feat: 解构模式语义补齐（REST 枚举/getter/computed 排除、IteratorClose、RegAlloc def 干涉、for-in 捕获遮蔽）

crates/oxide_builtins/src/iterator.rs

@@ -65,9 +65,19 @@ pub(crate) fn try_make_iterator<H: VmHost>(vm: &mut H, value: JsValue) -> Result
     vm.set_or_create_prop_value(wrapper_obj, next_si, next_fn);
 
     // 把 IteratorClose 转发给内层迭代器，使 for-of 异常退出时可清理。
+    // 仅当内层提供可调用的 return 方法时包装器才暴露 return：内建集合
+    // （数组/字符串等索引迭代）无 return 方法，此时 GetMethod 应返回 undefined
+    // （IteratorClose 跳过），否则 return() 结果 undefined 会被误判为非对象报错。
     let return_si = vm.kernel_core().perm_interner().intern("return").0;
-    let return_fn = make_native_function(vm, "return", iterator_wrapper_return::<H> as *const (), 0);
+    if inner.is_object() {
-    vm.set_or_create_prop_value(wrapper_obj, return_si, return_fn);
+        let inner_obj = unsafe { &*inner.as_js_object_ptr() };
+        if let Ok(return_fn) = vm.ordinary_get(inner_obj, return_si, inner) {
+            if is_callable(return_fn) {
+                let wrapper_return = make_native_function(vm, "return", iterator_wrapper_return::<H> as *const (), 0);
+                vm.set_or_create_prop_value(wrapper_obj, return_si, wrapper_return);
+            }
+        }
+    }
 
     Ok(Some(JsValue::from_js_object(wrapper)))
 }

crates/oxide_emit/src/closure.rs

@@ -22,6 +22,17 @@ impl Emitter {
         names
     }
 
+    /// 收集 for-in/for-of 头部声明（`var x` / 解构 pattern）绑定的名字。
+    fn collect_for_left_decl_names(&self, left: &oxide_parser::ForStatementLeft, out: &mut HashSet<String>) {
+        if let oxide_parser::ForStatementLeft::VariableDeclaration(vd) = left {
+            for d in &vd.declarations {
+                if let oxide_parser::BindingPattern::BindingIdentifier(bi) = &d.id {
+                    out.insert(bi.name.to_string());
+                }
+            }
+        }
+    }
+
     /// 收集当前函数作用域声明的绑定名（参数 + 变量/函数声明，含嵌套 block，不含嵌套函数体）。
     pub(crate) fn collect_own_binding_names(&self, param_names: &[&str], stmts: &[Statement]) -> HashSet<String> {
         let mut names = HashSet::new();
@@ -66,6 +77,28 @@ impl Emitter {
                     }
                     self.collect_decl_names_stmt(std::slice::from_ref(&f.body), out);
                 }
+                // for-in / for-of 头部的 var 声明是本函数局部绑定（遮蔽外层同名），
+                // 须计入 own_bindings，否则闭包捕获分析会误判为捕获外层变量。
+                Statement::ForInStatement(fi) => {
+                    if let oxide_parser::ForStatementLeft::VariableDeclaration(vd) = &fi.left {
+                        for d in &vd.declarations {
+                            if let oxide_parser::BindingPattern::BindingIdentifier(bi) = &d.id {
+                                out.insert(bi.name.to_string());
+                            }
+                        }
+                    }
+                    self.collect_decl_names_stmt(std::slice::from_ref(&fi.body), out);
+                }
+                Statement::ForOfStatement(fo) => {
+                    if let oxide_parser::ForStatementLeft::VariableDeclaration(vd) = &fo.left {
+                        for d in &vd.declarations {
+                            if let oxide_parser::BindingPattern::BindingIdentifier(bi) = &d.id {
+                                out.insert(bi.name.to_string());
+                            }
+                        }
+                    }
+                    self.collect_decl_names_stmt(std::slice::from_ref(&fo.body), out);
+                }
                 Statement::SwitchStatement(sw) => {
                     for case in &sw.cases {
                         self.collect_decl_names_stmt(&case.consequent, out);
@@ -87,13 +120,6 @@ impl Emitter {
         }
     }
 
