From 926d907965f45bdad489227a1f18aa9ade0383a6 Mon Sep 17 00:00:00 2001
From: pjh456 <147148383@qq.com>
Date: Sun, 16 Aug 2026 12:34:14 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E9=97=AD=E5=8C=85=E9=93=BE=E5=BC=8F?=
 =?UTF-8?q?=E6=8D=95=E8=8E=B7=E8=B6=8A=E7=95=8C=E6=94=B9=E7=BC=96=E8=AF=91?=
 =?UTF-8?q?=E9=94=99=E8=AF=AF=E6=97=A9=E6=9A=B4=E9=9C=B2=E9=98=B2=E9=9D=99?=
 =?UTF-8?q?=E9=BB=98=E9=94=99=E5=80=BC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/oxide_vm/src/dispatch/call.rs | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/crates/oxide_vm/src/dispatch/call.rs b/crates/oxide_vm/src/dispatch/call.rs
index 1fbc115d..d66b15d1 100644
--- a/crates/oxide_vm/src/dispatch/call.rs
+++ b/crates/oxide_vm/src/dispatch/call.rs
@@ -153,7 +153,18 @@ impl Vm {
                 let mut upvals = Box::new(Vec::with_capacity(upvalue_captures.len()));
                 for capture in &upvalue_captures {
                     let cell_ptr = if let Some(puv) = capture.parent_uv_idx {
-                        parent_upvalues.get(puv as usize).copied().unwrap_or(std::ptr::null_mut())
+                        match parent_upvalues.get(puv as usize) {
+                            Some(&ptr) => ptr,
+                            // parent_uv_idx 由编译期按父 upvalue 表位置计算，越界即
+                            // 捕获编码错位——Err 早暴露，避免落惰性路径读到错层 cell。
+                            None => {
+                                return Err(format!(
+                                    "CREATE_CLOSURE: parent upvalue index {} out of bounds (parent has {})",
+                                    puv,
+                                    parent_upvalues.len()
+                                ));
+                            }
+                        }
                     } else {
                         let cell_idx = capture.cell_idx as usize;
                         if cell_idx >= current_cells.len() {