fix: strict 删除非可配置属性抛错并修正数组长度

crates/oxide_vm/src/dispatch/property.rs

@@ -649,10 +649,10 @@ impl Vm {
             return Ok(false);
         };
         let obj = unsafe { &mut *obj_ptr };
-        // 统一走共享删除逻辑（与 Reflect.deleteProperty 一致）；不可配置返回 false。
-        let deleted = oxide_builtins::object::delete_own_property(self, obj, prop_name_si);
-        self.regs[rd] = JsValue::bool(deleted);
-        Ok(false)
+        // 统一走共享删除逻辑（与 Reflect.deleteProperty 同源）；严格模式分派见
+        // finish_member_delete。
+        let outcome = oxide_builtins::object::delete_own_property_outcome(self, obj, prop_name_si);
+        self.finish_member_delete(rd, outcome)
     }
 
     pub(crate) fn dispatch_delete_prop_dynamic(&mut self, rd: usize, b: usize) -> Result<bool, String> {
@@ -667,9 +667,33 @@ impl Vm {
             return Ok(false);
         };
         let obj = unsafe { &mut *obj_ptr };
-        // 统一走共享删除逻辑（与 Reflect.deleteProperty 一致）；不可配置返回 false。
-        let deleted = oxide_builtins::object::delete_own_property(self, obj, prop_name_si);
-        self.regs[rd] = JsValue::bool(deleted);
+        // 统一走共享删除逻辑（与 Reflect.deleteProperty 同源）；严格模式分派见
+        // finish_member_delete。
+        let outcome = oxide_builtins::object::delete_own_property_outcome(self, obj, prop_name_si);
+        self.finish_member_delete(rd, outcome)
+    }
+
+    /// 成员形 delete 的结果分派：不可配置属性在严格模式抛 TypeError（规范要求
+    /// delete 运算符对 [[Delete]] 返回 false 的引用抛错），其余情形把「是否删除
+    /// 成功」写入 `rd`。
+    ///
+    /// # 步骤
+    /// 1. 不可配置且当前上下文严格：抛 TypeError，返回 `Ok(true)` 令调用方重取 pc
+    /// 2. 否则按三态投影布尔结果写 `rd`（`Missing`/`Deleted` 为 true）
+    ///
+    /// # 边界与前提
+    /// - 严格性取 `current_strict()`（覆盖帧栈顶 / inline 基线 / 顶层脚本三形态）
+    ///
+    /// # 副作用
+    /// - 抛错路径经 `unwind` 改写 pc / 异常通道；成功路径写 `regs[rd]`
+    fn finish_member_delete(
+        &mut self, rd: usize, outcome: oxide_builtins::object::DeleteOutcome,
+    ) -> Result<bool, String> {
+        if outcome == oxide_builtins::object::DeleteOutcome::NonConfigurable && self.current_strict() {
+            self.raise_type_error("Cannot delete property")?;
+            return Ok(true);
+        }
+        self.regs[rd] = JsValue::bool(outcome != oxide_builtins::object::DeleteOutcome::NonConfigurable);
         Ok(false)
     }
 

crates/oxide_vm/src/vm/props.rs

@@ -117,19 +117,24 @@ impl Vm {
     /// true。
     ///
     /// # 步骤
-    /// 1. null/undefined 基抛 TypeError（调用方经 `?` 传播异常）
+    /// 1. null/undefined 基抛 TypeError 并早返回（异常已展开，不再写结果槽）
     /// 2. 字符串基按下标键区间判自身属性；非字符串基恒真
-    /// 3. 布尔结果写 `rd` 槽（与对象基臂同槽位）
+    /// 3. 严格模式下删除失败（字符串下标/length 不可配置）抛 TypeError
+    /// 4. 布尔结果写 `rd` 槽（与对象基臂同槽位）
     ///
     /// # 边界与前提
     /// - 调用点已证基非对象；对象基走既有对象臂，不进本函数
     /// - 字符串长度口径按 UTF-16 码元（与字符串自身属性面一致）；非规范数字串
     ///   键（前导零等）与 symbol 键走"无自身属性"面
+    ///
+    /// # 副作用
+    /// - 抛错路径经 `unwind` 改写 pc / 异常通道；成功路径写 `regs[rd]`
     pub(crate) fn delete_prop_non_object_base(
         &mut self, base: JsValue, rd: usize, key_si: u32,
     ) -> Result<bool, String> {
         if base.is_null() || base.is_undefined() {
-            self.raise_error_kind("TypeError", "delete on non-object")?;
+            self.raise_type_error("delete on non-object")?;
+            return Ok(true);
         }
         let deleted = if base.is_string() {
             let len = unsafe { (*base.as_string_ptr()).units().len() };
@@ -141,6 +146,11 @@ impl Vm {
         } else {
             true
         };
+        // 删除失败即命中不可配置自身属性，严格模式下 delete 运算符须抛 TypeError。
+        if !deleted && self.current_strict() {
+            self.raise_type_error("Cannot delete property")?;
+            return Ok(true);
+        }
         self.regs[rd] = JsValue::bool(deleted);
         Ok(false)
     }