-    /// 扫描 stmts 内（含任意深度嵌套函数）对 `ref_set` 的引用，写入 out。
-    /// 递归进入嵌套函数时累加其局部绑定为遮蔽集，避免把内层局部误判为捕获。
-    fn collect_capture_names(&self, stmts: &[Statement], ref_set: &HashSet<String>, out: &mut HashSet<String>) {
-        let shadow = HashSet::new();
-        self.collect_capture_names_shadowed(stmts, ref_set, &shadow, out);
-    }
-
     fn collect_capture_names_shadowed(
         &self, stmts: &[Statement], ref_set: &HashSet<String>, shadow: &HashSet<String>, out: &mut HashSet<String>,
     ) {
@@ -174,11 +200,16 @@ impl Emitter {
             }
             Statement::ForInStatement(fi) => {
                 self.collect_capture_names_expr(&fi.right, ref_set, shadow, out);
-                self.collect_capture_names_stmt(&fi.body, ref_set, shadow, out);
+                // left 的 var 声明遮蔽外层同名绑定，body 内引用不视为捕获外层。
+                let mut for_shadow = shadow.clone();
+                self.collect_for_left_decl_names(&fi.left, &mut for_shadow);
+                self.collect_capture_names_shadowed(std::slice::from_ref(&fi.body), ref_set, &for_shadow, out);
             }
             Statement::ForOfStatement(fo) => {
                 self.collect_capture_names_expr(&fo.right, ref_set, shadow, out);
-                self.collect_capture_names_stmt(&fo.body, ref_set, shadow, out);
+                let mut for_shadow = shadow.clone();
+                self.collect_for_left_decl_names(&fo.left, &mut for_shadow);
+                self.collect_capture_names_shadowed(std::slice::from_ref(&fo.body), ref_set, &for_shadow, out);
             }
             Statement::BlockStatement(b) => self.collect_capture_names_shadowed(&b.body, ref_set, shadow, out),
             Statement::TryStatement(ts) => {
@@ -501,7 +532,11 @@ impl Emitter {
             Statement::FunctionDeclaration(fd) => {
                 let body: &[Statement] = fd.body.as_ref().map(|b| &b.statements[..]).unwrap_or(&[]);
                 self.collect_fn_default_captured(&fd.params, own, out);
-                self.collect_capture_names(body, own, out);
+                // 函数参数与体内部声明遮蔽父级绑定：体内对这些名字的引用不算捕获父级。
+                let mut fn_shadow = HashSet::new();
+                fn_shadow.extend(self.collect_fn_param_names(&fd.params));
+                fn_shadow.extend(self.collect_own_binding_names(&[], body));
+                self.collect_capture_names_shadowed(body, own, &fn_shadow, out);
             }
             Statement::ClassDeclaration(cd) => {
                 // 类构造器/方法体与字段表达式引用的父级绑定须建 cell，供子模块 upvalue 捕获。

