From 3f393b6acbcab35e7bc3941a7eaed00b28ab626b Mon Sep 17 00:00:00 2001
From: pjh456 <147148383@qq.com>
Date: Wed, 9 Sep 2026 19:03:23 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20eval=20=E8=84=9A=E6=9C=AC=20var=20?=
 =?UTF-8?q?=E5=A3=B0=E6=98=8E=E8=90=BD=E5=85=A8=E5=B1=80=20configurable:tr?=
 =?UTF-8?q?ue=E2=80=94=E2=80=94is=5Feval=5Fscript=20=E7=A9=BF=E9=80=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/oxide_cfg/tests/regression.rs          |  8 +-
 crates/oxide_compiler/src/compiler.rs         | 14 ++-
 crates/oxide_dce/tests/precise_eq.rs          | 16 +++-
 crates/oxide_dce/tests/runtime_eq.rs          |  8 +-
 crates/oxide_emit/src/emit.rs                 | 28 ++++--
 crates/oxide_liveness/tests/smoke.rs          |  2 +-
 crates/oxide_regalloc/tests/b005_samples.rs   |  4 +-
 .../tests/nested_parent_slot_regress.rs       |  2 +-
 crates/oxide_regalloc/tests/reg_count.rs      |  4 +-
 crates/oxide_regalloc/tests/runtime_eq.rs     |  6 +-
 crates/oxide_regalloc/tests/smoke.rs          |  2 +-
 crates/oxide_vm/src/vm.rs                     | 11 ++-
 crates/oxide_vm/src/vm_dispatch_ctrl.rs       | 35 +++++---
 .../tests/eval_script_global_tests.rs         | 88 +++++++++++++++++++
 14 files changed, 188 insertions(+), 40 deletions(-)
 create mode 100644 crates/oxide_vm/tests/eval_script_global_tests.rs

diff --git a/crates/oxide_cfg/tests/regression.rs b/crates/oxide_cfg/tests/regression.rs
index 00d79d24..5dbdf8c8 100644
--- a/crates/oxide_cfg/tests/regression.rs
+++ b/crates/oxide_cfg/tests/regression.rs
@@ -9,7 +9,9 @@ use oxide_cfg::EdgeKind;
 fn cfg_from_source(src: &str) -> oxide_cfg::Cfg {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, src).expect("parse failed");
-    let ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     build_cfg(&ir)
 }
 
@@ -53,7 +55,9 @@ fn nested_function_cfgs_are_independent() {
     let allocator = oxide_parser::Allocator::default();
     let program =
         oxide_parser::parse(&allocator, "function outer(){ var x = 0; while(x<3){x=x+1;} }").expect("parse failed");
-    let ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     for nested in &ir.nested {
         let cfg = build_cfg(nested);
         assert!(!cfg.blocks.is_empty());
diff --git a/crates/oxide_compiler/src/compiler.rs b/crates/oxide_compiler/src/compiler.rs
index 9d3ec58c..190c8230 100644
--- a/crates/oxide_compiler/src/compiler.rs
+++ b/crates/oxide_compiler/src/compiler.rs
@@ -7,7 +7,7 @@ use oxide_ir::lower::lower;
 /// 结构哈希 / 编译模块哈希 re-export（供编译缓存作键）。
 pub use crate::hash::{compiled_module_hash, structural_hash};
 
-/// 编译入口：状态 = DCE 开关 + RegAlloc 开关 + REPL 持久开关，编译其余状态在 emit/lower 内部。
+/// 编译入口：状态 = DCE 开关 + RegAlloc 开关 + REPL 持久开关 + eval 脚本标记，编译其余状态在 emit/lower 内部。
 pub struct Compiler {
     /// 是否在 emit 与 lower 之间运行死代码消除（默认开启）。
     enable_dce: bool,
@@ -16,15 +16,18 @@ pub struct Compiler {
     enable_regalloc: bool,
     /// 是否为 REPL 持久模式：脚本顶层 let/const 也写全局对象属性。
     repl_persist: bool,
+    /// 是否为 eval 脚本：顶层 var/function 声明落全局属性 configurable:true。
+    is_eval_script: bool,
 }
 
 impl Compiler {
-    /// 构造 `Compiler`：默认开启 DCE 与 RegAlloc，不开启 REPL 持久。
+    /// 构造 `Compiler`：默认开启 DCE 与 RegAlloc，不开启 REPL 持久与 eval 脚本标记。
     pub fn new() -> Self {
         Self {
             enable_dce: true,
