fix: matchAll flags 读走 Get 语义传播 getter 抛错

crates/oxide_builtins/src/regexp.rs

@@ -105,7 +105,7 @@ fn rx_set_prop<H: VmHost>(
 
 /// live 语义读 flags 串：ToString(Get(rx, "flags"))，getter 抛错与
 /// ToString 抛错均传播原异常。
-fn rx_get_flags<H: VmHost>(vm: &mut H, rx: *mut JsObject, this_val: JsValue) -> Result<String, JsValue> {
+pub fn rx_get_flags<H: VmHost>(vm: &mut H, rx: *mut JsObject, this_val: JsValue) -> Result<String, JsValue> {
     let val = rx_get_prop(vm, rx, "flags", this_val)?;
     // 回退文案用原始文本（"TypeError: " 前缀恢复错误种类）。
     let s = match oxide_runtime_api::to_string_value_full(val, vm) {

crates/oxide_builtins/src/string/regex.rs

@@ -789,9 +789,12 @@ pub fn string_match_all<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
 
     let re_obj = if is_regexp_obj(pattern_val, vm) {
         let re_ptr = pattern_val.as_js_object_ptr();
-        let re = unsafe { &*re_ptr };
+        // 规范：Get(rx, "flags") → ToString → 含 "g" 判定；getter 抛错传播。
-        let is_global = crate::regexp::regexp_has_flag(vm, re, 'g');
+        let flags = match crate::regexp::rx_get_flags(vm, re_ptr, pattern_val) {
-        if !is_global {
+            Ok(f) => f,
+            Err(e) => return NativeResult::Err(e),
+        };
+        if !flags.contains('g') {
             return NativeResult::Err(crate::error::create_type_error(
                 vm,
                 "String.prototype.matchAll: regex must have global flag",