fix: 装箱对象被包基元改专属载荷字段免槽位错位

crates/oxide_builtins/src/bigint.rs

@@ -170,7 +170,7 @@ fn this_bigint_value<H: VmHost>(vm: &mut H, this_val: JsValue) -> Result<JsValue
                 let bigint_proto =
                     vm.session().builtin_world().bigint_proto.as_ptr() as *mut oxide_types::object::JsObject;
                 if !proto_ptr.is_null() && std::ptr::eq(proto_ptr, bigint_proto) {
-                    let v = obj.get_prop_at(0);
+                    let v = obj.boxed_value();
                     if v.is_bigint() {
                         return Ok(v);
                     }

crates/oxide_builtins/src/boolean.rs

@@ -48,7 +48,7 @@ pub fn boolean_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
 
     let obj = unsafe { &mut *this_val.as_js_object_ptr() };
     obj.type_tag = JsObject::OBJ_TYPE_BOOLEAN_OBJ;
-    obj.push_prop(JsValue::bool(bool_val));
+    obj.set_boxed_value(JsValue::bool(bool_val));
     NativeResult::Ok(this_val)
 }
 
@@ -72,7 +72,7 @@ pub fn boolean_prototype_value_of<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeR
             "Boolean.prototype.valueOf called on non-Boolean object",
         ));
     }
-    let val = obj.get_prop_at(0);
+    let val = obj.boxed_value();
     NativeResult::Ok(val)
 }
 
@@ -100,7 +100,7 @@ pub fn boolean_prototype_to_string<H: VmHost>(vm: &mut H, args: &[u8]) -> Native
             "Boolean.prototype.toString called on non-Boolean object",
         ));
     }
-    let val = obj.get_prop_at(0);
+    let val = obj.boxed_value();
     let is_true = if val.is_bool() {
         val.as_bool()
     } else {

crates/oxide_builtins/src/number.rs

@@ -46,7 +46,7 @@ pub fn number_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         } else {
             JsValue::float(n)
         };
-        obj.set_prop_at(0, boxed);
+        obj.set_boxed_value(boxed);
         return NativeResult::Ok(this_val);
     }
 
@@ -514,7 +514,7 @@ pub fn number_value_of<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
             }
             let obj = unsafe { &*ptr };
             if obj.is_number_obj() {
-                return NativeResult::Ok(obj.get_prop_at(0));
+                return NativeResult::Ok(obj.boxed_value());
             }
         }
     }

crates/oxide_builtins/src/object.rs

@@ -431,7 +431,7 @@ pub fn object_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto)));
         let obj_ref = unsafe { &mut *obj };
         obj_ref.type_tag = JsObject::OBJ_TYPE_NUMBER_OBJ;
-        obj_ref.set_prop_at(0, val);
+        obj_ref.set_boxed_value(val);
         return NativeResult::Ok(JsValue::from_js_object(obj));
     }
     if val.is_string() {
@@ -447,7 +447,7 @@ pub fn object_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto)));
         let obj_ref = unsafe { &mut *obj };
         obj_ref.type_tag = JsObject::OBJ_TYPE_BOOLEAN_OBJ;
-        obj_ref.set_prop_at(0, val);
+        obj_ref.set_boxed_value(val);
         return NativeResult::Ok(JsValue::from_js_object(obj));
     }
     if val.is_symbol() {
@@ -455,14 +455,14 @@ pub fn object_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto)));
         let obj_ref = unsafe { &mut *obj };
         obj_ref.type_tag = JsObject::OBJ_TYPE_SYMBOL_OBJ;
-        obj_ref.set_prop_at(0, val);
+        obj_ref.set_boxed_value(val);
         return NativeResult::Ok(JsValue::from_js_object(obj));
     }
     if val.is_bigint() {
         let proto = vm.session().builtin_world().bigint_proto.as_ptr() as *mut JsObject;
         let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto)));
         let obj_ref = unsafe { &mut *obj };
-        obj_ref.set_prop_at(0, val);
+        obj_ref.set_boxed_value(val);
         return NativeResult::Ok(JsValue::from_js_object(obj));
     }
     let obj = vm.alloc_object(JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(object_proto)));

crates/oxide_builtins/src/symbol.rs

@@ -53,7 +53,7 @@ pub fn symbol_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
 
 /// `Symbol.prototype.toString`：返回 `Symbol(description)` 形式字符串。
 /// this 必须是 Symbol，否则抛 TypeError。
-/// thisSymbolValue：Symbol 原样返回；包装对象解盒（prop 0 存原始 Symbol）；其它类型 TypeError。
+/// thisSymbolValue：Symbol 原样返回；包装对象解盒（专属载荷字段存原始 Symbol）；其它类型 TypeError。
 fn this_symbol_value<H: VmHost>(vm: &mut H, this_val: JsValue) -> Result<JsValue, JsValue> {
     if this_val.is_symbol() {
         return Ok(this_val);
@@ -67,7 +67,7 @@ fn this_symbol_value<H: VmHost>(vm: &mut H, this_val: JsValue) -> Result<JsValue
                 let symbol_proto =
                     vm.session().builtin_world().symbol_proto.as_ptr() as *mut oxide_types::object::JsObject;
                 if !proto_ptr.is_null() && std::ptr::eq(proto_ptr, symbol_proto) {
-                    let v = obj.get_prop_at(0);
+                    let v = obj.boxed_value();
                     if v.is_symbol() {
                         return Ok(v);
                     }