +130,9 @@ impl oxide_runtime_api::VmHost for Vm {
fn call_function_sync(&mut self, callee: JsValue, receiver: JsValue, args: &[JsValue]) -> Result<JsValue, String> {
self.call_function_sync(callee, receiver, args)
}
fn construct_ctor(&mut self, ctor: JsValue, args: &[JsValue]) -> Result<JsValue, JsValue> {
Vm::construct_ctor(self, ctor, args)
}
fn checked_object_ptr(&mut self, val: JsValue, error_msg: &str) -> Result<Option<*mut JsObject>, String> {
self.checked_object_ptr(val, error_msg)
}
crates/oxide_vm/src/vm_dispatch_ctrl.rs
+12 -2
View File
@@ -741,16 +741,26 @@ impl Vm {
let is_derived_constructor = frame.is_derived_constructor;
let super_called = frame.super_called;
let continuation = frame.continuation;
// 隐式返回交付当前 this 绑定：super() 已把 regs[254] 换为父构造器新建
// 的实例，restore_frame 会把压帧期旧值回写 regs[254]，须先取。
let current_this = self.regs[254];
vm_trace!("RETURN frame: continuation={:?}, derived={}", continuation, is_derived_constructor);
self.restore_frame(frame);
if let (Some(target_reg), Some(constructed_this)) = (construct_result_reg, constructed_this) {
// 规范 §9.2.2.2：derived 构造器返回非对象值（含 undefined/null/原始值）
// 且未调用 super() 时抛 ReferenceError；调过 super() 则回退构造 this。
// 且未调用 super() 时抛 ReferenceError；调过 super() 则回退当前 this
// （super 已将其换为父构造器实例，构造 this 仅作非对象兜底）。
if is_derived_constructor && !result.is_object() && !super_called {
self.raise_error_kind("ReferenceError", "derived constructor must call super()")?;
return Ok(None);
}
self.regs[target_reg as usize] = if result.is_object() { result } else { constructed_this };
self.regs[target_reg as usize] = if result.is_object() {
result
} else if current_this.is_object() {
current_this
} else {
constructed_this
};
self.regs[0] = self.regs[target_reg as usize];
vm_trace!("RETURN constructor: target_reg={} regs[0]={:?}", target_reg, self.regs[0]);
} else {