fix: sloppy 普通函数调用 this 未定义/null 绑定全局对象

2026-10-25 03:01:12 +08:00 · 2026-08-16 16:58:32 +08:00
parent 089179daab
commit 9f64962b20
5 changed files with 192 additions and 11 deletions
@@ -381,7 +381,15 @@ impl Vm {
        for i in 0..sub.n_args as usize {
            self.regs[sub.param_base as usize + i] = args.get(i).copied().unwrap_or(JsValue::undefined());
        }
-        self.regs[254] = if sub.is_arrow { callee_obj.captured_this() } else { receiver };
+        // this 绑定：箭头函数恒用词法捕获；sloppy 普通函数 this 为 null/undefined 时
+        // 替换为全局对象（ECMA-262 10.4.3）；严格模式与显式 receiver 原样保留。
+        self.regs[254] = if sub.is_arrow {
+            callee_obj.captured_this()
+        } else if !sub.is_strict && receiver.is_nullish() {
+            JsValue::from_js_object(self.session.global_object().as_ptr() as *mut JsObject)
+        } else {
+            receiver
+        };
        self.regs[255] = JsValue::undefined();
        for (name, reg) in &sub.builtin_reg_map {
            let si = self.kernel_core.perm_interner().intern(name.as_str()).0;