feat: ArrayBuffer 载荷状态位与 byteLength 原型访问器

crates/oxide_builtins/src/array_buffer.rs

@@ -1,11 +1,48 @@
 use oxide_kernel::shape_forge::EMPTY_SHAPE_ID;
-use oxide_types::object::{JsObject, NativeFnPtr, PropAttributes};
+use oxide_types::object::{JsObject, NativeFnPtr};
 use oxide_types::value::JsValue;
 
 use oxide_runtime_api::{NativeResult, VmHost};
 
 pub(crate) const MAX_ARRAY_BUFFER_LENGTH: usize = 1 << 30;
 
+/// ArrayBuffer 载荷：字节缓冲与状态位。`data` 为 `None` 即缓冲区已 detach；
+/// `max_byte_length` 为 0 即定长缓冲；`immutable` 为字节缓冲写守卫标志。
+/// 载荷经 `Box::into_raw` 存于对象 `native_fn` 槽，GC 三自由函数
+/// （clone/size/drop）对整结构体操作，克隆须连标志位一并拷贝。
+#[derive(Clone)]
+pub(crate) struct ArrayBufferPayload {
+    pub(crate) data: Option<Vec<u8>>,
+    // 状态位：resizable 上限与 immutable 写守卫，当前读路径尚未消费。
+    #[cfg_attr(
+        not(test),
+        expect(
+            dead_code,
+            reason = "状态位随构造器写入与克隆拷贝，消费方在 options/resize/detach 语义路径"
+        )
+    )]
+    pub(crate) max_byte_length: usize,
+    #[cfg_attr(
+        not(test),
+        expect(
+            dead_code,
+            reason = "状态位随构造器写入与克隆拷贝，消费方在 options/resize/detach 语义路径"
+        )
+    )]
+    pub(crate) immutable: bool,
+}
+
+impl ArrayBufferPayload {
+    /// 构造定长已附着载荷（构造器/切片路径的默认形态）。
+    fn attached(data: Vec<u8>) -> Self {
+        ArrayBufferPayload {
+            data: Some(data),
+            max_byte_length: 0,
+            immutable: false,
+        }
+    }
+}
+
 macro_rules! native_try {
     ($expr:expr) => {
         match $expr {
@@ -48,78 +85,74 @@ fn normalize_index<H: VmHost>(vm: &mut H, value: JsValue, len: usize) -> usize {
     }
 }
 
-fn set_named_prop<H: VmHost>(vm: &mut H, obj: &mut JsObject, name: &str, value: JsValue, attributes: PropAttributes) {
-    let si = vm.kernel_core().perm_interner().intern(name).0;
-    let _ = vm.define_data_property(obj, si, value, attributes);
-}
-
 pub(crate) fn new_array_buffer<H: VmHost>(vm: &mut H, data: Vec<u8>) -> *mut JsObject {
     let proto = vm.session().builtin_world().array_buffer_proto.as_ptr() as *mut JsObject;
     let mut obj = JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::from_js_object(proto));
     obj.type_tag = JsObject::OBJ_TYPE_ARRAY_BUFFER;
-    let len = data.len();
-    let data_ptr = Box::into_raw(Box::new(data));
-    // SAFETY: ArrayBuffer 对象不可调用，故 native_fn 槽复用作不透明 `Box<Vec<u8>>`
+    // byteLength 经原型访问器读（构造器不写 own 数据属性，实例零命名属性）。
+    let payload_ptr = Box::into_raw(Box::new(ArrayBufferPayload::attached(data)));
+    // SAFETY: ArrayBuffer 对象不可调用，故 native_fn 槽复用作不透明载荷盒
     // 指针，与既有 RegExp 存储模式一致。
-    obj.set_native_fn(Some(unsafe { NativeFnPtr::from_raw(data_ptr as *const ()) }));
-    set_named_prop(
-        vm,
-        &mut obj,
-        "byteLength",
-        JsValue::int(len as i32),
-        PropAttributes::new(false, false, false),
-    );
+    obj.set_native_fn(Some(unsafe { NativeFnPtr::from_raw(payload_ptr as *const ()) }));
     vm.alloc_object(obj)
 }
 
