refactor: 退役逃逸写屏障 builtins 侧调用点与 trait 兑现

crates/oxide_builtins/src/map.rs

@@ -627,11 +627,10 @@ pub fn map_group_by<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
             }
             new_arr_val
         };
-        // push element 到分组数组（写入前 promote，与 Array.prototype.push 同款）。
+        // push element 到分组数组（与 Array.prototype.push 同款）。
         let arr_obj = unsafe { &mut *arr_val.as_js_object_ptr() };
         let idx = arr_obj.prop_count();
-        let promoted_elem = vm.promote_if_needed_for_write_ptr(arr_val.as_js_object_ptr(), element);
+        arr_obj.set_prop_at(idx, element);
-        arr_obj.set_prop_at(idx, promoted_elem);
         counter += 1;
     }
     NativeResult::Ok(map_val)

crates/oxide_builtins/src/object.rs

@@ -732,9 +732,8 @@ pub fn object_assign<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
 
     let target = unsafe { &mut *target_ptr };
     for (si, val) in all_assignments {
-        let promoted = vm.promote_if_needed_for_write_ptr(target_ptr, val);
         // Set(to, key, value, true)：receiver 为目标对象（目标同名 setter 的 this 指向 target）。
-        if let Err(err) = vm.ordinary_set(target, si, promoted, target_val, true) {
+        if let Err(err) = vm.ordinary_set(target, si, val, target_val, true) {
             return NativeResult::Err(crate::error::create_type_error(vm, &err));
         }
     }
@@ -1605,9 +1604,8 @@ pub fn object_from_entries<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
         let value_val = pair.get_prop_at(1);
         // ToPropertyKey 语义建键：int/规范数字串/symbol 统一映射，避免数字键分裂。
         let si = vm.property_key_si(key_val);
-        let promoted = vm.promote_if_needed_for_write_ptr(obj, value_val);
         // 写入失败按 builtin 边界传播（目标为 fresh 对象实际不可达，不得静默吞）。
-        if let Err(err) = vm.ordinary_set(unsafe { &mut *obj }, si, promoted, target_val, true) {
+        if let Err(err) = vm.ordinary_set(unsafe { &mut *obj }, si, value_val, target_val, true) {
             return NativeResult::Err(crate::array::from_engine_error(vm, &err));
         }
     }
@@ -2320,18 +2318,16 @@ pub fn object_group_by<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
             ));
             let new_arr_val = JsValue::from_js_object(arr);
             let result_ref_mut = unsafe { &mut *result };
-            let promoted = vm.promote_if_needed_for_write_ptr(result, new_arr_val);
             // 写入失败按 builtin 边界传播（result 为 fresh 对象实际不可达，不得静默吞）。
-            if let Err(err) = vm.ordinary_set(result_ref_mut, key_si, promoted, result_val, true) {
+            if let Err(err) = vm.ordinary_set(result_ref_mut, key_si, new_arr_val, result_val, true) {
                 return NativeResult::Err(crate::array::from_engine_error(vm, &err));
             }
             new_arr_val
         };
-        // push element 到分组数组（写入前 promote，与 Array.prototype.push 同款）。
+        // push element 到分组数组（与 Array.prototype.push 同款）。
         let arr_obj = unsafe { &mut *arr_val.as_js_object_ptr() };
         let idx = arr_obj.prop_count();
-        let promoted_elem = vm.promote_if_needed_for_write_ptr(arr_val.as_js_object_ptr(), element);
+        arr_obj.set_prop_at(idx, element);
-        arr_obj.set_prop_at(idx, promoted_elem);
         counter += 1;
     }
     NativeResult::Ok(result_val)

crates/oxide_builtins/src/reflect.rs

@@ -424,15 +424,13 @@ fn set_on_receiver<H: VmHost>(vm: &mut H, receiver: JsValue, key_si: u32, value:
                 return NativeResult::Ok(JsValue::bool(false));
             }
         }
-        let val = vm.promote_if_needed_for_write_ptr(receiver_ptr, value);
+        vm.set_or_create_prop_value(unsafe { &mut *receiver_ptr }, key_si, value);
-        vm.set_or_create_prop_value(unsafe { &mut *receiver_ptr }, key_si, val);
         return NativeResult::Ok(JsValue::bool(true));
     }
     if !receiver_obj.is_extensible() {
         return NativeResult::Ok(JsValue::bool(false));
     }
-    let val = vm.promote_if_needed_for_write_ptr(receiver_ptr, value);
+    vm.set_or_create_prop_value(unsafe { &mut *receiver_ptr }, key_si, value);
-    vm.set_or_create_prop_value(unsafe { &mut *receiver_ptr }, key_si, val);
     NativeResult::Ok(JsValue::bool(true))
 }
 

crates/oxide_runtime_api/src/host.rs

@@ -227,7 +227,6 @@ pub trait VmHost {
     /// caller/arguments 访问是否受限：严格函数对象，或生成器 / 异步 /
     /// 异步生成器函数对象（[[Prototype]] 为三个动态函数原型之一）。
     fn function_is_restricted(&self, obj: &JsObject) -> bool;
-    fn promote_if_needed_for_write_ptr(&mut self, target_ptr: *mut JsObject, value: JsValue) -> JsValue;
     fn step_rng(&mut self);
     fn math_rng_value(&self) -> f64;
     fn sub_module_function_name(&self, gen: u32, sub_idx: u16) -> String;

crates/oxide_vm/src/vm/vmhost.rs

@@ -194,9 +194,6 @@ impl oxide_runtime_api::VmHost for Vm {
             || std::ptr::eq(p, self.async_function_proto.as_ptr())
             || std::ptr::eq(p, self.async_generator_function_proto.as_ptr())
     }
-    fn promote_if_needed_for_write_ptr(&mut self, _target_ptr: *mut JsObject, value: JsValue) -> JsValue {
-        value
-    }
     fn step_rng(&mut self) {
         self.step_rng()
     }