From 9a161290f31a708ec37ed1a1d4239f249030a3b4 Mon Sep 17 00:00:00 2001
From: pjh456 <147148383@qq.com>
Date: Wed, 23 Sep 2026 22:25:16 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20transferToImmutable=20=E6=98=BE=E5=BC=8F?=
 =?UTF-8?q?=20undefined=20=E9=95=BF=E5=BA=A6=E5=8F=82=E6=95=B0=E5=9B=9E?=
 =?UTF-8?q?=E8=90=BD=E6=BA=90=E5=AD=97=E8=8A=82=E9=95=BF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/oxide_builtins/src/array_buffer.rs           |  7 +++++--
 .../oxide_vm/tests/builtins_array_buffer_tests.rs   | 13 +++++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/crates/oxide_builtins/src/array_buffer.rs b/crates/oxide_builtins/src/array_buffer.rs
index 0b37e6a4..e1d2399e 100644
--- a/crates/oxide_builtins/src/array_buffer.rs
+++ b/crates/oxide_builtins/src/array_buffer.rs
@@ -935,8 +935,8 @@ enum TransferKeep {
 ///
 /// # 步骤
 /// 1. this 品牌校验（非对象/非 ArrayBuffer → TypeError）。
-/// 2. newLength 缺省 → 源当前字节长；在场 → ToIndex 传播式（强转副作用
-///    先于一切守卫观测）。
+/// 2. newLength 缺省（含显式 undefined）→ 源当前字节长；其余在场 → ToIndex
+///    传播式（强转副作用先于一切守卫观测）。
 /// 3. 重取源载荷指针（求值可已晋升/detach/改 immutable），重检状态位：
 ///    detached → TypeError；immutable → TypeError。
 /// 4. 界校验：仅保持性原样臂——resizable 源且 newByteLength > 真实上限
@@ -957,7 +957,10 @@ fn array_buffer_copy_and_detach<H: VmHost>(
     // 只读当前字节长，借用即结束，不跨 JS 调用点。
     let cur_len = unsafe { &*payload_ptr }.data.as_ref().map_or(0, |d| d.len());
     let new_len = match new_length {
+        // undefined 缺省臂（含显式 undefined）先于 ToIndex：显式 undefined 与
+        // 缺省同义，直接取源当前字节长。
         None => cur_len,
+        Some(v) if v.is_undefined() => cur_len,
         Some(v) => native_try!(to_index(vm, v)),
     };
     // 求值可已把本缓冲区晋升进 session、detach 或置 immutable：接收者寄存器
diff --git a/crates/oxide_vm/tests/builtins_array_buffer_tests.rs b/crates/oxide_vm/tests/builtins_array_buffer_tests.rs
index eab4e6f3..1bb1815d 100644
--- a/crates/oxide_vm/tests/builtins_array_buffer_tests.rs
+++ b/crates/oxide_vm/tests/builtins_array_buffer_tests.rs
@@ -72,6 +72,19 @@ fn array_buffer_negative_length_throws_range_error() {
     assert!(result.as_bool());
 }
 
+// newLength 缺省（含显式 undefined）保持源当前字节长：两臂同钉。
+#[test]
+fn array_buffer_transfer_to_immutable_default_keeps_byte_length() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "var a = new ArrayBuffer(8); var b = new ArrayBuffer(8); \
+         a.transferToImmutable(undefined).byteLength === 8 && b.transferToImmutable().byteLength === 8",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
 #[test]
 fn array_buffer_to_string_is_identifiable() {
     let mut vm = Vm::new();