-fn array_buffer_vec_ptr(obj: &JsObject) -> Option<*mut Vec<u8>> {
+fn array_buffer_payload_ptr(obj: &JsObject) -> Option<*mut ArrayBufferPayload> {
     if !obj.is_array_buffer_obj() {
         return None;
     }
-    obj.native_fn().map(|ptr| ptr.as_ptr() as *mut Vec<u8>)
+    obj.native_fn().map(|ptr| ptr.as_ptr() as *mut ArrayBufferPayload)
 }
 
-/// 克隆 ArrayBuffer 的字节数据到新对象（跨 epoch 克隆流程用）。
+/// 克隆 ArrayBuffer 载荷（字节缓冲 + 状态位）到新对象（跨 epoch 克隆流程用）。
 pub fn clone_array_buffer_native(old_obj: &JsObject, new_obj: &mut JsObject) {
-    let Some(ptr) = array_buffer_vec_ptr(old_obj) else {
+    let Some(ptr) = array_buffer_payload_ptr(old_obj) else {
         return;
     };
     if ptr.is_null() {
         return;
     }
-    let cloned = unsafe { (&*ptr).clone() };
+    // SAFETY: ptr 非空且指向存活载荷盒（克隆/晋升臂由 GC 持有源对象）。
+    let cloned = unsafe { &*ptr }.clone();
     let cloned_ptr = Box::into_raw(Box::new(cloned));
     new_obj.set_native_fn(Some(unsafe { NativeFnPtr::from_raw(cloned_ptr as *const ()) }));
 }
 
-/// 只读核算 ArrayBuffer 字节缓冲字节（不释放）。
+/// 只读核算 ArrayBuffer 载荷字节（不释放）：结构体尺寸 + 附着缓冲容量，
+/// detached 载荷仅计结构体尺寸。
 pub fn array_buffer_native_size(obj: &JsObject) -> u64 {
-    let Some(data_ptr) = array_buffer_vec_ptr(obj) else {
+    let Some(payload_ptr) = array_buffer_payload_ptr(obj) else {
         return 0;
     };
-    if data_ptr.is_null() {
+    if payload_ptr.is_null() {
         return 0;
     }
-    unsafe { (std::mem::size_of::<Vec<u8>>() + (*data_ptr).capacity()) as u64 }
+    // SAFETY: payload_ptr 非空且指向存活载荷盒。
+    let payload = unsafe { &*payload_ptr };
+    (std::mem::size_of::<ArrayBufferPayload>() + payload.data.as_ref().map_or(0, |d| d.capacity())) as u64
 }
 
-/// 释放 ArrayBuffer 的字节缓冲（native_fn 槽中的 `Box<Vec<u8>>`），返回字节数。
+/// 释放 ArrayBuffer 载荷盒（native_fn 槽），返回字节数；槽置空后重复调用零释放。
 pub fn drop_array_buffer_native(obj: &mut JsObject) -> u64 {
     let bytes = array_buffer_native_size(obj);
     if bytes == 0 {
         return 0;
     }
-    let Some(data_ptr) = array_buffer_vec_ptr(obj) else {
+    let Some(payload_ptr) = array_buffer_payload_ptr(obj) else {
         return 0;
     };
-    // SAFETY: data_ptr 非空（array_buffer_native_size 已验证），Box::from_raw 恰好释放一次。
-    let data = unsafe { Box::from_raw(data_ptr) };
-    drop(data);
+    // SAFETY: payload_ptr 非空（array_buffer_native_size 已验证），Box::from_raw 恰好释放一次。
+    let payload = unsafe { Box::from_raw(payload_ptr) };
+    drop(payload);
     obj.set_native_fn(None);
     bytes
 }
 