             enable_regalloc: true,
             repl_persist: false,
+            is_eval_script: false,
         }
     }
 
@@ -46,10 +49,15 @@ impl Compiler {
         Self { repl_persist: enable, ..self }
     }
 
+    /// 标记为 eval 脚本（顶层 var/function 声明落全局属性 configurable:true）。
+    pub fn with_eval_script(self, enable: bool) -> Self {
+        Self { is_eval_script: enable, ..self }
+    }
+
     /// 编译整个 script program：AST → IR（`Emitter::emit_program`）→ 统一 IR 管线。
     pub fn compile(&self, program: &oxide_parser::Program) -> Result<CompiledModule, String> {
         crate::compiler_debug!("compile: starting...");
-        let ir = Emitter::new().emit_program(program, self.repl_persist)?;
+        let ir = Emitter::new().emit_program(program, self.repl_persist, self.is_eval_script)?;
         self.compile_ir(ir)
     }
 
diff --git a/crates/oxide_dce/tests/precise_eq.rs b/crates/oxide_dce/tests/precise_eq.rs
index 15e118c8..209b3cfa 100644
--- a/crates/oxide_dce/tests/precise_eq.rs
+++ b/crates/oxide_dce/tests/precise_eq.rs
@@ -12,7 +12,9 @@ use oxide_vm::JsValue;
 fn run_source(src: &str, precise: bool) -> Result<JsValue, String> {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, src).expect("parse failed");
-    let mut ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let mut ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     oxide_dce::dce(&mut ir); // 保守轮恒定（两跑一致）
     if precise {
         let cfg = oxide_cfg::build_cfg(&ir);
@@ -71,7 +73,9 @@ fn precise_dce_semantics_preserved() {
 fn top_level_store_var_survives_precise() {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, "var x = 1; 2;").expect("parse failed");
-    let mut ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let mut ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     oxide_dce::dce(&mut ir);
     let cfg = oxide_cfg::build_cfg(&ir);
     let live = oxide_liveness::liveness(&ir, &cfg);
@@ -93,7 +97,9 @@ fn top_level_store_var_survives_precise() {
 fn precise_removes_dead_local_store() {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, "function f() { var y = 1; return 5; } f();").expect("parse failed");
-    let ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     assert_eq!(ir.nested.len(), 1);
     let mut sub = ir.nested[0].clone();
     oxide_dce::dce(&mut sub);
@@ -108,7 +114,9 @@ fn precise_removes_dead_local_store() {
 fn top_level_flag_filled_by_emit() {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, "var x = 1; function g() { return 2; }").expect("parse failed");
-    let ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     assert!(ir.is_top_level, "顶层脚本 is_top_level 应为 true");
     assert!(ir.nested.iter().any(|sub| !sub.is_top_level), "嵌套函数 is_top_level 应为 false");
 }
diff --git a/crates/oxide_dce/tests/runtime_eq.rs b/crates/oxide_dce/tests/runtime_eq.rs
index 39e38248..349bf89e 100644
--- a/crates/oxide_dce/tests/runtime_eq.rs
+++ b/crates/oxide_dce/tests/runtime_eq.rs
@@ -11,7 +11,9 @@ use oxide_vm::JsValue;
 fn run_source(src: &str, dce: bool) -> Result<JsValue, String> {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, src).expect("parse failed");
-    let mut ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let mut ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     if dce {
         oxide_dce::dce(&mut ir);
