feat: 事件目标弱引用注册表加三方法加原型链

crates/oxide_vm/src/bindings/bind_broadcast_channel.rs

@@ -85,9 +85,9 @@ pub fn bind_broadcast_channel(core: &Arc<KernelCore>, session: &KernelSession, g
         proto.bump_generation();
     }
 
-    // [[Prototype]] → Object.prototype（幂等，裸写槽）。
-    let object_proto_val = JsValue::from_js_object(world.object_proto.as_ptr() as *mut JsObject);
-    let _ = proto.set_proto(object_proto_val);
+    // [[Prototype]] → EventTarget.prototype（事件三方法经原型链可达；幂等，裸写槽）。
+    let et_proto_val = JsValue::from_js_object(world.event_target_proto.as_ptr() as *mut JsObject);
+    let _ = proto.set_proto(et_proto_val);
 
     // 原型方法：postMessage / close（每方法先 lookup_position 守卫）。
     let si_post_message = sf.intern("postMessage").0;

crates/oxide_vm/src/bindings/bind_event.rs

@@ -162,4 +162,39 @@ pub fn bind_event(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
             bind_accessor_getter(core, session, proto, name, fn_ptr);
         }
     }
+
+    // ---- 填 EventTarget 原型占位（无构造器，仅暴露原型与三方法）----
+    // 幂等：三方法经 lookup_position 守卫，[[Prototype]] 裸写槽幂等。
+    let et_proto_ptr = world.event_target_proto.as_ptr() as *mut JsObject;
+    let et_proto = unsafe { &mut *et_proto_ptr };
+    // [[Prototype]] → Object.prototype（幂等，裸写槽）。
+    let object_proto_val = JsValue::from_js_object(world.object_proto.as_ptr() as *mut JsObject);
+    let _ = et_proto.set_proto(object_proto_val);
+    // 三方法：addEventListener / removeEventListener / dispatchEvent（每方法先
+    // lookup_position 守卫）。
+    let si_add = sf.intern("addEventListener").0;
+    if sh.lookup_position(et_proto.shape_id(), si_add).is_none() {
+        apply_binding_table(
+            world,
+            et_proto,
+            core,
+            &[
+                (
+                    "addEventListener",
+                    oxide_builtins::event_target::event_target_add_event_listener::<crate::vm::Vm> as *const (),
+                    3,
+                ),
+                (
+                    "removeEventListener",
+                    oxide_builtins::event_target::event_target_remove_event_listener::<crate::vm::Vm> as *const (),
+                    3,
+                ),
+                (
+                    "dispatchEvent",
+                    oxide_builtins::event_target::event_target_dispatch_event::<crate::vm::Vm> as *const (),
+                    1,
+                ),
+            ],
+        );
+    }
 }

crates/oxide_vm/src/bindings/bind_message_channel.rs

@@ -85,9 +85,9 @@ pub fn bind_message_channel(core: &Arc<KernelCore>, session: &KernelSession, glo
         proto.bump_generation();
     }
 
-    // [[Prototype]] → Object.prototype（幂等，裸写槽）。
-    let object_proto_val = JsValue::from_js_object(world.object_proto.as_ptr() as *mut JsObject);
-    let _ = proto.set_proto(object_proto_val);
+    // [[Prototype]] → EventTarget.prototype（事件三方法经原型链可达；幂等，裸写槽）。
+    let et_proto_val = JsValue::from_js_object(world.event_target_proto.as_ptr() as *mut JsObject);
+    let _ = proto.set_proto(et_proto_val);
 
     // 原型方法：postMessage / close / start（每方法先 lookup_position 守卫）。
     let si_post_message = sf.intern("postMessage").0;

crates/oxide_vm/src/bindings/bind_worker.rs

@@ -75,8 +75,10 @@ pub fn bind_worker(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         match sh.lookup_position(ctor.shape_id(), si_prototype) {
             Some(pos) if ctor.get_prop_at(pos).is_object() => ctor.get_prop_at(pos).as_js_object_ptr(),
             _ => {
-                let object_proto = world.object_proto.as_ptr() as *mut JsObject;
-                let proto = JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(object_proto));
+                // Worker.prototype 的 [[Prototype]] 指向 EventTarget.prototype
+                // （事件三方法经原型链可达；EventTarget 无构造器，仅暴露原型）。
+                let et_proto = world.event_target_proto.as_ptr() as *mut JsObject;
+                let proto = JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(et_proto));
                 let ptr = Box::into_raw(Box::new(proto));
                 world.track_leaked_object(ptr);
                 // 回填构造器 prototype 槽（描述符 { f,f,f }）。
@@ -145,6 +147,33 @@ pub fn bind_worker(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
             ],
         );
     }
+    // EventTarget 三方法直绑全局（worker realm 经 self === global 可达；全局原型链
+    // 是 Object.prototype，首版不改全局原型，三方法直绑全局等价可见）。幂等守卫。
+    let si_self_add = sf.intern("addEventListener").0;
+    if sh.lookup_position(global.shape_id(), si_self_add).is_none() {
+        apply_binding_table(
+            world,
+            global,
+            core,
+            &[
+                (
+                    "addEventListener",
+                    oxide_builtins::event_target::event_target_add_event_listener::<crate::vm::Vm> as *const (),
+                    3,
+                ),
+                (
+                    "removeEventListener",
+                    oxide_builtins::event_target::event_target_remove_event_listener::<crate::vm::Vm> as *const (),
+                    3,
+                ),
+                (
+                    "dispatchEvent",
+                    oxide_builtins::event_target::event_target_dispatch_event::<crate::vm::Vm> as *const (),
+                    1,
+                ),
+            ],
+        );
+    }
     // self 全局属性：值为 global 对象本身（worker realm 经 self === global 可达，
     // self.onmessage / self.postMessage 由此成立）。幂等守卫。
     let si_self = sf.intern("self").0;