-pub(crate) fn array_buffer_data_ptr<H: VmHost>(vm: &mut H, this_val: JsValue) -> Result<*mut Vec<u8>, JsValue> {
+/// 读入口：校验 receiver 为 ArrayBuffer 并取载荷指针。detach（载荷 `data` 为
+/// `None`）不在此分叉，由消费方现读 `data` 时按既有错误形态处理。
+pub(crate) fn array_buffer_payload<H: VmHost>(
+    vm: &mut H, this_val: JsValue,
+) -> Result<*mut ArrayBufferPayload, JsValue> {
     if !this_val.is_object() {
         return Err(crate::error::create_type_error(vm, "ArrayBuffer method called on incompatible receiver"));
     }
@@ -131,14 +164,14 @@ pub(crate) fn array_buffer_data_ptr<H: VmHost>(vm: &mut H, this_val: JsValue) ->
     if !obj.is_array_buffer_obj() {
         return Err(crate::error::create_type_error(vm, "ArrayBuffer method called on incompatible receiver"));
     }
-    let Some(data_ptr) = obj.native_fn() else {
+    let Some(payload_ptr) = obj.native_fn() else {
         return Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
     };
-    let data_ptr = data_ptr.as_ptr() as *mut Vec<u8>;
-    if data_ptr.is_null() {
+    let payload_ptr = payload_ptr.as_ptr() as *mut ArrayBufferPayload;
+    if payload_ptr.is_null() {
         return Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
     }
-    Ok(data_ptr)
+    Ok(payload_ptr)
 }
 
 /// `ArrayBuffer(length)` 构造逻辑：分配 length 字节（0 填充）的新缓冲区。
@@ -157,15 +190,22 @@ pub fn array_buffer_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeRes
 /// `ArrayBuffer.prototype.byteLength` getter：返回缓冲区字节数。
 pub fn array_buffer_byte_length<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
-    let data_ptr = native_try!(array_buffer_data_ptr(vm, this_val));
-    NativeResult::Ok(JsValue::int(unsafe { (*data_ptr).len() } as i32))
+    let payload_ptr = native_try!(array_buffer_payload(vm, this_val));
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(data) = unsafe { &*payload_ptr }.data.as_ref() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
+    NativeResult::Ok(JsValue::int(data.len() as i32))
 }
 
