fix: 装箱对象被包基元改专属载荷字段免槽位错位

crates/oxide_builtins/src/bigint.rs

@@ -170,7 +170,7 @@ fn this_bigint_value<H: VmHost>(vm: &mut H, this_val: JsValue) -> Result<JsValue
                 let bigint_proto =
                     vm.session().builtin_world().bigint_proto.as_ptr() as *mut oxide_types::object::JsObject;
                 if !proto_ptr.is_null() && std::ptr::eq(proto_ptr, bigint_proto) {
-                    let v = obj.get_prop_at(0);
+                    let v = obj.boxed_value();
                     if v.is_bigint() {
                         return Ok(v);
                     }

crates/oxide_builtins/src/boolean.rs

@@ -48,7 +48,7 @@ pub fn boolean_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
 
     let obj = unsafe { &mut *this_val.as_js_object_ptr() };
     obj.type_tag = JsObject::OBJ_TYPE_BOOLEAN_OBJ;
-    obj.push_prop(JsValue::bool(bool_val));
+    obj.set_boxed_value(JsValue::bool(bool_val));
     NativeResult::Ok(this_val)
 }
 
@@ -72,7 +72,7 @@ pub fn boolean_prototype_value_of<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeR
             "Boolean.prototype.valueOf called on non-Boolean object",
         ));
     }
-    let val = obj.get_prop_at(0);
+    let val = obj.boxed_value();
     NativeResult::Ok(val)
 }
 
@@ -100,7 +100,7 @@ pub fn boolean_prototype_to_string<H: VmHost>(vm: &mut H, args: &[u8]) -> Native
             "Boolean.prototype.toString called on non-Boolean object",
         ));
     }
-    let val = obj.get_prop_at(0);
+    let val = obj.boxed_value();
     let is_true = if val.is_bool() {
         val.as_bool()
     } else {

crates/oxide_builtins/src/number.rs

@@ -46,7 +46,7 @@ pub fn number_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         } else {
             JsValue::float(n)
         };
-        obj.set_prop_at(0, boxed);
+        obj.set_boxed_value(boxed);
         return NativeResult::Ok(this_val);
     }
 
@@ -514,7 +514,7 @@ pub fn number_value_of<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
             }
             let obj = unsafe { &*ptr };
             if obj.is_number_obj() {
-                return NativeResult::Ok(obj.get_prop_at(0));
+                return NativeResult::Ok(obj.boxed_value());
             }
         }
     }

crates/oxide_builtins/src/object.rs

@@ -431,7 +431,7 @@ pub fn object_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto)));
         let obj_ref = unsafe { &mut *obj };
         obj_ref.type_tag = JsObject::OBJ_TYPE_NUMBER_OBJ;
-        obj_ref.set_prop_at(0, val);
+        obj_ref.set_boxed_value(val);
         return NativeResult::Ok(JsValue::from_js_object(obj));
     }
     if val.is_string() {
@@ -447,7 +447,7 @@ pub fn object_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto)));
         let obj_ref = unsafe { &mut *obj };
         obj_ref.type_tag = JsObject::OBJ_TYPE_BOOLEAN_OBJ;
-        obj_ref.set_prop_at(0, val);
+        obj_ref.set_boxed_value(val);
         return NativeResult::Ok(JsValue::from_js_object(obj));
     }
     if val.is_symbol() {
@@ -455,14 +455,14 @@ pub fn object_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto)));
         let obj_ref = unsafe { &mut *obj };
         obj_ref.type_tag = JsObject::OBJ_TYPE_SYMBOL_OBJ;
-        obj_ref.set_prop_at(0, val);
+        obj_ref.set_boxed_value(val);
         return NativeResult::Ok(JsValue::from_js_object(obj));
     }
     if val.is_bigint() {
         let proto = vm.session().builtin_world().bigint_proto.as_ptr() as *mut JsObject;
         let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto)));
         let obj_ref = unsafe { &mut *obj };
-        obj_ref.set_prop_at(0, val);
+        obj_ref.set_boxed_value(val);
         return NativeResult::Ok(JsValue::from_js_object(obj));
     }
     let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(object_proto)));

crates/oxide_builtins/src/symbol.rs

@@ -53,7 +53,7 @@ pub fn symbol_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
 