     }
@@ -73,7 +75,9 @@ fn top_level_store_var_kept() {
     let src = "let x = 0; class C { [x = 1]() { return 2; } } new C();";
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, src).expect("parse failed");
-    let mut ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let mut ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     oxide_dce::dce(&mut ir);
     let module = oxide_ir::lower::lower(&ir).expect("lower failed");
     let has_store_var = module
diff --git a/crates/oxide_emit/src/emit.rs b/crates/oxide_emit/src/emit.rs
index 5dcd742f..f8c82afe 100644
--- a/crates/oxide_emit/src/emit.rs
+++ b/crates/oxide_emit/src/emit.rs
@@ -185,6 +185,9 @@ pub struct CompileCtx {
     /// 是否为 REPL 持久模式：脚本顶层 let/const 也写全局对象属性，使跨轮次
     /// 读取（LOAD_GLOBAL）可见变量绑定。仅 `eval_repl` 设置。
     pub(crate) repl_persist: bool,
+    /// 是否为 eval 脚本：脚本顶层 var/function 声明落全局对象时属性
+    /// configurable:true（普通脚本顶层为 false）。仅动态脚本入口设置。
+    pub(crate) is_eval_script: bool,
     pub(crate) static_block_this_reg: Option<u8>,
     pub(crate) field_buffer: Option<FieldBuffer>,
     /// 类构造器模块中 `@@field_keys` upvalue 下标（实例字段 computed key 数组）。
@@ -328,6 +331,7 @@ impl CompileCtx {
             is_strict: false,
             is_global_scope: false,
             repl_persist: false,
+            is_eval_script: false,
             static_block_this_reg: None,
             field_buffer: None,
             field_keys_uv: None,
@@ -1527,29 +1531,39 @@ impl Emitter {
     /// 可经 `globalThis` 反射（脚本环境记录的 var 绑定全局对象属性）。
     ///
     /// # 边界与前提
-    /// - 仅顶层模块上下文调用：顶层 `this`（物理寄存器 254）恒为全局对象。
+    /// - 仅顶层模块上下文调用。
     /// - let/const/class 不落全局对象，不得调用本函数。
     ///
     /// # 副作用
-    /// - 定义全局对象数据属性（可写/可枚举/不可配置），属性缺失时新建。
+    /// - 普通脚本：定义可写/可枚举/不可配置数据属性（经顶层 `this` = 全局对象）。
+    /// - eval 脚本（`is_eval_script`）：属性可配置（configurable:true），全局对象
+    ///   经 session 解析——eval var 声明允许后续 redefine/delete。
     pub(crate) fn emit_global_prop_write(&self, name: &str, val_reg: u32, ctx: &mut CompileCtx) {
         let idx = ctx.add_constant(Constant::String(name.to_string()));
-        let key_reg = ctx.alloc_reg();
-        ctx.inst(Inst::load_const(Operand::Reg(key_reg), idx));
-        ctx.inst(Inst::define_global_prop(Operand::This, Operand::Reg(val_reg), Operand::Reg(key_reg)));
+        if ctx.is_eval_script {
+            ctx.inst(Inst::define_global_prop_c(Operand::Reg(val_reg), idx));
+        } else {
+            let key_reg = ctx.alloc_reg();
+            ctx.inst(Inst::load_const(Operand::Reg(key_reg), idx));
+            ctx.inst(Inst::define_global_prop(Operand::This, Operand::Reg(val_reg), Operand::Reg(key_reg)));
+        }
     }
 
     /// 把完整程序编译为顶层模块体的 IRFunction。
     ///
     /// 调用方为 `oxide_compiler::Compiler::compile`：本函数完成 emit 半程，
     /// 随后由 `oxide_ir::lower::lower` 降为字节码。
-    /// `repl_persist` 为 true 时脚本顶层 let/const 也写全局对象（REPL 跨轮次持久）。
-    pub fn emit_program(&self, program: &oxide_parser::Program, repl_persist: bool) -> Result<IRFunction, String> {
+    /// `repl_persist` 为 true 时脚本顶层 let/const 也写全局对象（REPL 跨轮次持久）；
+    /// `is_eval_script` 为 true 时顶层 var/function 声明落全局属性 configurable:true。
+    pub fn emit_program(
+        &self, program: &oxide_parser::Program, repl_persist: bool, is_eval_script: bool,
+    ) -> Result<IRFunction, String> {