 /// `ArrayBuffer.prototype.slice(start, end)`：复制字节区间生成新 ArrayBuffer。
 pub fn array_buffer_slice<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
-    let data_ptr = native_try!(array_buffer_data_ptr(vm, this_val));
-    let data = unsafe { &*data_ptr };
+    let payload_ptr = native_try!(array_buffer_payload(vm, this_val));
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(data) = unsafe { &*payload_ptr }.data.as_ref() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     let len = data.len();
     let start = if args.len() > 1 { normalize_index(vm, vm.reg(args[1]), len) } else { 0 };
     let end = if args.len() > 2 { normalize_index(vm, vm.reg(args[2]), len) } else { len };
@@ -190,8 +230,99 @@ pub fn array_buffer_is_view<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult
 /// `ArrayBuffer.prototype.toString`：校验 receiver 后返回 `[object ArrayBuffer]`。
 pub fn array_buffer_to_string<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
-    if array_buffer_data_ptr(vm, this_val).is_err() {
+    if array_buffer_payload(vm, this_val).is_err() {
         return type_error(vm, "ArrayBuffer.prototype.toString called on incompatible receiver");
     }
     NativeResult::Ok(vm.new_string("[object ArrayBuffer]"))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// 手工构造带载荷盒的 ArrayBuffer 对象（不经 Vm，只验 GC 三自由函数）。
+    fn ab_object_with_payload(payload: ArrayBufferPayload) -> JsObject {
+        let mut obj = JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::undefined());
+        obj.type_tag = JsObject::OBJ_TYPE_ARRAY_BUFFER;
+        let payload_ptr = Box::into_raw(Box::new(payload));
+        // SAFETY: 载荷盒形态与 new_array_buffer 的 native_fn 槽存储一致，测试结束前恰好释放一次。
+        obj.set_native_fn(Some(unsafe { NativeFnPtr::from_raw(payload_ptr as *const ()) }));
+        obj
+    }
+
+    /// 克隆目标对象与真实 GC 克隆体同形：AB 类型标签 + 空 native_fn 槽。
+    fn ab_clone_target() -> JsObject {
+        let mut obj = JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::undefined());
+        obj.type_tag = JsObject::OBJ_TYPE_ARRAY_BUFFER;
+        obj
+    }
+
+    #[test]
+    fn payload_clone_propagates_detached() {
+        let old = ab_object_with_payload(ArrayBufferPayload {
+            data: None,
+            max_byte_length: 0,
+            immutable: false,
+        });
+        let mut new_obj = ab_clone_target();
+        clone_array_buffer_native(&old, &mut new_obj);
+        let ptr = array_buffer_payload_ptr(&new_obj).expect("克隆体应携带载荷盒");
+        // SAFETY: ptr 由 clone_array_buffer_native 新建的存活盒。
+        let cloned = unsafe { &*ptr };
+        assert!(cloned.data.is_none());
+        unsafe { drop(Box::from_raw(ptr)) };
+    }
+
+    #[test]
+    fn payload_clone_copies_flags() {
+        let old = ab_object_with_payload(ArrayBufferPayload {
+            data: Some(vec![1, 2, 3]),
+            max_byte_length: 42,
+            immutable: true,
+        });
+        let mut new_obj = ab_clone_target();
+        clone_array_buffer_native(&old, &mut new_obj);
+        let ptr = array_buffer_payload_ptr(&new_obj).expect("克隆体应携带载荷盒");
+        // SAFETY: ptr 由 clone_array_buffer_native 新建的存活盒。
+        let cloned = unsafe { &*ptr };
+        assert_eq!(cloned.max_byte_length, 42);
+        assert!(cloned.immutable);
+        assert_eq!(cloned.data.as_ref().expect("附着缓冲应随克隆").as_slice(), &[1, 2, 3]);
+        unsafe { drop(Box::from_raw(ptr)) };
+    }
+
+    #[test]
+    fn detached_size_and_drop_idempotent() {
+        let mut obj = ab_object_with_payload(ArrayBufferPayload {
+            data: None,
+            max_byte_length: 0,
+            immutable: false,
+        });
+        let struct_bytes = std::mem::size_of::<ArrayBufferPayload>() as u64;
+        assert_eq!(array_buffer_native_size(&obj), struct_bytes);
+        // 首次 drop 释放结构体（无缓冲容量）；槽置空后二次 drop 零释放。
+        assert_eq!(drop_array_buffer_native(&mut obj), struct_bytes);
+        assert_eq!(drop_array_buffer_native(&mut obj), 0);
+    }
+
+    #[test]
+    fn attached_size_and_drop() {
+        let mut obj = ab_object_with_payload(ArrayBufferPayload::attached(vec![0u8; 8]));
+        let bytes = (std::mem::size_of::<ArrayBufferPayload>() + 8) as u64;
+        assert_eq!(array_buffer_native_size(&obj), bytes);
+        assert_eq!(drop_array_buffer_native(&mut obj), bytes);
+        assert_eq!(drop_array_buffer_native(&mut obj), 0);
+    }
+
+    #[test]
+    fn payload_ptr_brand_guard() {
+        // 非 ArrayBuffer 类型标签（PLAIN）对象取载荷指针恒 None。
+        let mut obj = JsObject::new_empty(EMPTY_SHAPE_ID, JsValue::undefined());
+        let payload_ptr = Box::into_raw(Box::new(ArrayBufferPayload::attached(vec![0u8; 4])));
+        // SAFETY: 同 ab_object_with_payload 的载荷盒形态。
+        obj.set_native_fn(Some(unsafe { NativeFnPtr::from_raw(payload_ptr as *const ()) }));
+        assert!(array_buffer_payload_ptr(&obj).is_none());
+        // SAFETY: 测试构造的盒，恰好释放一次。
+        unsafe { drop(Box::from_raw(payload_ptr)) };
+    }
+}

