feat: with 语句、成员位/移位复合赋值、CALL_NATIVE 无目标修复

with 语句：新增 emit 支持，with 体内自由标识符动态解析（对象属性优先，
回退外层），支持读/写/复合赋值/自增自减/delete/var 初始化动态化，
TO_OBJECT opcode 处理原始值对象，顶层 this 绑定全局对象。

复合赋值：新增 6 个 COMPOUND_MEMBER_BIT_* opcode 支持成员位/移位复合赋值，
修复 computed member 复合赋值覆盖 bug，with 内标识符复合赋值动态化。

CALL_NATIVE：实现全局 isNaN/isFinite 并绑定，用户覆盖 builtin 名时
回退通用调用路径而非报错，局部遮蔽 builtin 名走普通 CALL。

test262: with 34 pass（基线 0），compound-assignment 320 pass（基线 223）

crates/oxide_vm/src/bindings/bind_number.rs

@@ -81,6 +81,8 @@ pub fn bind_number(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         &[
             ("parseInt", oxide_builtins::number::number_parse_int::<crate::vm::Vm> as *const (), 1),
             ("parseFloat", oxide_builtins::number::number_parse_float::<crate::vm::Vm> as *const (), 1),
+            ("isNaN", oxide_builtins::global::global_is_nan::<crate::vm::Vm> as *const (), 1),
+            ("isFinite", oxide_builtins::global::global_is_finite::<crate::vm::Vm> as *const (), 1),
         ],
     );
 }

crates/oxide_vm/src/bindings/mod.rs

@@ -230,6 +230,8 @@ fn bind_global_functions(core: &Arc<KernelCore>, session: &KernelSession, global
         &[
             ("parseInt", oxide_builtins::number::number_parse_int::<crate::vm::Vm> as *const (), 1),
             ("parseFloat", oxide_builtins::number::number_parse_float::<crate::vm::Vm> as *const (), 1),
+            ("isNaN", oxide_builtins::global::global_is_nan::<crate::vm::Vm> as *const (), 1),
+            ("isFinite", oxide_builtins::global::global_is_finite::<crate::vm::Vm> as *const (), 1),
             ("escape", oxide_builtins::global::js_escape::<crate::vm::Vm> as *const (), 1),
             ("unescape", oxide_builtins::global::js_unescape::<crate::vm::Vm> as *const (), 1),
             ("encodeURI", oxide_builtins::global::encode_uri::<crate::vm::Vm> as *const (), 1),

crates/oxide_vm/src/dispatch/member.rs

@@ -55,6 +55,57 @@ impl Vm {
                 "COMPOUND_MEMBER_EXP on non-object",
                 |l, r| l.powf(r),
             ),
+            OpCode::COMPOUND_MEMBER_BIT_AND => self.dispatch_compound_member_bitwise(
+                "COMPOUND_MEMBER_BIT_AND",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_BIT_AND on non-object",
+                |l, r| l & r,
+            ),
+            OpCode::COMPOUND_MEMBER_BIT_OR => self.dispatch_compound_member_bitwise(
+                "COMPOUND_MEMBER_BIT_OR",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_BIT_OR on non-object",
+                |l, r| l | r,
+            ),
+            OpCode::COMPOUND_MEMBER_BIT_XOR => self.dispatch_compound_member_bitwise(
+                "COMPOUND_MEMBER_BIT_XOR",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_BIT_XOR on non-object",
+                |l, r| l ^ r,
+            ),
+            OpCode::COMPOUND_MEMBER_SHL => self.dispatch_compound_member_shift(
+                "COMPOUND_MEMBER_SHL",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_SHL on non-object",
+                false,
+                false,
+            ),
+            OpCode::COMPOUND_MEMBER_SHR => self.dispatch_compound_member_shift(
+                "COMPOUND_MEMBER_SHR",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_SHR on non-object",
+                true,
+                false,
+            ),
+            OpCode::COMPOUND_MEMBER_USHR => self.dispatch_compound_member_shift(
+                "COMPOUND_MEMBER_USHR",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_USHR on non-object",
+                true,
+                true,
+            ),
             _ => unreachable!("non-member opcode passed to dispatch_member_op"),
         }
     }
@@ -180,4 +231,60 @@ impl Vm {
         self.set_member_prop(obj, prop_name_si, new_val, receiver)?;
         Ok(())
     }
+
+    fn dispatch_compound_member_bitwise<F>(
+        &mut self, op_name: &str, rd: usize, a: usize, b: usize, error_msg: &str, op: F,
+    ) -> Result<(), String>
+    where
+        F: FnOnce(i32, i32) -> i32,
+    {
+        vm_trace!("{} rd={} a={} b={}", op_name, rd, a, b);
+        let Ok((obj_ptr, prop_name_si)) = self.member_target(rd, b, error_msg) else {
+            return Ok(());
+        };
+        let receiver = self.regs[rd];
+        let ln = {
+            let obj = unsafe { &mut *obj_ptr };
+            let prop_val = self.read_member_prop(obj, prop_name_si, receiver)?;
+            self.coerce_int32_bounded(prop_val)?
+        };
+        let rn = self.coerce_int32_bounded(self.regs[a])?;
+        let new_val = JsValue::int(op(ln, rn));
+        self.regs[a] = new_val;
+        let obj = unsafe { &mut *obj_ptr };
+        self.set_member_prop(obj, prop_name_si, new_val, receiver)?;
+        Ok(())
+    }
+
+    fn dispatch_compound_member_shift(
+        &mut self, op_name: &str, rd: usize, a: usize, b: usize, error_msg: &str, is_right: bool, is_unsigned: bool,
+    ) -> Result<(), String> {
+        vm_trace!("{} rd={} a={} b={}", op_name, rd, a, b);
+        let Ok((obj_ptr, prop_name_si)) = self.member_target(rd, b, error_msg) else {
+            return Ok(());
+        };
+        let receiver = self.regs[rd];
+        let ln = {
+            let obj = unsafe { &mut *obj_ptr };
+            let prop_val = self.read_member_prop(obj, prop_name_si, receiver)?;
+            self.coerce_int32_bounded(prop_val)?
+        };
+        let shift = self.coerce_uint32_bounded(self.regs[a])? & 0x1F;
+        let new_val = if !is_right {
+            JsValue::int(ln.wrapping_shl(shift))
+        } else if is_unsigned {
+            let u = (ln as u32) >> shift;
+            if u <= i32::MAX as u32 {
+                JsValue::int(u as i32)
+            } else {
+                JsValue::float(u as f64)
+            }
+        } else {
+            JsValue::int(ln >> shift)
+        };
+        self.regs[a] = new_val;
+        let obj = unsafe { &mut *obj_ptr };
+        self.set_member_prop(obj, prop_name_si, new_val, receiver)?;
+        Ok(())
+    }
 }