crates/oxide_emit/src/shared/binding.rs

@@ -190,23 +190,74 @@ impl Emitter {
     fn emit_object_binding(
         &self, op: &ObjectPattern, src_reg: u32, kind: VariableDeclarationKind, is_const: bool, ctx: &mut CompileCtx,
     ) -> Result<(), String> {
+        // 对象解构先 ToObject(rhs)：null/undefined 抛 TypeError（含空 pattern），
+        // 原始值包装为对应对象，保证属性读取与 rest 都以对象为源。
+        // 写到临时寄存器，保留 src_reg 原值（声明初始化路径的返回值语义）。
+        let obj_reg = ctx.alloc_reg();
+        ctx.inst(Inst::new(OpCode::LOAD_VAR, Operand::Reg(obj_reg), Operand::Reg(src_reg), Operand::None));
+        ctx.inst(Inst::new(OpCode::TO_OBJECT, Operand::Reg(obj_reg), Operand::None, Operand::None));
+        // 有 rest 时构建运行时 excluded 数组：静态 key 直接 push 常量，computed key 求值结果 push 值。
         let mut excluded = Vec::new();
+        let mut excl_arr_reg = None;
+        let mut excl_push = 0usize;
+        if op.rest.is_some() {
+            excl_arr_reg = Some(self.emit_new_excluded_array(ctx));
+        }
         for prop in &op.properties {
-            let (prop_reg, static_key) = self.emit_object_property_read_key(src_reg, &prop.key, prop.computed, ctx)?;
+            let (prop_reg, static_key, key_reg) =
+                self.emit_object_property_read_key(obj_reg, &prop.key, prop.computed, ctx)?;
             if let Some(key) = static_key {
-                excluded.push(key);
+                excluded.push(key.clone());
+                if let Some(arr) = excl_arr_reg {
+                    self.emit_push_excluded_key(arr, None, &key, excl_push, ctx);
+                    excl_push += 1;
+                }
+            } else if let (Some(arr), Some(key_reg)) = (excl_arr_reg, key_reg) {
+                self.emit_push_excluded_key(arr, Some(key_reg), "", excl_push, ctx);
+                excl_push += 1;
             }
             self.emit_binding_pattern(&prop.value, prop_reg, kind, is_const, ctx)?;
         }
         if let Some(rest) = &op.rest {
             let rest_reg = ctx.alloc_reg();
             let excluded_idx = ctx.add_constant(Constant::String(excluded.join("\0")));
-            ctx.inst(Inst::rest_object(Operand::Reg(rest_reg), Operand::Reg(src_reg), excluded_idx as u32));
+            ctx.inst(Inst::rest_object(
+                Operand::Reg(rest_reg),
+                Operand::Reg(obj_reg),
+                excluded_idx as u32,
+                excl_arr_reg.map(Operand::Reg),
+            ));
             self.emit_binding_pattern(&rest.argument, rest_reg, kind, is_const, ctx)?;
         }
         Ok(())
     }
 