crates/oxide_builtins/src/data_view.rs

@@ -5,7 +5,7 @@ use oxide_types::value::JsValue;
 use num_bigint::BigInt;
 use num_traits::ToPrimitive;
 
-use crate::array_buffer::array_buffer_data_ptr;
+use crate::array_buffer::array_buffer_payload;
 
 use oxide_runtime_api::{NativeResult, VmHost};
 
@@ -121,8 +121,11 @@ fn checked_absolute_offset<H: VmHost>(
 /// GetViewValue 后半：按已校验的视图与偏移读 N 字节（越界抛 RangeError）。
 fn read_bytes_at<const N: usize, H: VmHost>(vm: &mut H, view: DataViewData, offset: usize) -> Result<[u8; N], JsValue> {
     let abs = checked_absolute_offset(vm, view, offset, N)?;
-    let buffer_ptr = array_buffer_data_ptr(vm, view.buffer)?;
-    let buffer = unsafe { &*buffer_ptr };
+    let payload_ptr = array_buffer_payload(vm, view.buffer)?;
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(buffer) = unsafe { &*payload_ptr }.data.as_deref() else {
+        return Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     if abs + N > buffer.len() {
         return Err(crate::error::create_range_error(vm, "DataView offset out of bounds"));
     }
@@ -136,8 +139,11 @@ fn write_bytes<const N: usize, H: VmHost>(
     vm: &mut H, view: DataViewData, offset: usize, bytes: [u8; N],
 ) -> Result<(), JsValue> {
     let abs = checked_absolute_offset(vm, view, offset, N)?;
-    let buffer_ptr = array_buffer_data_ptr(vm, view.buffer)?;
-    let buffer = unsafe { &mut *buffer_ptr };
+    let payload_ptr = array_buffer_payload(vm, view.buffer)?;
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(buffer) = unsafe { &mut *payload_ptr }.data.as_deref_mut() else {
+        return Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     if abs + N > buffer.len() {
         return Err(crate::error::create_range_error(vm, "DataView offset out of bounds"));
     }
@@ -195,8 +201,12 @@ pub fn data_view_constructor<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult
         return NativeResult::Err(crate::error::create_type_error(vm, "DataView requires an ArrayBuffer"));
     }
     let buffer = vm.reg(args[1]);
-    let buffer_ptr = native_try!(array_buffer_data_ptr(vm, buffer));
-    let buffer_len = unsafe { (*buffer_ptr).len() };
+    let payload_ptr = native_try!(array_buffer_payload(vm, buffer));
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(data) = unsafe { &*payload_ptr }.data.as_ref() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
+    let buffer_len = data.len();
     let byte_offset = if args.len() > 2 {
         native_try!(to_index(vm, vm.reg(args[2]), "DataView byteOffset out of bounds"))
     } else {

crates/oxide_builtins/src/typed_array.rs

@@ -5,7 +5,7 @@ use oxide_types::object::{JsObject, NativeFnPtr, TypedArrayKind};
 use oxide_types::private_key::{int_key_value, is_int_key, make_well_known_symbol_key, WELL_KNOWN_SYMBOL_SPECIES};
 use oxide_types::value::JsValue;
 
-use crate::array_buffer::{array_buffer_data_ptr, new_array_buffer, MAX_ARRAY_BUFFER_LENGTH};
+use crate::array_buffer::{array_buffer_payload, new_array_buffer, MAX_ARRAY_BUFFER_LENGTH};
 
 use oxide_runtime_api::{NativeResult, VmHost};
 