crates/oxide_vm/tests/delete_prop_primitive_base_tests.rs

@@ -91,3 +91,23 @@ fn delete_undefined_base_throws_type_error() {
 fn delete_nan_base_keys_are_true() {
     truthy("delete NaN.x");
 }
+
+// ── 严格模式：删除字符串不可配置下标属性抛 TypeError ──
+#[test]
+fn strict_delete_string_index_throws_type_error() {
+    truthy(
+        "\"use strict\"; \
+         var threw = false; try { delete 'ab'[0]; } catch (e) { threw = e instanceof TypeError; } \
+         threw",
+    );
+}
+
+// ── 严格模式：删除字符串 length 抛 TypeError ──
+#[test]
+fn strict_delete_string_length_throws_type_error() {
+    truthy(
+        "\"use strict\"; \
+         var threw = false; try { delete 'abc'.length; } catch (e) { threw = e instanceof TypeError; } \
+         threw",
+    );
+}

crates/oxide_vm/tests/property_delete_tests.rs

@@ -17,6 +17,11 @@ fn eval_many(lines: &[&str]) -> Result<JsValue, String> {
     eval(&source)
 }
 
+fn truthy(source: &str) {
+    let result = eval(source).unwrap_or_else(|e| panic!("{source} -> {e}"));
+    assert!(result.is_bool() && result.as_bool(), "{source} -> 期望 true，得 {:?}", result);
+}
+
 // ── 删除可配置属性成功 ──
 #[test]
 fn delete_configurable_property_succeeds_and_returns_true() {
@@ -93,3 +98,98 @@ fn delete_configurable_proto_property_on_child_returns_true() {
         r
     );
 }
+
+// ── 严格模式：不可配置数据属性抛 TypeError 且属性保留 ──
+#[test]
+fn strict_delete_non_configurable_data_throws_type_error() {
+    truthy(
+        "\"use strict\"; var o = {}; \
+         Object.defineProperty(o, 'x', {value: 1, configurable: false}); \
+         var threw = false; try { delete o.x; } catch (e) { threw = e instanceof TypeError; } \
+         threw && o.x === 1",
+    );
+}
+
+// ── 严格模式：不可配置访问器属性同样抛 TypeError 且 getter 保留 ──
+#[test]
+fn strict_delete_non_configurable_accessor_throws_type_error() {
+    truthy(
+        "\"use strict\"; var o = {}; \
+         Object.defineProperty(o, 'x', {get: function () { return 1; }, configurable: false}); \
+         var threw = false; try { delete o.x; } catch (e) { threw = e instanceof TypeError; } \
+         threw && o.x === 1",
+    );
+}
+
+// ── 严格模式：删除全局不可配置内置属性（NaN）抛 TypeError ──
+#[test]
+fn strict_delete_global_nan_throws_type_error() {
+    truthy(
+        "\"use strict\"; var g = this; \
+         var threw = false; try { delete g.NaN; } catch (e) { threw = e instanceof TypeError; } \
+         threw && g.NaN !== undefined",
+    );
+}
+
+// ── 严格模式：删除 Math.LN2 抛 TypeError ──
+#[test]
+fn strict_delete_math_ln2_throws_type_error() {
+    truthy(
+        "\"use strict\"; \
+         var threw = false; try { delete Math.LN2; } catch (e) { threw = e instanceof TypeError; } \
+         threw && Math.LN2 !== undefined",
+    );
+}
+
+// ── 严格模式：可配置属性仍可删除 ──
+#[test]
+fn strict_delete_configurable_property_succeeds() {
+    truthy(
+        "\"use strict\"; var o = {}; \
+         Object.defineProperty(o, 'x', {value: 1, configurable: true}); \
+         delete o.x === true && o.x === undefined",
+    );
+}
+
+// ── 严格模式：删除不存在的属性返回 true（不得过抛） ──
+#[test]
+fn strict_delete_missing_property_returns_true() {
+    truthy("\"use strict\"; var o = {}; delete o.missing === true");
+}
+
+// ── 数组 length 虚拟属性：sloppy 删除返回 false 且 length 不变 ──
+#[test]
+fn sloppy_delete_array_length_returns_false() {
+    truthy("var a = [1, 2, 3]; a.x = 10; delete a.length === false && a.length === 3");
+}
+
+// ── 数组 length 虚拟属性：严格模式删除抛 TypeError 且 length 不变 ──
+#[test]
+fn strict_delete_array_length_throws_type_error() {
+    truthy(
+        "\"use strict\"; var a = [1, 2, 3]; \
+         var threw = false; try { delete a.length; } catch (e) { threw = e instanceof TypeError; } \
+         threw && a.length === 3",
+    );
+}
+
+// ── 冻结数组元素不可配置：严格模式删除抛 TypeError 且元素保留 ──
+#[test]
+fn strict_delete_frozen_array_element_throws_type_error() {
+    truthy(
+        "\"use strict\"; var a = [1, 2, 3]; Object.freeze(a); \
+         var threw = false; try { delete a[0]; } catch (e) { threw = e instanceof TypeError; } \
+         threw && a[0] === 1",
+    );
+}
+
+// ── Reflect.deleteProperty 恒不抛：不可配置与数组 length 均返回 false ──
+#[test]
+fn reflect_delete_non_configurable_and_array_length_return_false() {
+    truthy(
+        "var o = {}; Object.defineProperty(o, 'x', {value: 1, configurable: false}); \
+         var a = [1, 2, 3]; \
+         Reflect.deleteProperty(o, 'x') === false && o.x === 1 \
+         && Reflect.deleteProperty(a, 'length') === false && a.length === 3",
+    );
+}