         crate::emit_debug!("emit_program: {} stmts", program.body.len());
         let mut ctx = CompileCtx::new();
         // 脚本顶层：var/function 声明需落到全局对象，let/const/class 不进全局。
         ctx.is_global_scope = true;
         ctx.repl_persist = repl_persist;
+        ctx.is_eval_script = is_eval_script;
         // 脚本顶层严格模式由源码 "use strict" directive 决定（嵌套函数经父 ctx 继承）。
         ctx.is_strict = program.has_use_strict_directive();
         self.predeclare_function_declarations(&program.body, &mut ctx);
diff --git a/crates/oxide_liveness/tests/smoke.rs b/crates/oxide_liveness/tests/smoke.rs
index a432e34f..fac3ffb3 100644
--- a/crates/oxide_liveness/tests/smoke.rs
+++ b/crates/oxide_liveness/tests/smoke.rs
@@ -6,7 +6,7 @@ use oxide_liveness::{liveness, LiveInfo};
 fn run_liveness(src: &str) -> (LiveInfo, oxide_cfg::Cfg, usize) {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, src).expect("parse");
-    let ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit");
+    let ir = oxide_emit::Emitter::new().emit_program(&program, false, false).expect("emit");
     let cfg = build_cfg(&ir);
     let info = liveness(&ir, &cfg);
     (info, cfg, ir.insts.len())
diff --git a/crates/oxide_regalloc/tests/b005_samples.rs b/crates/oxide_regalloc/tests/b005_samples.rs
index 76fb9096..0d547615 100644
--- a/crates/oxide_regalloc/tests/b005_samples.rs
+++ b/crates/oxide_regalloc/tests/b005_samples.rs
@@ -10,7 +10,9 @@ use oxide_bytecode::module::CompiledModule;
 fn compile_source(src: &str, regalloc: bool) -> Result<CompiledModule, String> {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, src).expect("parse failed");
-    let mut ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let mut ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     oxide_dce::dce(&mut ir);
     if regalloc {
         let cfg = oxide_cfg::build_cfg(&ir);
diff --git a/crates/oxide_regalloc/tests/nested_parent_slot_regress.rs b/crates/oxide_regalloc/tests/nested_parent_slot_regress.rs
index 1517c3e8..19ef4e64 100644
--- a/crates/oxide_regalloc/tests/nested_parent_slot_regress.rs
+++ b/crates/oxide_regalloc/tests/nested_parent_slot_regress.rs
@@ -13,7 +13,7 @@ fn run_source(src: &str, regalloc: bool) -> (bool, String) {
         Ok(p) => p,
         Err(e) => return (false, format!("parse error: {}", e[0].message)),
     };
-    let mut ir = match oxide_emit::Emitter::new().emit_program(&program, false) {
+    let mut ir = match oxide_emit::Emitter::new().emit_program(&program, false, false) {
         Ok(i) => i,
         Err(e) => return (false, format!("emit error: {e}")),
     };
diff --git a/crates/oxide_regalloc/tests/reg_count.rs b/crates/oxide_regalloc/tests/reg_count.rs
index 24643220..c98e4692 100644
--- a/crates/oxide_regalloc/tests/reg_count.rs
+++ b/crates/oxide_regalloc/tests/reg_count.rs
@@ -3,7 +3,9 @@
 fn n_registers(src: &str, regalloc: bool) -> Result<u8, String> {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, src).expect("parse failed");
-    let mut ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let mut ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     oxide_dce::dce(&mut ir);
     if regalloc {
         let cfg = oxide_cfg::build_cfg(&ir);
diff --git a/crates/oxide_regalloc/tests/runtime_eq.rs b/crates/oxide_regalloc/tests/runtime_eq.rs