+    /// 新建运行时 excluded 数组（NEW_ARRAY），供 REST_OBJECT 排除 computed key。
+    fn emit_new_excluded_array(&self, ctx: &mut CompileCtx) -> u32 {
+        let arr = ctx.alloc_reg();
+        ctx.inst(Inst::new(OpCode::NEW_ARRAY, Operand::Reg(arr), Operand::None, Operand::None));
+        arr
+    }
+
+    /// 向 excluded 数组下标 `idx` 写入一个键：`key_val` 为运行时寄存器值，否则用 `key_str` 常量。
+    fn emit_push_excluded_key(
+        &self, arr: u32, key_val: Option<u32>, key_str: &str, idx: usize, ctx: &mut CompileCtx,
+    ) {
+        let val_reg = match key_val {
+            Some(kv) => kv,
+            None => {
+                let ki = ctx.add_constant(Constant::String(key_str.to_string()));
+                let kr = ctx.alloc_reg();
+                ctx.inst(Inst::load_const(Operand::Reg(kr), ki));
+                kr
+            }
+        };
+        let elem_idx = ctx.alloc_reg();
+        let cidx = ctx.add_constant(Constant::Int(idx as i32));
+        ctx.inst(Inst::load_const(Operand::Reg(elem_idx), cidx));
+        ctx.inst(Inst::new(OpCode::SET_ELEM, Operand::Reg(arr), Operand::Reg(elem_idx), Operand::Reg(val_reg)));
+    }
+
     fn emit_assignment_maybe_default(
         &self, target: &AssignmentTargetMaybeDefault, src_reg: u32, ctx: &mut CompileCtx,
     ) -> Result<(), String> {
@@ -260,13 +311,28 @@ impl Emitter {
     pub(crate) fn emit_object_assignment(
         &self, op: &ObjectAssignmentTarget, src_reg: u32, ctx: &mut CompileCtx,
     ) -> Result<(), String> {
+        // 对象解构先 ToObject(rhs)：null/undefined 抛 TypeError（含空 pattern），
+        // 原始值包装为对应对象，保证属性读取与 rest 都以对象为源。
+        // 写到临时寄存器，保留 src_reg 原值（解构赋值表达式返回值 = rhs）。
+        let obj_reg = ctx.alloc_reg();
+        ctx.inst(Inst::new(OpCode::LOAD_VAR, Operand::Reg(obj_reg), Operand::Reg(src_reg), Operand::None));
+        ctx.inst(Inst::new(OpCode::TO_OBJECT, Operand::Reg(obj_reg), Operand::None, Operand::None));
         let mut excluded = Vec::new();
+        let mut excl_arr_reg = None;
+        let mut excl_push = 0usize;
+        if op.rest.is_some() {
+            excl_arr_reg = Some(self.emit_new_excluded_array(ctx));
+        }
         for prop in &op.properties {
             match prop {
                 AssignmentTargetProperty::AssignmentTargetPropertyIdentifier(id) => {
                     let key = id.binding.name.as_str().to_string();
                     excluded.push(key.clone());
-                    let mut prop_reg = self.emit_object_property_read(src_reg, &key, ctx);
+                    if let Some(arr) = excl_arr_reg {
+                        self.emit_push_excluded_key(arr, None, &key, excl_push, ctx);
+                        excl_push += 1;
+                    }
+                    let mut prop_reg = self.emit_object_property_read(obj_reg, &key, ctx);
                     if let Some(default_expr) = &id.init {
                         let name = id.binding.name.as_str();
                         prop_reg = self.emit_default_if_undefined(prop_reg, default_expr, Some(name), ctx)?;
@@ -281,10 +347,17 @@ impl Emitter {
                     ));
                 }
                 AssignmentTargetProperty::AssignmentTargetPropertyProperty(prop) => {
-                    let (prop_reg, static_key) =
+                    let (prop_reg, static_key, key_reg) =
-                        self.emit_object_property_read_key(src_reg, &prop.name, prop.computed, ctx)?;
+                        self.emit_object_property_read_key(obj_reg, &prop.name, prop.computed, ctx)?;
                     if let Some(key) = static_key {
-                        excluded.push(key);
+                        excluded.push(key.clone());
+                        if let Some(arr) = excl_arr_reg {
+                            self.emit_push_excluded_key(arr, None, &key, excl_push, ctx);
+                            excl_push += 1;
+                        }
+                    } else if let (Some(arr), Some(key_reg)) = (excl_arr_reg, key_reg) {
+                        self.emit_push_excluded_key(arr, Some(key_reg), "", excl_push, ctx);
+                        excl_push += 1;
                     }
                     self.emit_assignment_maybe_default(&prop.binding, prop_reg, ctx)?;
                 }
@@ -293,7 +366,12 @@ impl Emitter {
         if let Some(rest) = &op.rest {
             let rest_reg = ctx.alloc_reg();
             let excluded_idx = ctx.add_constant(Constant::String(excluded.join("\0")));
-            ctx.inst(Inst::rest_object(Operand::Reg(rest_reg), Operand::Reg(src_reg), excluded_idx as u32));
+            ctx.inst(Inst::rest_object(
+                Operand::Reg(rest_reg),
+                Operand::Reg(obj_reg),
+                excluded_idx as u32,
+                excl_arr_reg.map(Operand::Reg),
+            ));
             self.emit_assign_target(&rest.target, rest_reg, ctx)?;
         }
         Ok(())

