feat: 七构造器绑定 Symbol.species 静态访问器

crates/oxide_builtins/src/regexp.rs

@@ -238,8 +238,11 @@ fn species_constructor<H: VmHost>(
     if !c.is_object() {
         return Err(crate::error::create_type_error(vm, "RegExp species constructor must be an object"));
     }
+    // Get(C, @@species) 的 receiver 是构造器 C 本身：访问器 getter 返回
+    // receiver，传实例会让返回值错指到接收者本体。
     let species_key = oxide_types::private_key::make_well_known_symbol_key(10);
-    let s = match vm.ordinary_get(unsafe { &*c.as_js_object_ptr() }, species_key, r_val) {
+    let c_val = JsValue::from_js_object(c.as_js_object_ptr());
+    let s = match vm.ordinary_get(unsafe { &*c.as_js_object_ptr() }, species_key, c_val) {
         Ok(v) => v,
         Err(_) => return Err(crate::iterator::engine_error(vm, "cannot read @@species")),
     };

crates/oxide_vm/src/bindings/bind_array_buffer.rs

@@ -1,7 +1,7 @@
 use std::sync::Arc;
 
 use crate::bind_constructor;
-use crate::bindings::{apply_binding_table, configure_native_constructor};
+use crate::bindings::{apply_binding_table, bind_accessor_getter_key, configure_native_constructor};
 use oxide_kernel::kernel::{KernelCore, KernelSession};
 use oxide_types::object::JsObject;
 
@@ -29,6 +29,17 @@ pub fn bind_array_buffer(core: &Arc<KernelCore>, session: &KernelSession, global
         )],
     );
 
+    // ArrayBuffer[Symbol.species] 访问器：getter 返回 receiver，派生类沿静态原型链
+    // 解析 @@species 得自身构造器（规范不给 class 默认 static @@species，类上无 own）。
+    bind_accessor_getter_key(
+        core,
+        session,
+        ctor,
+        oxide_types::private_key::make_well_known_symbol_key(oxide_types::private_key::WELL_KNOWN_SYMBOL_SPECIES),
+        "get [Symbol.species]",
+        oxide_builtins::array::array_species_get::<crate::vm::Vm> as *const (),
+    );
+
     apply_binding_table(
         session.builtin_world(),
         proto,

crates/oxide_vm/src/bindings/bind_map.rs

@@ -2,7 +2,8 @@ use std::sync::Arc;
 
 use crate::bind_constructor;
 use crate::bindings::{
-    apply_binding_table, bind_accessor_getter, bind_well_known_method_alias, configure_native_constructor,
+    apply_binding_table, bind_accessor_getter, bind_accessor_getter_key, bind_well_known_method_alias,
+    configure_native_constructor,
 };
 use oxide_kernel::kernel::{KernelCore, KernelSession};
 use oxide_types::object::JsObject;
@@ -39,6 +40,17 @@ pub fn bind_map(core: &Arc<KernelCore>, session: &KernelSession, global: &mut Js
     bind_well_known_method_alias(core, proto, "entries", 0);
     bind_accessor_getter(core, session, proto, "size", oxide_builtins::map::map_size::<crate::vm::Vm> as *const ());
 
+    // Map[Symbol.species] 访问器：getter 返回 receiver，派生类沿静态原型链解析
+    // @@species 得自身构造器（规范不给 class 默认 static @@species，类上无 own）。
+    bind_accessor_getter_key(
+        core,
+        session,
+        ctor,
+        oxide_types::private_key::make_well_known_symbol_key(oxide_types::private_key::WELL_KNOWN_SYMBOL_SPECIES),
+        "get [Symbol.species]",
+        oxide_builtins::array::array_species_get::<crate::vm::Vm> as *const (),
+    );
+
     // Map.groupBy 静态方法。
     apply_binding_table(
         session.builtin_world(),

crates/oxide_vm/src/bindings/bind_regexp.rs

@@ -1,7 +1,8 @@
 use std::sync::Arc;
 
 use crate::bindings::{
-    apply_binding_table, bind_accessor_getter, bind_well_known_method, configure_native_constructor,
+    apply_binding_table, bind_accessor_getter, bind_accessor_getter_key, bind_well_known_method,
+    configure_native_constructor,
 };
 use oxide_kernel::kernel::{KernelCore, KernelSession};
 use oxide_types::object::JsObject;
@@ -158,5 +159,16 @@ pub fn bind_regexp(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         1,
     );
 