 /// `Symbol.prototype.toString`：返回 `Symbol(description)` 形式字符串。
 /// this 必须是 Symbol，否则抛 TypeError。
-/// thisSymbolValue：Symbol 原样返回；包装对象解盒（prop 0 存原始 Symbol）；其它类型 TypeError。
+/// thisSymbolValue：Symbol 原样返回；包装对象解盒（专属载荷字段存原始 Symbol）；其它类型 TypeError。
 fn this_symbol_value<H: VmHost>(vm: &mut H, this_val: JsValue) -> Result<JsValue, JsValue> {
     if this_val.is_symbol() {
         return Ok(this_val);
@@ -67,7 +67,7 @@ fn this_symbol_value<H: VmHost>(vm: &mut H, this_val: JsValue) -> Result<JsValue
                 let symbol_proto =
                     vm.session().builtin_world().symbol_proto.as_ptr() as *mut oxide_types::object::JsObject;
                 if !proto_ptr.is_null() && std::ptr::eq(proto_ptr, symbol_proto) {
-                    let v = obj.get_prop_at(0);
+                    let v = obj.boxed_value();
                     if v.is_symbol() {
                         return Ok(v);
                     }

crates/oxide_runtime_api/src/coercion.rs

@@ -741,7 +741,9 @@ pub fn strict_equality(lhs: JsValue, rhs: JsValue) -> bool {
 
 /// ToObject（ECMA-262 §7.1.13）：null/undefined 抛 TypeError，其余原始值包装为对应包装对象。
 ///
-/// 包装对象按类型选择原型（String/Number/Boolean 原型或默认 Object 原型），原始值存入 hash props 槽。
+/// 包装对象按类型选择原型（String/Number/Boolean 原型或默认 Object 原型）；
+/// 被包基元写入对象专属载荷字段，不占命名属性区。字符串盒暂仍预存属性区
+/// 槽 0——其消费面（解盒读原始串）与规范固有属性面同批切换，两端不可分拆。
 pub fn to_object<H: VmHost>(val: JsValue, host: &mut H) -> Result<JsValue, String> {
     if val.is_object() {
         return Ok(val);
@@ -768,8 +770,12 @@ pub fn to_object<H: VmHost>(val: JsValue, host: &mut H) -> Result<JsValue, Strin
     let obj_val = JsValue::from_js_object(obj);
     let obj_ref = unsafe { &mut *obj };
     obj_ref.type_tag = type_tag;
-    obj_ref.ensure_hash_props().push(val);
-    obj_ref.set_prop_count(1);
+    if val.is_string() {
+        obj_ref.ensure_hash_props().push(val);
+        obj_ref.set_prop_count(1);
+    } else {
+        obj_ref.set_boxed_value(val);
+    }
     Ok(obj_val)
 }
 

crates/oxide_types/src/object.rs

@@ -82,10 +82,11 @@ pub const MAX_DENSE_PROPS: usize = 1_000_000;
 ///   table_gen: u32 (4 字节，创建期所属子模块平表的表代际)
 ///   captured_this: JsValue (8 字节，箭头函数的词法 this)
 ///   home_object: JsValue (8 字节，\[\[HomeObject\]\]，供 super 查找)
+///   boxed_value: JsValue (8 字节，装箱对象的被包基元载荷，见字段注释)
 ///   upvalues: *mut u8 (8 字节，指向闭包的 Box<Vec<*mut Cell>>)
 ///
-///   字段自和：116 字节，另有 4 字节对齐填充（native_fn 之前）
-///   总计：120 字节
+///   字段自和：124 字节，另有 4 字节对齐填充（native_fn 之前）
+///   总计：128 字节
 ///   对齐：8 字节
 pub struct JsObject {
     header: u32,
@@ -126,6 +127,11 @@ pub struct JsObject {
     table_gen: u32,
     captured_this: JsValue,
     home_object: JsValue,
+    /// 装箱基元对象（Number/String/Boolean/Symbol 盒与 BigInt 包装）的被包
+    /// 基元载荷：构造期直接写入本字段，不占用命名属性区——属性区存储位与
+    /// shape 槽位保持恒等映射，后续索引/命名属性写读不干扰被包值。
+    /// 未装箱对象恒为 undefined。
+    boxed_value: JsValue,
     pub upvalues: *mut u8,
 }
 