index 84e82a13..11bdae3f 100644
--- a/crates/oxide_regalloc/tests/runtime_eq.rs
+++ b/crates/oxide_regalloc/tests/runtime_eq.rs
@@ -11,7 +11,9 @@ use oxide_vm::JsValue;
 fn run_source(src: &str, regalloc: bool) -> Result<JsValue, String> {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, src).expect("parse failed");
-    let mut ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit failed");
+    let mut ir = oxide_emit::Emitter::new()
+        .emit_program(&program, false, false)
+        .expect("emit failed");
     oxide_dce::dce(&mut ir);
     if regalloc {
         let cfg = oxide_cfg::build_cfg(&ir);
@@ -123,7 +125,7 @@ fn large_and_spill_samples_run_correctly() {
     // 字节码扫描：spill 样例经 alloc + lower 后应含 SPILL 与 UNSPILL opcode
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, &src_spill).expect("parse");
-    let mut ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit");
+    let mut ir = oxide_emit::Emitter::new().emit_program(&program, false, false).expect("emit");
     oxide_dce::dce(&mut ir);
     let cfg = oxide_cfg::build_cfg(&ir);
     let live = oxide_liveness::liveness(&ir, &cfg);
diff --git a/crates/oxide_regalloc/tests/smoke.rs b/crates/oxide_regalloc/tests/smoke.rs
index 5d73e992..cd3cf421 100644
--- a/crates/oxide_regalloc/tests/smoke.rs
+++ b/crates/oxide_regalloc/tests/smoke.rs
@@ -6,7 +6,7 @@ use std::collections::BTreeSet;
 fn run_color(src: &str) -> (AllocMap, oxide_ir::IRFunction) {
     let allocator = oxide_parser::Allocator::default();
     let program = oxide_parser::parse(&allocator, src).expect("parse");
-    let ir = oxide_emit::Emitter::new().emit_program(&program, false).expect("emit");
+    let ir = oxide_emit::Emitter::new().emit_program(&program, false, false).expect("emit");
     let cfg = oxide_cfg::build_cfg(&ir);
     let live = oxide_liveness::liveness(&ir, &cfg);
     let m = oxide_regalloc::color(&ir, &live).expect("color");
diff --git a/crates/oxide_vm/src/vm.rs b/crates/oxide_vm/src/vm.rs
index 26d9c4f4..cb8cb30d 100644
--- a/crates/oxide_vm/src/vm.rs
+++ b/crates/oxide_vm/src/vm.rs
@@ -2396,10 +2396,12 @@ impl Vm {
         Ok(func_val)
     }
 
-    /// 动态编译脚本（eval 脚本模式）：把源码按脚本模式编译，var/函数声明落全局对象。
+    /// 动态编译脚本（eval 脚本模式）：把源码按脚本模式编译，var/函数声明落全局对象
+    /// （属性 configurable:true，区别于普通脚本顶层的 false）。
     ///
     /// # 步骤
-    /// 1. parse（脚本模式）→ compile（emit_program 置 is_global_scope=true）。
+    /// 1. parse（脚本模式）→ compile（emit_program 置 is_global_scope=true，
+    ///    Compiler 置 is_eval_script=true）。
     /// 2. 整棵模块树（根 flat_id=0 + 嵌套函数）追加进平表：`rehome_subtree(&module, base+1)`，
     ///    使根落 base、子函数 old→base+old，CREATE_CLOSURE imm16 同步重写。
     /// 3. 扩容 immutables_cache，建函数对象（sub_module_index = base）返回。
@@ -2415,7 +2417,10 @@ impl Vm {
         let allocator = oxide_parser::Allocator::default();
         let program = oxide_parser::parse(&allocator, code)
             .map_err(|errs| errs.into_iter().map(|e| e.message).collect::<Vec<_>>().join("\n"))?;
-        let module = oxide_compiler::compiler::Compiler::new().compile(&program)?;
+        // eval 脚本：顶层 var/function 声明落全局属性 configurable:true。
+        let module = oxide_compiler::compiler::Compiler::new()
+            .with_eval_script(true)
+            .compile(&program)?;
         let base = self.sub_modules.len() as u32;