crates/oxide_vm/src/dispatch/misc.rs

@@ -49,6 +49,20 @@ impl Vm {
         self.regs[rd] = self.new_string(result);
     }
 
+    /// ToObject：rd 原地转换。对象直接返回；null/undefined 抛 TypeError；
+    /// 其余原始值包装为对应包装对象（with 对象环境需要）。
+    #[inline(always)]
+    pub(crate) fn dispatch_to_object(&mut self, rd: usize) -> Result<(), String> {
+        vm_trace!("TO_OBJECT rd={} r{}={:?}", rd, rd, self.regs[rd]);
+        let val = self.regs[rd];
+        if val.is_object() {
+            return Ok(());
+        }
+        let obj_val = oxide_runtime_api::to_object(val, self)?;
+        self.regs[rd] = obj_val;
+        Ok(())
+    }
+
     pub(crate) fn dispatch_load_var(&mut self, rd: usize, a: usize) -> Result<bool, String> {
         vm_trace!("LOAD_VAR rd={} r{}={:?}", rd, a, self.regs[a]);
         if a == 254

crates/oxide_vm/src/vm.rs

@@ -1305,6 +1305,10 @@ impl Vm {
                     self.dispatch_typeof(rd, a);
                 }
 
+                OpCode::TO_OBJECT => {
+                    self.dispatch_to_object(rd)?;
+                }
+
                 OpCode::VOID => {
                     self.dispatch_void(rd);
                 }
@@ -1374,7 +1378,13 @@ impl Vm {
                 | OpCode::COMPOUND_MEMBER_MUL
                 | OpCode::COMPOUND_MEMBER_DIV
                 | OpCode::COMPOUND_MEMBER_MOD
-                | OpCode::COMPOUND_MEMBER_EXP => {
+                | OpCode::COMPOUND_MEMBER_EXP
+                | OpCode::COMPOUND_MEMBER_BIT_AND
+                | OpCode::COMPOUND_MEMBER_BIT_OR
+                | OpCode::COMPOUND_MEMBER_BIT_XOR
+                | OpCode::COMPOUND_MEMBER_SHL
+                | OpCode::COMPOUND_MEMBER_SHR
+                | OpCode::COMPOUND_MEMBER_USHR => {
                     self.dispatch_member_op(op, rd, a, b)?;
                 }
 

crates/oxide_vm/src/vm_dispatch_ctrl.rs

@@ -77,6 +77,12 @@ impl Vm {
             return self.raise_type_error("CALL_NATIVE target is null");
         }
         let obj = unsafe { &*obj_ptr };
+        // 目标为普通 JS 函数（如用户覆盖了 builtin 名）：回退到通用调用路径，
+        // 复用 dispatch_call 的 JS 函数调用逻辑而非强制走 native。
+        // pc 此刻指向 ext 字（与 CALL 指令一致），dispatch_call 直接读取。
+        if obj.is_function() && obj.native_fn().is_none() {
+            return self.dispatch_call(rd, a, b).map(|_| ());
+        }
         if !obj.is_function() || obj.native_fn().is_none() {
             return self.raise_type_error("CALL_NATIVE target is not a native function");
         }

crates/oxide_vm/src/vm_runtime.rs

@@ -217,7 +217,9 @@ impl Vm {
             }
         }
 
-        self.regs[254] = JsValue::undefined();
+        // 全局代码的 this 绑定为全局对象（ECMA-262 全局执行上下文）。
+        let global = self.session.global_object();
+        self.regs[254] = JsValue::from_js_object(global.as_ptr() as *mut JsObject);
 
         self.dispatch()
     }