@@ -375,6 +381,7 @@ impl JsObject {
             table_gen: 0,
             captured_this: JsValue::undefined(),
             home_object: JsValue::undefined(),
+            boxed_value: JsValue::undefined(),
             upvalues: std::ptr::null_mut(),
         }
     }
@@ -401,6 +408,7 @@ impl JsObject {
             table_gen: 0,
             captured_this: JsValue::undefined(),
             home_object: JsValue::undefined(),
+            boxed_value: JsValue::undefined(),
             upvalues: std::ptr::null_mut(),
         };
         let vec = Box::new(vec![JsValue::undefined(); n_elements.min(MAX_DENSE_PROPS)]);
@@ -499,6 +507,7 @@ impl JsObject {
             table_gen: self.table_gen,
             captured_this: self.captured_this,
             home_object: self.home_object,
+            boxed_value: self.boxed_value,
             upvalues: self.upvalues,
         }
     }
@@ -641,6 +650,9 @@ impl JsObject {
         if self.home_object.is_object() {
             self.home_object = rewrite(self.home_object);
         }
+        if self.boxed_value.is_object() {
+            self.boxed_value = rewrite(self.boxed_value);
+        }
         if !self.upvalues.is_null() {
             let cells = unsafe { &mut *(self.upvalues as *mut Vec<*mut Cell>) };
             for cell_ptr in cells {
@@ -943,6 +955,20 @@ impl JsObject {
     pub fn set_home_object(&mut self, v: JsValue) {
         self.home_object = v;
     }
+
+    /// 装箱对象的被包基元载荷（未装箱对象为 undefined）。
+    pub fn boxed_value(&self) -> JsValue {
+        self.boxed_value
+    }
+
+    /// 设置装箱对象的被包基元载荷。
+    ///
+    /// # 注意事项
+    /// 仅供装箱构造点调用：写入前对象须尚未进入属性读写路径，
+    /// 载荷不参与 shape/属性区，写后不得再经属性区预存同一值。
+    pub fn set_boxed_value(&mut self, v: JsValue) {
+        self.boxed_value = v;
+    }
 }
 
 #[cfg(test)]

crates/oxide_vm/src/session_gc.rs

@@ -162,6 +162,7 @@ impl SessionGc {
         Self::process_edge(obj.proto(), vm, stack, live_strings, live_bigints);
         Self::process_edge(obj.captured_this(), vm, stack, live_strings, live_bigints);
         Self::process_edge(obj.home_object(), vm, stack, live_strings, live_bigints);
+        Self::process_edge(obj.boxed_value(), vm, stack, live_strings, live_bigints);
         if obj.is_map() {
             for value in map::map_native_edges(obj) {
                 Self::process_edge(value, vm, stack, live_strings, live_bigints);
@@ -329,6 +330,9 @@ impl SessionGc {
         if obj.home_object().is_string() {
             Self::mark_string_live(live, obj.home_object().as_string_ptr_mut());
         }
+        if obj.boxed_value().is_string() {
+            Self::mark_string_live(live, obj.boxed_value().as_string_ptr_mut());
+        }
         // 扫描 upvalue cell 中的字符串引用。
         for cell_ptr in obj.upvalues_slice() {
             if cell_ptr.is_null() {