crates/oxide_emit/src/shared/chain.rs

@@ -281,11 +281,11 @@ impl Emitter {
 
     pub(crate) fn emit_object_property_read_key(
         &self, src_reg: u32, key: &PropertyKey, computed: bool, ctx: &mut CompileCtx,
-    ) -> Result<(u32, Option<String>), String> {
+    ) -> Result<(u32, Option<String>, Option<u32>), String> {
         if !computed {
             let key_name = self.static_property_name(key)?;
             let prop_reg = self.emit_object_property_read(src_reg, &key_name, ctx);
-            return Ok((prop_reg, Some(key_name)));
+            return Ok((prop_reg, Some(key_name), None));
         }
         let prop_reg = ctx.alloc_reg();
         ctx.inst(Inst::new(OpCode::LOAD_VAR, Operand::Reg(prop_reg), Operand::Reg(src_reg), Operand::None));
@@ -297,6 +297,6 @@ impl Emitter {
             Operand::Reg(key_reg),
             Operand::Reg(val_reg),
         ));
-        Ok((val_reg, None))
+        Ok((val_reg, None, Some(key_reg)))
     }
 }

crates/oxide_ir/src/contract.rs

@@ -301,8 +301,11 @@ impl Inst {
             // for-in/of 迭代器：INIT 读 a；NEXT/DONE 读迭代器栈隐式状态
             OpCode::FOR_IN_INIT | OpCode::FOR_OF_INIT => push_operand(&mut uses, &self.a),
             OpCode::FOR_IN_NEXT | OpCode::FOR_IN_DONE | OpCode::FOR_OF_NEXT | OpCode::FOR_OF_DONE => {}
-            // REST_OBJECT：读 a（ext 是 excluded_idx 常量）
+            // REST_OBJECT：读 a（src）与可选 b（运行时 excluded 数组），ext 是 excluded_idx 常量
-            OpCode::REST_OBJECT => push_operand(&mut uses, &self.a),
+            OpCode::REST_OBJECT => {
+                push_operand(&mut uses, &self.a);
+                push_operand(&mut uses, &self.b);
+            }
             // SPREAD_OBJECT：原地改目标对象，读目标（rd）与源（a）
             OpCode::SPREAD_OBJECT => {
                 push_operand(&mut uses, &self.rd);

crates/oxide_ir/src/inst.rs

@@ -203,8 +203,10 @@ impl Inst {
     }
 
     /// 对象 rest 展开：`{...src, 排除 excluded_idx 常量列出的键}` 存入 `rest`。
-    pub fn rest_object(rest: Operand, src: Operand, excluded_idx: u32) -> Self {
+    /// `excl_arr` 为可选运行时 excluded 键数组寄存器（computed key 求值结果），
-        Self::with_ext(OpCode::REST_OBJECT, rest, src, Operand::None, &[excluded_idx])
+    /// None 时仅用编译期 excluded_idx 常量。
+    pub fn rest_object(rest: Operand, src: Operand, excluded_idx: u32, excl_arr: Option<Operand>) -> Self {
+        Self::with_ext(OpCode::REST_OBJECT, rest, src, excl_arr.unwrap_or(Operand::None), &[excluded_idx])
     }
 
     /// 对象字面量 spread 展开：把源 `src` 的可枚举自有属性写入目标对象 `rd`（原地改）。

crates/oxide_regalloc/src/graph.rs

@@ -180,7 +180,7 @@ pub(super) fn build(
                 at_i.push(fr.id);
             }
         }
-        // 两两加边
+        // 两两加边（基于 live_before：约束 use/def 与执行前存活值）
         for a in 0..at_i.len() {
             for b in a + 1..at_i.len() {
                 let (x, y) = (at_i[a], at_i[b]);
@@ -188,6 +188,22 @@ pub(super) fn build(
                 adj_sets.entry(y).or_default().insert(x);
             }
         }
+        // def 结果与执行后仍存活的值冲突（写覆盖）：live_after 含 def 后存活者。
+        // live_before 已 kill def 自身，纯写指令（FOR_OF_NEXT 等）的结果若与长活
+        // 寄存器同色会覆盖其值（elision 解构返回值被覆盖），须补此干涉边。
+        if let Some(d) = f.insts[i].def_reg() {
+            if nodes.contains_key(&d) {
+                for &v in &node_ids {
+                    if v == d {
+                        continue;
+                    }
+                    if live.inst_live_after[i].get(v as usize).copied().unwrap_or(false) {
+                        adj_sets.entry(d).or_default().insert(v);
+                        adj_sets.entry(v).or_default().insert(d);
+                    }
+                }
+            }
+        }
     }
     for (v, set) in adj_sets {
         if let Some(node) = nodes.get_mut(&v) {

