fix: 修复全局边界安全与内存稳定性问题

crates/oxide_vm/src/dispatch/call.rs

@@ -21,7 +21,7 @@ impl Vm {
         &mut self, obj: &JsObject, callee: JsValue, this_reg: u8, first_arg_reg: u8, arg_count: usize,
     ) -> Result<(), String> {
         if self.native_call_depth >= self.kernel_core.config.max_call_depth {
-            return Err("RangeError: Maximum call stack size exceeded".into());
+            return self.raise_error_kind("RangeError", "Maximum call stack size exceeded");
         }
         let (args_buf, len) = Self::build_native_args(first_arg_reg, arg_count, this_reg);
         let args_slice = &args_buf[..len];

crates/oxide_vm/src/dispatch/property.rs

@@ -5,7 +5,7 @@ use oxide_types::object::JsObject;
 use oxide_types::private_key::make_private_name_id;
 use oxide_types::value::JsValue;
 
-use crate::vm::Vm;
+use crate::vm::{Vm, MAX_PROTO_CHAIN_DEPTH};
 
 #[inline(always)]
 fn ic_get_hit(obj: &JsObject, shape_id: u32, slot_index: u32) -> Option<JsValue> {
@@ -98,7 +98,9 @@ impl Vm {
             return Some(obj.get_prop_at(pos));
         }
         let mut proto = obj.proto();
-        while proto.is_object() {
+        let mut depth = 0usize;
+        while proto.is_object() && depth < MAX_PROTO_CHAIN_DEPTH {
+            depth += 1;
             let proto_obj = unsafe { &*proto.as_js_object_ptr() };
             if let Some(pos) = self.private_slot(proto_obj, private_key) {
                 return Some(proto_obj.get_prop_at(pos));