crates/oxide_vm/tests/boxed_primitive_prop_tests.rs

@@ -0,0 +1,137 @@
+//! 装箱基元对象（Number/Boolean/Symbol/BigInt 盒）索引写读回钉：
+//! 构造期被包基元住专属载荷字段而非属性区，后续索引/命名属性写读与
+//! 被包值互不干扰，值与 node 实测一致。
+
+use std::sync::Arc;
+
+use oxide_compiler::compiler::Compiler;
+use oxide_types::value::JsValue;
+use oxide_vm::vm::Vm;
+
+fn eval(vm: &mut Vm, source: &str) -> Result<JsValue, String> {
+    let allocator = oxide_parser::Allocator::default();
+    let program = oxide_parser::parse(&allocator, source).map_err(|e| format!("Parse error: {:?}", e))?;
+    let module = Compiler::new().compile(&program).map_err(|e| format!("Compile error: {}", e))?;
+    vm.run(&Arc::new(module))
+}
+
+/// 读数组结果第 i 个元素（结果必为数组）。
+fn elem(result: JsValue, i: usize) -> JsValue {
+    let obj = unsafe { &*result.as_js_object_ptr() };
+    obj.get_prop_at(i)
+}
+
+#[test]
+fn boxed_number_fresh_box_has_no_index_payload() {
+    // fresh 盒无自有属性：0 键不存在、索引读 undefined、被包值经 Number 还原、
+    // 自有属性名空。
+    let mut vm = Vm::new();
+    let r = eval(
+        &mut vm,
+        "[0 in Object(5), Object(5)[0], Number(Object(5)), Object.getOwnPropertyNames(Object(5)).length]",
+    )
+    .unwrap();
+    let v0 = elem(r, 0);
+    assert!(v0.is_bool() && !v0.as_bool(), "0 in Object(5) 应为 false");
+    assert!(elem(r, 1).is_undefined(), "Object(5)[0] 应为 undefined");
+    assert_eq!(elem(r, 2).as_int(), 5, "Number(Object(5)) 应为 5");
+    assert_eq!(elem(r, 3).as_int(), 0, "自有属性名应为空");
+}
+
+#[test]
+fn boxed_number_index_write_reads_written_value() {
+    let mut vm = Vm::new();
+    let r = eval(&mut vm, "var o = Object(5); o[0] = 77; [0 in o, o[0], Number(o)]").unwrap();
+    let v0 = elem(r, 0);
+    assert!(v0.is_bool() && v0.as_bool(), "写后 0 in o 应为 true");
+    assert_eq!(elem(r, 1).as_int(), 77, "o[0] 应读回写入值 77");
+    assert_eq!(elem(r, 2).as_int(), 5, "Number(o) 应保持被包值 5");
+}
+
+#[test]
+fn boxed_number_repeated_index_write_keeps_payload() {
+    // 二次写命中同一键：读回最新写入值，被包基元不被覆写。
+    let mut vm = Vm::new();
+    let r = eval(&mut vm, "var o = Object(5); o[0] = 77; o[0] = 99; [o[0], Number(o)]").unwrap();
+    assert_eq!(elem(r, 0).as_int(), 99, "o[0] 应读回 99");
+    assert_eq!(elem(r, 1).as_int(), 5, "被包值应仍为 5");
+}
+
+#[test]
+fn boxed_number_named_keys_not_shifted() {
+    let mut vm = Vm::new();
+    let r = eval(&mut vm, "var o = Object(5); o.a = 1; o.b = 2; [o.a, o.b]").unwrap();
+    assert_eq!(elem(r, 0).as_int(), 1, "o.a 应为 1");
+    assert_eq!(elem(r, 1).as_int(), 2, "o.b 应为 2");
+}
+
+#[test]
+fn boxed_number_non_index_key_read_write() {
+    let mut vm = Vm::new();
+    let r = eval(&mut vm, "var o = Object(5); o.x = 1; o.x").unwrap();
