fix: TA 共享原型父链回退 Object.prototype 对齐规范

crates/oxide_vm/tests/builtins_typed_array_base64_tests.rs

@@ -361,8 +361,10 @@ fn typed_array_prototype_to_string_chain() {
             var d = Object.getOwnPropertyDescriptor(TypedArray.prototype, "toString");
             if (d === undefined) return "not own";
             if (d.writable !== true || d.enumerable !== false || d.configurable !== true) return "attrs";
-            // proto 链接 Array.prototype。
-            if (Object.getPrototypeOf(TypedArray.prototype) !== Array.prototype) return "chain";
+            // proto 链接 Object.prototype，不继承 Array.prototype。
+            if (Object.getPrototypeOf(TypedArray.prototype) !== Object.prototype) return "chain";
+            if (new Int8Array(1) instanceof Array) return "instanceof";
+            if (Int8Array.prototype.push !== undefined) return "inherited";
             // 实例 toString 走 Array 语义（经 TA 自身 join）。
             if (new Uint8Array([1, 2, 3]).toString() !== "1,2,3") return "instance";
             if (new Int16Array([7]).toString() !== "7") return "instance16";

crates/oxide_vm/tests/builtins_typed_array_tests.rs

@@ -150,8 +150,14 @@ fn typed_array_bigint_fill_with_number_throws() {
 #[test]
 fn typed_array_to_string_is_identifiable() {
     let mut vm = Vm::new();
-    let result = eval(&mut vm, "var ta = new Uint8Array(1); ta.toString()").unwrap();
-    assert_eq!(to_str(&vm, result), "[object Uint8Array]");
+    // own toString 走 Array join 语义（Uint8Array(1) → "0")；
+    // @@toStringTag 经 Object.prototype.toString 仍可辨识。
+    let result = eval(
+        &mut vm,
+        "var ta = new Uint8Array(1); Object.prototype.toString.call(ta) + \";\" + ta.toString()",
+    )
+    .unwrap();
+    assert_eq!(to_str(&vm, result), "[object Uint8Array];0");
 }
 
 #[test]