crates/oxide_regalloc/tests/runtime_eq.rs

@@ -54,6 +54,11 @@ fn regalloc_preserves_semantics() {
         "function f(n) { var s = 0; for (var i = 0; i < n; i++) { s += i * i; } return s; } f(10);",
         // 解构
         "function f() { var [a, b] = [1, 2]; var { c, d } = { c: 3, d: 4 }; return a + b + c + d; } f();",
+        // elision 解构赋值：返回值寄存器与 FOR_OF_NEXT 结果须异色（def 干涉边回归）
+        "var result; var vals = [1, 2, 3]; result = [,] = vals; result[0] + result[1] + result[2];",
+        "var result; var vals = [1, 2, 3]; var x, y, z; result = [x, y, z] = vals; x + y + z;",
+        // 嵌套数组解构（内层迭代器覆盖外层 last result，done 检查须正确）
+        "var x; var vals = [[1]]; var result = [[x]] = vals; x;",
         // 闭包（upvalue cell 路径）
         "function f() { var x = 1; return function() { return x++; }; } var g = f(); var r = [g(), g(), g()]; r[0] + r[1] + r[2];",
         // 箭头函数

crates/oxide_vm/src/dispatch/call.rs

@@ -5,7 +5,7 @@ use oxide_builtins::iterator::make_iterator_for_value;
 use oxide_builtins::{builtins_debug, builtins_trace};
 use oxide_bytecode::opcode;
 use oxide_runtime_api::{to_boolean, NativeResult};
-use oxide_types::object::{Cell, JsObject};
+use oxide_types::object::{Cell, JsObject, PropAttributes};
 use oxide_types::value::JsValue;
 use std::sync::Arc;
 
@@ -135,7 +135,8 @@ impl Vm {
             .as_deref()
             .map(|n| self.new_string(n))
             .unwrap_or_else(|| self.new_string(""));
-        self.set_or_create_prop_value(func_obj, name_si, name_val);
+        // name 属性描述符：不可写、不可枚举、可配置（SetFunctionName 语义）。
+        self.define_data_property(func_obj, name_si, name_val, PropAttributes::new(false, false, true))?;
         if !upvalue_captures.is_empty() {
             // 链式捕获（parent_uv_idx）：从父闭包（创建者）的 upvalues 取 cell。
             let parent_upvalues: Vec<*mut Cell> = match self.current_callee() {

crates/oxide_vm/src/dispatch/misc.rs

@@ -58,6 +58,11 @@ impl Vm {
         if val.is_object() {
             return Ok(());
         }
+        if val.is_null() || val.is_undefined() {
+            // 抛 JS 异常而非返回 Err：外围 try/catch 须能捕获（对象解构空 pattern）。
+            self.raise_error_kind("TypeError", "Cannot convert null or undefined to object")?;
+            return Ok(());
+        }
         let obj_val = oxide_runtime_api::to_object(val, self)?;
         self.regs[rd] = obj_val;
         Ok(())

crates/oxide_vm/src/vm.rs

@@ -1453,7 +1453,7 @@ impl Vm {
                 }
 
                 OpCode::REST_OBJECT => {
-                    self.dispatch_rest_object(rd, a)?;
+                    self.dispatch_rest_object(rd, a, b)?;
                 }
 