+    assert_eq!(r.as_int(), 1, "o.x 应读回 1");
+}
+
+#[test]
+fn boxed_number_out_of_range_index_absent() {
+    let mut vm = Vm::new();
+    let r = eval(&mut vm, "var o = Object(5); o[0] = 77; [1 in o, 5 in o]").unwrap();
+    let v0 = elem(r, 0);
+    assert!(v0.is_bool() && !v0.as_bool(), "1 in o 应为 false");
+    let v1 = elem(r, 1);
+    assert!(v1.is_bool() && !v1.as_bool(), "5 in o 应为 false");
+}
+
+#[test]
+fn boxed_boolean_index_write_reads_written_value() {
+    let mut vm = Vm::new();
+    let r = eval(&mut vm, "var t = Object(true); t[0] = 'x'; [t[0], Boolean(t)]").unwrap();
+    assert_eq!(vm.lookup_str(elem(r, 0)).unwrap(), "x", "t[0] 应读回 'x'");
+    assert!(elem(r, 1).as_bool(), "Boolean(t) 应保持 true");
+}
+
+#[test]
+fn boxed_float_index_write_reads_written_value() {
+    let mut vm = Vm::new();
+    let r = eval(&mut vm, "var f = Object(1.5); f[0] = 'x'; [f[0], Number(f)]").unwrap();
+    assert_eq!(vm.lookup_str(elem(r, 0)).unwrap(), "x", "f[0] 应读回 'x'");
+    assert_eq!(elem(r, 1).as_double(), 1.5, "Number(f) 应保持 1.5");
+}
+
+#[test]
+fn boxed_bigint_index_write_reads_written_value() {
+    let mut vm = Vm::new();
+    let r = eval(&mut vm, "var bb = Object(1n); bb[0] = 9; [bb[0], BigInt(bb)]").unwrap();
+    assert_eq!(elem(r, 0).as_int(), 9, "bb[0] 应读回 9");
+    assert!(elem(r, 1).is_bigint(), "BigInt(bb) 应为 BigInt");
+    assert_eq!(vm.bigint_value(elem(r, 1)), &num_bigint::BigInt::from(1), "BigInt(bb) 应为 1n");
+}
+
+#[test]
+fn boxed_symbol_index_write_reads_written_value() {
+    // Symbol 盒消费面（thisSymbolValue 解盒）同批切换，索引写读与其互不干扰。
+    let mut vm = Vm::new();
+    let r = eval(
+        &mut vm,
+        "var s = Object(Symbol('d')); s[0] = 7; [s[0], Symbol.prototype.toString.call(s)]",
+    )
+    .unwrap();
+    assert_eq!(elem(r, 0).as_int(), 7, "s[0] 应读回 7");
+    assert_eq!(vm.lookup_str(elem(r, 1)).unwrap(), "Symbol(d)", "解盒 toString 应保持 Symbol(d)");
+}
+
+#[test]
+fn boxed_primitive_existing_guards_hold() {
+    // 既有面守卫：构造器装箱、valueOf、typeof、toString tag 面不随本次机制变化。
+    let mut vm = Vm::new();
+    let r = eval(
+        &mut vm,
+        "[+new Number(1), new Number(5).valueOf(), typeof new Number(5), Object.prototype.toString.call(Object(5))]",
+    )
+    .unwrap();
+    // 一元 + 结果按引擎算术面为 double 表示（数值相等，显示同 int）。
+    assert_eq!(elem(r, 0).as_double(), 1.0, "+new Number(1) 应为 1");
+    assert_eq!(elem(r, 1).as_int(), 5, "valueOf 应返回 5");
+    assert_eq!(vm.lookup_str(elem(r, 2)).unwrap(), "object", "typeof 应为 object");
+    assert_eq!(vm.lookup_str(elem(r, 3)).unwrap(), "[object Number]", "toString tag 应为 [object Number]");
+}