+    // RegExp[Symbol.species] 访问器：getter 返回 receiver，派生类沿静态原型链解析
+    // @@species 得自身构造器（规范不给 class 默认 static @@species，类上无 own）。
+    bind_accessor_getter_key(
+        core,
+        session,
+        ctor,
+        oxide_types::private_key::make_well_known_symbol_key(oxide_types::private_key::WELL_KNOWN_SYMBOL_SPECIES),
+        "get [Symbol.species]",
+        oxide_builtins::array::array_species_get::<crate::vm::Vm> as *const (),
+    );
+
     bind_constructor!(core, global, "RegExp", ctor_ptr, oxide_builtins::regexp::regexp_constructor::<crate::vm::Vm>, 2, hash: true);
 }

crates/oxide_vm/src/bindings/bind_set.rs

@@ -2,8 +2,8 @@ use std::sync::Arc;
 
 use crate::bind_constructor;
 use crate::bindings::{
-    apply_binding_table, bind_accessor_getter, bind_method_alias, bind_well_known_method_alias,
+    apply_binding_table, bind_accessor_getter, bind_accessor_getter_key, bind_method_alias,
-    configure_native_constructor,
+    bind_well_known_method_alias, configure_native_constructor,
 };
 use oxide_kernel::kernel::{KernelCore, KernelSession};
 use oxide_types::object::JsObject;
@@ -53,5 +53,16 @@ pub fn bind_set(core: &Arc<KernelCore>, session: &KernelSession, global: &mut Js
     bind_well_known_method_alias(core, proto, "values", 0);
     bind_accessor_getter(core, session, proto, "size", oxide_builtins::set::set_size::<crate::vm::Vm> as *const ());
 
+    // Set[Symbol.species] 访问器：getter 返回 receiver，派生类沿静态原型链解析
+    // @@species 得自身构造器（规范不给 class 默认 static @@species，类上无 own）。
+    bind_accessor_getter_key(
+        core,
+        session,
+        ctor,
+        oxide_types::private_key::make_well_known_symbol_key(oxide_types::private_key::WELL_KNOWN_SYMBOL_SPECIES),
+        "get [Symbol.species]",
+        oxide_builtins::array::array_species_get::<crate::vm::Vm> as *const (),
+    );
+
     bind_constructor!(core, global, "Set", ctor_ptr, oxide_builtins::set::set_constructor::<crate::vm::Vm>, 1, hash: true);
 }

crates/oxide_vm/src/bindings/bind_typed_array.rs

@@ -56,6 +56,22 @@ fn bind_typed_array_abstract_ctor(core: &Arc<KernelCore>, session: &KernelSessio
         },
         1,
     );
+
+    // %TypedArray%[Symbol.species] 访问器：getter 返回 receiver，十一具体构造器
+    // （及派生类）沿原型链解析 @@species 得自身（具体构造器无 own 属性）。绑定站
+    // 与 TA 构造器后续消费面改造共用，先查槽位防重复绑定追加第二访问器槽。
+    let species_key =
+        oxide_types::private_key::make_well_known_symbol_key(oxide_types::private_key::WELL_KNOWN_SYMBOL_SPECIES);
+    if core.shape_forge().lookup_position(ctor.shape_id(), species_key).is_none() {
+        bind_accessor_getter_key(
+            core,
+            session,
+            ctor,
+            species_key,
+            "get [Symbol.species]",
+            oxide_builtins::array::array_species_get::<crate::vm::Vm> as *const (),
+        );
+    }
 }
 
 /// 给构造器与对应原型设置 `BYTES_PER_ELEMENT`（只读、不可枚举、不可配置）。

crates/oxide_vm/src/promise/constructor.rs

@@ -264,6 +264,17 @@ impl Vm {
         // prototype 槽位在 length/name 之后（下标 2）。
         ctor_mut.set_prop_at(2u32, JsValue::from_js_object(self.promise_proto.as_ptr() as *mut JsObject));
 
+        // Promise[Symbol.species] 访问器：getter 返回 receiver，派生类沿静态原型链
+        // 解析 @@species 得自身构造器。ctor 经本函数每次调用全新构造，同键槽不累积。
+        crate::bindings::bind_accessor_getter_key(
+            &self.kernel_core,
+            &self.session,
+            ctor_mut,
+            oxide_types::private_key::make_well_known_symbol_key(oxide_types::private_key::WELL_KNOWN_SYMBOL_SPECIES),
+            "get [Symbol.species]",
+            oxide_builtins::array::array_species_get::<crate::vm::Vm> as *const (),
+        );
+
         // 绑定 global：槽已存在则更新（full_reset 未重建 global 时旧槽指向已弃 ctor）。
         let global_ptr = self.session.global_object().as_ptr() as *mut JsObject;
         // SAFETY: global 对象由 session 持有，存活整个 session；本函数内只改其