                 OpCode::SPREAD_OBJECT => {

crates/oxide_vm/src/vm_dispatch_misc.rs

@@ -521,6 +521,18 @@ impl Vm {
         let Some(iterator) = self.iters.pop_for_of() else {
             return Ok(());
         };
+        // 迭代已自然结束（最后一次 next 返回 done:true）时不调 return()；
+        // 仅当元素耗尽但迭代器未 done（提前退出）才执行 IteratorClose。
+        let result = self.iters.last_for_of_result();
+        if result.is_object() {
+            let result_obj = unsafe { &*result.as_js_object_ptr() };
+            let done_si = self.kernel_core.perm_interner().intern("done").0;
+            if let Ok(done_val) = self.ordinary_get(result_obj, done_si, result) {
+                if to_boolean(done_val) {
+                    return Ok(());
+                }
+            }
+        }
         // 正常 / break / return 退出：此前无进行中的突然完成，return() 自身的抛出直接传播。
         self.close_for_of_iterator(iterator, false)
     }
@@ -558,7 +570,16 @@ impl Vm {
                     self.exception_value = saved_exc;
                     self.pending_error_kind = saved_kind;
                 } else {
-                    let _ = self.call_function_sync(return_fn, iterator, &[])?;
+                    let inner = match self.call_function_sync(return_fn, iterator, &[]) {
+                        Ok(v) => v,
+                        // return() 抛出：恢复原始异常值并展开，使外围 try/catch 可捕获。
+                        Err(e) => return self.raise_call_error(&e).map(|_| ()),
+                    };
+                    // IteratorClose 要求 return() 返回值是对象，否则抛 TypeError。
+                    if !inner.is_object() {
+                        self.raise_type_error("iterator return() result is not an object")?;
+                        return Ok(());
+                    }
                 }
             }
         }
@@ -577,7 +598,7 @@ impl Vm {
         }
     }
 
-    pub(crate) fn dispatch_rest_object(&mut self, rd: usize, a: usize) -> Result<(), String> {
+    pub(crate) fn dispatch_rest_object(&mut self, rd: usize, a: usize, b: usize) -> Result<(), String> {
         vm_trace!("REST_OBJECT rd={}", rd);
         // ext 字（excluded 常量下标）在任何路径都先消费，防止 ToObject 早返回后
         // pc 错位把 ext 字当下一条指令解码（曾误读成 UNSPILL slot）。
@@ -608,7 +629,7 @@ impl Vm {
             self.regs[rd] = JsValue::from_js_object(rest_ptr);
             return Ok(());
         }
-        let excluded = self
+        let excluded_const = self
             .immutables()
             .get(excluded_idx)
             .and_then(|v| {
@@ -620,39 +641,96 @@ impl Vm {
                 }
             })
             .unwrap_or_default();
-        let excluded: std::collections::HashSet<&str> = excluded.split('\0').filter(|s| !s.is_empty()).collect();
+        let mut excluded: std::collections::HashSet<u32> = excluded_const
+            .split('\0')
+            .filter(|s| !s.is_empty())
+            .map(|s| self.kernel_core.perm_interner().intern(s).0)
+            .collect();
+        // 运行时 excluded：b 槽数组（computed key 求值结果）的元素 ToPropertyKey 后排除。
+        if b != 0 {
+            let arr_val = self.regs[b];
+            if arr_val.is_object() {
+                let arr_obj = unsafe { &*arr_val.as_js_object_ptr() };
+                if arr_obj.is_array() {
+                    for i in 0..arr_obj.array_prop_count {
+                        let v = arr_obj.get_prop_at(i);
+                        let si = self.property_key_si(v);
+                        excluded.insert(si);
+                    }
+                }
+            }
+        }
 