         let mut added = Vec::new();
         // 根模块 flat_id=0 传 base+1，重编号后落 base（避开 sub_module_index()==0 守卫）。
diff --git a/crates/oxide_vm/src/vm_dispatch_ctrl.rs b/crates/oxide_vm/src/vm_dispatch_ctrl.rs
index 0bcae93b..346f8849 100644
--- a/crates/oxide_vm/src/vm_dispatch_ctrl.rs
+++ b/crates/oxide_vm/src/vm_dispatch_ctrl.rs
@@ -299,10 +299,14 @@ impl Vm {
     /// 不一定是全局对象）。属性可写/可枚举/可配置（未声明标识符 PutValue 与
     /// eval 脚本 var/函数声明的属性描述符）。
     ///
+    /// # 步骤
+    /// 1. 属性已存在：CreateGlobalVarBinding 不改既有描述符——保持原属性只更新
+    ///    值（不可写数据/访问器：strict 抛 TypeError、sloppy 静默 no-op）。
+    /// 2. 属性缺失：新建可写/可枚举/可配置属性；全局对象不可扩展 → TypeError
+    ///    （两模式均抛，CreateGlobalVarBinding 语义）。
+    ///
     /// # 边界与前提
     /// - 键常量必须是字符串（emit 侧保证）；非字符串按错误返回。
-    /// - 全局对象不可扩展且属性缺失 → TypeError（两模式均抛，CreateGlobalVarBinding 语义）；
-    ///   已有不可写属性时 sloppy PutValue 静默 no-op，严格模式抛错。
     pub(crate) fn dispatch_define_global_prop_c(&mut self, a: usize, key_idx: u16) -> Result<(), String> {
         let idx = key_idx as usize;
         vm_trace!("DEFINE_GLOBAL_PROP_C value={} idx={}", a, idx);
@@ -315,18 +319,25 @@ impl Vm {
         let global_ptr = self.session.global_object().as_ptr() as *mut JsObject;
         // SAFETY: 全局对象钉在 session 永久区，指针在 VM 生命周期内有效。
         let obj = unsafe { &mut *global_ptr };
+        // 属性已存在：保持原描述符只更新值，不升级 configurable（规范：
+        // CreateGlobalVarBinding 对既有属性不改描述符）。
+        if let Some(pos) = self.kernel_core.shape_forge().lookup_position(obj.shape_id(), si) {
+            if let Some(current) = obj.prop_meta_at(pos) {
+                let writable = !current.is_accessor && current.attributes.writable();
+                if !writable {
+                    return if self.current_strict() {
+                        self.raise_error_kind("TypeError", "cannot assign to read-only property")
+                    } else {
+                        Ok(())
+                    };
+                }
+                return self.define_data_property(obj, si, value, current.attributes);
+            }
+        }
+        // 属性缺失：新建；唯一失败面是全局对象不可扩展（两模式均抛 TypeError）。
         match self.define_data_property(obj, si, value, PropAttributes::new(true, true, true)) {
             Ok(()) => Ok(()),
-            Err(msg) => {
-                // 不可扩展 + 新属性：规范两模式均抛；已有不可写属性：sloppy 静默、strict 抛。
-                let non_extensible_new = self.kernel_core.shape_forge().lookup_position(obj.shape_id(), si).is_none()
-                    && !obj.is_extensible();
-                if non_extensible_new || self.current_strict() {
-                    self.raise_error_kind("TypeError", &msg)
-                } else {
-                    Ok(())
-                }
-            }
+            Err(msg) => self.raise_error_kind("TypeError", &msg),
         }
     }
 
diff --git a/crates/oxide_vm/tests/eval_script_global_tests.rs b/crates/oxide_vm/tests/eval_script_global_tests.rs
new file mode 100644
index 00000000..7f986486
--- /dev/null
+++ b/crates/oxide_vm/tests/eval_script_global_tests.rs
@@ -0,0 +1,88 @@
+//! eval 脚本 var/函数声明落全局对象的属性语义测试：configurable:true（区别于普通
+//! 脚本顶层的 false）、可 delete、跨 eval 轮次经全局对象可见。
+
+use oxide_compiler::compiler::Compiler;
+use oxide_types::value::JsValue;
+use oxide_vm::vm::Vm;
+
+fn eval(source: &str) -> Result<JsValue, String> {