@@ -270,8 +270,11 @@ pub fn typed_array_element_get<H: VmHost>(vm: &mut H, obj: &JsObject, index: u32
     if index as usize >= view.length {
         return Ok(JsValue::undefined());
     }
-    let buffer_ptr = array_buffer_data_ptr(vm, view.buffer).map_err(|e| format!("{e}"))?;
-    let buffer = unsafe { &*buffer_ptr };
+    let payload_ptr = array_buffer_payload(vm, view.buffer).map_err(|e| format!("{e}"))?;
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(buffer) = unsafe { &*payload_ptr }.data.as_deref() else {
+        return Err("ArrayBuffer internal state invalid".into());
+    };
     Ok(read_element(vm, view.kind, buffer, absolute_byte_offset(view, index as usize)))
 }
 
@@ -341,9 +344,11 @@ fn write_typed_array_element<H: VmHost>(
     if index as usize >= view.length {
         return Ok(());
     }
-    let buffer_ptr = array_buffer_data_ptr(vm, view.buffer).map_err(|e| format!("{e}"))?;
-    // SAFETY: buffer_ptr 经 array_buffer_data_ptr 校验为合法 ArrayBuffer。
-    let buffer = unsafe { &mut *buffer_ptr };
+    let payload_ptr = array_buffer_payload(vm, view.buffer).map_err(|e| format!("{e}"))?;
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(buffer) = unsafe { &mut *payload_ptr }.data.as_deref_mut() else {
+        return Err("ArrayBuffer internal state invalid".into());
+    };
     write_element(vm, view.kind, buffer, absolute_byte_offset(view, index as usize), elem);
     Ok(())
 }
@@ -489,8 +494,11 @@ fn collect_array_like<H: VmHost>(vm: &mut H, value: JsValue, consult_iterator: b
     }
     if obj.is_typed_array_obj() {
         let view = get_typed_array_data(vm, value)?;
-        let buffer_ptr = array_buffer_data_ptr(vm, view.buffer)?;
-        let buffer = unsafe { &*buffer_ptr };
+        let payload_ptr = array_buffer_payload(vm, view.buffer)?;
+        // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+        let Some(buffer) = unsafe { &*payload_ptr }.data.as_deref() else {
+            return Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+        };
         return Ok((0..view.length)
             .map(|i| read_element(vm, view.kind, buffer, absolute_byte_offset(view, i)))
             .collect());
@@ -558,8 +566,12 @@ fn typed_array_new<H: VmHost>(vm: &mut H, args: &[u8], kind: TypedArrayKind) ->
         let first_ptr = first.as_js_object_ptr();
         let first_obj = unsafe { &*first_ptr };
         if first_obj.is_array_buffer_obj() {
-            let buffer_ptr = native_try!(array_buffer_data_ptr(vm, first));
-            let buffer_len = unsafe { (*buffer_ptr).len() };
+            let payload_ptr = native_try!(array_buffer_payload(vm, first));
+            // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+            let Some(data) = unsafe { &*payload_ptr }.data.as_ref() else {
+                return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+            };
+            let buffer_len = data.len();
             let byte_offset = if args.len() > 2 {
                 native_try!(to_index(vm, vm.reg(args[2]), "TypedArray byteOffset out of bounds"))
             } else {
@@ -585,8 +597,11 @@ fn typed_array_new<H: VmHost>(vm: &mut H, args: &[u8], kind: TypedArrayKind) ->
             let values = native_try!(collect_array_like(vm, first, true));
             let byte_len = values.len().saturating_mul(bpe);
             let buffer = JsValue::from_js_object(new_array_buffer(vm, vec![0; byte_len]));
-            let buffer_ptr = native_try!(array_buffer_data_ptr(vm, buffer));
-            let buffer_ref = unsafe { &mut *buffer_ptr };
+            let payload_ptr = native_try!(array_buffer_payload(vm, buffer));
+            // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+            let Some(buffer_ref) = unsafe { &mut *payload_ptr }.data.as_deref_mut() else {
+                return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+            };
             for (idx, value) in values.into_iter().enumerate() {
                 let elem = native_try!(ta_element_value(vm, kind, value));
                 write_element(vm, kind, buffer_ref, idx * bpe, elem);
@@ -673,8 +688,11 @@ pub fn typed_array_at<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     if idx < 0 || idx as usize >= view.length {
         return NativeResult::Ok(JsValue::undefined());
     }
-    let buffer_ptr = native_try!(array_buffer_data_ptr(vm, view.buffer));
-    let buffer = unsafe { &*buffer_ptr };
+    let payload_ptr = native_try!(array_buffer_payload(vm, view.buffer));
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(buffer) = unsafe { &*payload_ptr }.data.as_deref() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     NativeResult::Ok(read_element(vm, view.kind, buffer, absolute_byte_offset(view, idx as usize)))
 }
 