+        let src_obj = unsafe { &*src.as_js_object_ptr() };
+
+        // 收集-提交：先取齐 (键, 值)，取值阶段触发 getter（可能抛异常），再统一写
+        // 目标对象，避免提交写与取值互相交错。只复制可枚举自有属性（CopyDataProperties）。
+        let mut assignments: Vec<(u32, JsValue)> = Vec::new();
+
+        // 字符串包装对象：索引字符是可枚举自有属性（ToObject("str") 的 0..len-1）。
+        if src_obj.type_tag == JsObject::OBJ_TYPE_STRING_OBJ {
+            let raw = src_obj.get_prop_at(0);
+            let s = unsafe { (*raw.as_string_ptr()).data.clone() };
+            let code_units: Vec<u16> = s.encode_utf16().collect();
+            for (i, unit) in code_units.iter().enumerate() {
+                let ch = char::from_u32(*unit as u32).map(|c| c.to_string()).unwrap_or_default();
+                let si = self.kernel_core.perm_interner().intern(&i.to_string()).0;
+                assignments.push((si, self.new_string(&ch)));
+            }
+        }
+
+        // 数组元素区：整数下标可枚举元素（hole 跳过）。
+        if src_obj.is_array() {
+            for i in 0..src_obj.array_prop_count {
+                if src_obj.prop_meta_at(i).is_some_and(|m| m.is_hole()) {
+                    continue;
+                }
+                let enumerable = src_obj
+                    .prop_meta_at(i)
+                    .map(|m| m.attributes.enumerable())
+                    .unwrap_or(PropAttributes::DEFAULT_DATA.enumerable());
+                if enumerable {
+                    let si = self.kernel_core.perm_interner().intern(&i.to_string()).0;
+                    let val = match self.ordinary_get(src_obj, si, src) {
+                        Ok(v) => v,
+                        Err(e) => return self.raise_call_error(&e).map(|_| ()),
+                    };
+                    assignments.push((si, val));
+                }
+            }
+        }
+
+        // 命名属性：shape 链（walk_own_keys 规范顺序），仅可枚举，跳过 pattern 已绑定的键。
+        let keys = oxide_builtins::object::walk_own_keys(self, src_obj);
+        for (si, pos) in keys {
+            let store = if src_obj.is_array() { src_obj.array_prop_count + pos } else { pos };
+            let enumerable = src_obj
+                .prop_meta_at(store)
+                .map(|m| m.attributes.enumerable())
+                .unwrap_or(PropAttributes::DEFAULT_DATA.enumerable());
+            if !enumerable {
+                continue;
+            }
+            if excluded.contains(&si) {
+                continue;
+            }
+            let val = match self.ordinary_get(src_obj, si, src) {
+                Ok(v) => v,
+                Err(e) => return self.raise_call_error(&e).map(|_| ()),
+            };
+            assignments.push((si, val));
+        }
+
+        // 提交到 rest 对象。
         let proto_ptr = self.session.builtin_world().object_proto.as_ptr() as *mut JsObject;
         let rest_ptr = self.alloc_object(JsObject::new_empty(
             oxide_kernel::shape_forge::EMPTY_SHAPE_ID,
             JsValue::from_js_object(proto_ptr),
         ));
-        let src_obj = unsafe { &*src.as_js_object_ptr() };
+        let rest = unsafe { &mut *rest_ptr };
-        let mut cursor = Some(src_obj.shape_id());
+        for (si, val) in assignments {
-        while let Some(shape_id) = cursor {
+            let promoted = self.promote_if_needed_for_write_ptr(rest_ptr, val);
-            if shape_id == oxide_kernel::shape_forge::EMPTY_SHAPE_ID {
+            self.set_or_create_prop_value(rest, si, promoted);
-                break;
-            }
-            let Some(shape) = self.kernel_core.shape_forge().get_shape(shape_id) else {
-                break;
-            };
-            if shape.property_name != u32::MAX && !is_private_name_key(shape.property_name) {
-                if let Some(name) = self.kernel_core.perm_interner().lookup(shape.property_name) {
-                    if !excluded.contains(name) {
-                        if let Some(pos) = self
-                            .kernel_core
-                            .shape_forge()
-                            .lookup_position(src_obj.shape_id(), shape.property_name)
-                        {
-                            let val = src_obj.get_prop_at(pos);
-                            let rest = unsafe { &mut *rest_ptr };
-                            let val = self.promote_if_needed_for_write_ptr(rest_ptr, val);
-                            self.set_or_create_prop_value(rest, shape.property_name, val);
-                        }
-                    }
-                }
-            }
-            cursor = shape.parent;
         }
         self.regs[rd] = JsValue::from_js_object(rest_ptr);
         Ok(())