+    let allocator = oxide_parser::Allocator::default();
+    let program = oxide_parser::parse(&allocator, source).map_err(|e| format!("Parse error: {:?}", e))?;
+    let module = Compiler::new().compile(&program).map_err(|e| format!("Compile error: {}", e))?;
+    let mut vm = Vm::new();
+    vm.run(&module)
+}
+
+fn eval_many(lines: &[&str]) -> Result<JsValue, String> {
+    eval(&lines.join("; "))
+}
+
+fn assert_err_contains(result: Result<JsValue, String>, expected: &str) {
+    match result {
+        Ok(_) => panic!("expected error containing '{}', got Ok", expected),
+        Err(e) => assert!(e.contains(expected), "expected error containing '{}', got: {}", expected, e),
+    }
+}
+
+/// 求值并把结果按字符串提取（`JsValue` Display 不携带字符串内容）。
+fn eval_str(source: &str) -> String {
+    let allocator = oxide_parser::Allocator::default();
+    let program = oxide_parser::parse(&allocator, source).expect("parse");
+    let module = Compiler::new().compile(&program).expect("compile");
+    let mut vm = Vm::new();
+    let result = vm.run(&module).expect("run");
+    vm.lookup_str(result).unwrap_or_else(|| format!("{result}"))
+}
+
+// ── eval var 落全局属性 configurable:true ──
+#[test]
+fn eval_var_global_property_configurable_true() {
+    let s = eval_str("eval('var x;'); var d = Object.getOwnPropertyDescriptor(globalThis, 'x'); String(d.configurable) + ':' + String(d.writable) + ':' + String(d.enumerable)");
+    assert_eq!(s, "true:true:true", "eval var 全局属性描述符应全 true，实际 {s}");
+}
+
+// ── eval var 属性可 delete（configurable:true 的推论） ──
+#[test]
+fn eval_var_global_property_deletable() {
+    let r = eval_many(&["eval('var x = 1')", "delete globalThis.x === true && typeof x === 'undefined'"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "eval var 属性应可 delete 且删后读回 undefined，实际 {:?}", r);
+}
+
+// ── eval var 带初始化值经全局对象可见 ──
+#[test]
+fn eval_var_with_initializer_lands_on_global() {
+    let r = eval_many(&["eval('var x = 5')", "globalThis.x === 5"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "eval var 初始化值应落全局对象，实际 {:?}", r);
+}
+
+// ── 跨 eval 轮次：全局属性经 session 全局对象共享 ──
+#[test]
+fn eval_var_visible_across_eval_rounds() {
+    let r = eval_many(&["eval('var a = 1')", "eval('a') === 1"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "跨 eval 轮次应经全局对象可见，实际 {:?}", r);
+}
+
+// ── eval 函数声明落全局属性 configurable:true 且可调用 ──
+#[test]
+fn eval_function_declaration_configurable_and_callable() {
+    let s = eval_str(
+        "eval('function f(){ return 1 }'); \
+         var d = Object.getOwnPropertyDescriptor(globalThis, 'f'); \
+         String(d.configurable) + ':' + String(f())",
+    );
+    assert_eq!(s, "true:1", "eval 函数声明应落全局 configurable:true 且可调用，实际 {s}");
+}
+
+// ── 回归：普通脚本顶层 var 仍 configurable:false ──
+#[test]
+fn script_top_level_var_still_configurable_false() {
+    let r = eval_many(&["var y;", "Object.getOwnPropertyDescriptor(globalThis, 'y').configurable === false"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "脚本顶层 var 应保持 configurable:false，实际 {:?}", r);
+}
+
+// ── 严格 eval：未声明写抛 ReferenceError（Step 2 语义经 eval 路径） ──
+#[test]
+fn strict_eval_undeclared_write_throws_reference_error() {
+    let result = eval("eval(\"'use strict'; x = 1\")");
+    assert_err_contains(result, "x is not defined");
+}