crates/oxide_vm/tests/builtins_regexp_tests.rs

@@ -802,10 +802,12 @@ fn symbol_split_undefined_limit_full() {
 #[test]
 fn symbol_match_all_species_matcher_and_cached_lastindex() {
     let mut vm = Vm::new();
-    // matcher 经物种构造；lastIndex 只从 R 读一次并写入 matcher。
+    // matcher 经物种构造；lastIndex 只从 R 读一次并写入 matcher。静态 species 是
+    // getter-only 访问器，简单赋值静默失效（set 为 undefined），须 defineProperty
+    // 重定义为数据属性才能覆写。
     let result = eval(
         &mut vm,
-        "(() => { var r = /b/g; r.lastIndex = 2; var ctorCalls = 0; r.constructor[Symbol.species] = function() { ctorCalls += 1; return /b/g; }; var it = r[Symbol.matchAll]('abc'); return ctorCalls + '/' + it.__mal_re__.lastIndex; })()",
+        "(() => { var r = /b/g; r.lastIndex = 2; var ctorCalls = 0; Object.defineProperty(r.constructor, Symbol.species, { value: function() { ctorCalls += 1; return /b/g; }, configurable: true }); var it = r[Symbol.matchAll]('abc'); return ctorCalls + '/' + it.__mal_re__.lastIndex; })()",
     )
     .unwrap();
     assert_eq!(to_str(&vm, result), "1/2");

crates/oxide_vm/tests/builtins_species_tests.rs

@@ -0,0 +1,90 @@
+use std::sync::Arc;
+
+use oxide_compiler::compiler::Compiler;
+use oxide_types::value::JsValue;
+use oxide_vm::vm::Vm;
+
+fn eval(vm: &mut Vm, source: &str) -> Result<JsValue, String> {
+    let allocator = oxide_parser::Allocator::default();
+    let program = oxide_parser::parse(&allocator, source).map_err(|e| format!("Parse error: {:?}", e))?;
+    let module = Compiler::new().compile(&program).map_err(|e| format!("Compile error: {}", e))?;
+    vm.run(&Arc::new(module))
+}
+
+/// 七构造器 `Symbol.species` 静态 getter 的规范描述符面：
+/// `{ get, set:undefined, enumerable:false, configurable:true }`、`get.length === 0`、
+/// `get.name === "get [Symbol.species]"`，getter 返回 receiver。
+fn assert_species_accessor(ctor_name: &str) {
+    let mut vm = Vm::new();
+    let source = format!(
+        "var d = Object.getOwnPropertyDescriptor({ctor_name}, Symbol.species); \
+         d !== undefined && d.set === undefined && d.enumerable === false && d.configurable === true && \
+         typeof d.get === 'function' && d.get.length === 0 && d.get.name === 'get [Symbol.species]' && \
+         d.get.call({ctor_name}) === {ctor_name} && d.get.call('x') === 'x'"
+    );
+    let result = eval(&mut vm, &source).unwrap();
+    assert!(result.as_bool(), "{ctor_name} species accessor descriptor mismatch");
+}
+
+#[test]
+fn array_buffer_species_accessor_descriptor() {
+    assert_species_accessor("ArrayBuffer");
+}
+
+#[test]
+fn map_species_accessor_descriptor() {
+    assert_species_accessor("Map");
+}
+
+#[test]
+fn set_species_accessor_descriptor() {
+    assert_species_accessor("Set");
+}
+
+#[test]
+fn regexp_species_accessor_descriptor() {
+    assert_species_accessor("RegExp");
+}
+
+#[test]
+fn promise_species_accessor_descriptor() {
+    assert_species_accessor("Promise");
+}
+
+#[test]
+fn typed_array_abstract_species_descriptor_and_chain_read() {
+    // 抽象构造器 own 访问器；具体构造器无 own（gOPD 为 undefined），链上读回自身。
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "var d = Object.getOwnPropertyDescriptor(TypedArray, Symbol.species); \
+         d !== undefined && d.set === undefined && d.enumerable === false && d.configurable === true && \
+         d.get.name === 'get [Symbol.species]' && d.get.length === 0 && \
+         TypedArray[Symbol.species] === TypedArray && \
+         Object.getOwnPropertyDescriptor(Uint8Array, Symbol.species) === undefined && \
+         Uint8Array[Symbol.species] === Uint8Array && \
+         Object.getOwnPropertyDescriptor(BigUint64Array, Symbol.species) === undefined && \
+         BigUint64Array[Symbol.species] === BigUint64Array",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+#[test]
+fn species_subclasses_resolve_own_constructor() {
+    // 派生类无 own @@species，沿静态原型链命中基类同一 getter，receiver 为自身。
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "class SubMap extends Map {} \
+         class SubSet extends Set {} \
+         class SubBuf extends ArrayBuffer {} \
+         class SubRe extends RegExp {} \
+         class SubP extends Promise {} \
+         SubMap[Symbol.species] === SubMap && SubSet[Symbol.species] === SubSet && \
+         SubBuf[Symbol.species] === SubBuf && SubRe[Symbol.species] === SubRe && SubP[Symbol.species] === SubP && \
+         Object.getOwnPropertyDescriptor(SubMap, Symbol.species) === undefined",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}