From 21b99a98c9bb95c7be4934d76aa03bbc51276359 Mon Sep 17 00:00:00 2001
From: pjh456 <147148383@qq.com>
Date: Fri, 25 Sep 2026 15:54:03 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=95=B0=E7=BB=84=E8=BF=AD=E4=BB=A3?=
 =?UTF-8?q?=E5=99=A8=20next=20=E6=A0=A1=E9=AA=8C=20own=20=E5=86=85?=
 =?UTF-8?q?=E9=83=A8=E6=A7=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/oxide_builtins/src/array/sort_iterator.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/crates/oxide_builtins/src/array/sort_iterator.rs b/crates/oxide_builtins/src/array/sort_iterator.rs
index 0af6feee..3b2dc305 100644
--- a/crates/oxide_builtins/src/array/sort_iterator.rs
+++ b/crates/oxide_builtins/src/array/sort_iterator.rs
@@ -189,6 +189,11 @@ pub fn array_iterator_next<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     let target_si = vm.kernel_core().perm_interner().intern(ARRAY_ITER_TARGET_PROP).0;
     let index_si = vm.kernel_core().perm_interner().intern(ARRAY_ITER_INDEX_PROP).0;
     let kind_si = vm.kernel_core().perm_interner().intern(ARRAY_ITER_KIND_PROP).0;
+    // 内部槽守卫：无 own __target__ 槽的对象（如 Object.create 产物）不是数组
+    // 迭代器，不得沿原型链读底层迭代器的槽；三槽同批写入，查一槽即全查。
+    if vm.get_own_property_slot(&*iter, target_si).is_none() {
+        return NativeResult::Err(array_type_error(vm, "Array Iterator next called on non-iterator"));
+    }
     let target = match vm.ordinary_get(iter, target_si, this_val) {
         Ok(v) if v.is_undefined() => {
             return NativeResult::Ok(crate::iterator::make_iter_result(vm, JsValue::undefined(), true));