@@ -695,8 +713,11 @@ pub fn typed_array_fill<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     } else {
         view.length
     };
-    let buffer_ptr = native_try!(array_buffer_data_ptr(vm, view.buffer));
-    let buffer = unsafe { &mut *buffer_ptr };
+    let payload_ptr = native_try!(array_buffer_payload(vm, view.buffer));
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(buffer) = unsafe { &mut *payload_ptr }.data.as_deref_mut() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     for idx in start..end.max(start) {
         write_element(vm, view.kind, buffer, absolute_byte_offset(view, idx), elem);
     }
@@ -854,8 +875,11 @@ pub fn typed_array_set<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     for v in values {
         converted.push(native_try!(ta_element_value(vm, view.kind, v)));
     }
-    let buffer_ptr = native_try!(array_buffer_data_ptr(vm, view.buffer));
-    let buffer = unsafe { &mut *buffer_ptr };
+    let payload_ptr = native_try!(array_buffer_payload(vm, view.buffer));
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(buffer) = unsafe { &mut *payload_ptr }.data.as_deref_mut() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     for (i, elem) in converted.into_iter().enumerate() {
         write_element(vm, view.kind, buffer, absolute_byte_offset(view, offset + i), elem);
     }
@@ -948,8 +972,11 @@ fn set_typed_array_element<H: VmHost>(vm: &mut H, ta: JsValue, index: usize, val
         return Ok(());
     }
     let elem = ta_element_value(vm, view.kind, value)?;
-    let buffer_ptr = array_buffer_data_ptr(vm, view.buffer)?;
-    let buffer = unsafe { &mut *buffer_ptr };
+    let payload_ptr = array_buffer_payload(vm, view.buffer)?;
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(buffer) = unsafe { &mut *payload_ptr }.data.as_deref_mut() else {
+        return Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     write_element(vm, view.kind, buffer, absolute_byte_offset(view, index), elem);
     Ok(())
 }
@@ -978,15 +1005,21 @@ fn ta_read<H: VmHost>(vm: &mut H, view: TypedArrayData, index: usize) -> Result<
     if index >= view.length {
         return Ok(JsValue::undefined());
     }
-    let buffer_ptr = array_buffer_data_ptr(vm, view.buffer)?;
-    let buffer = unsafe { &*buffer_ptr };
+    let payload_ptr = array_buffer_payload(vm, view.buffer)?;
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(buffer) = unsafe { &*payload_ptr }.data.as_deref() else {
+        return Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     Ok(read_element(vm, view.kind, buffer, absolute_byte_offset(view, index)))
 }
 
 /// 把已转换的值写入 TypedArray 指定索引（视图 data 已取出的形式，供原型方法内部使用）。
 fn ta_write<H: VmHost>(vm: &mut H, view: TypedArrayData, index: usize, value: JsValue) -> Result<(), JsValue> {
-    let buffer_ptr = array_buffer_data_ptr(vm, view.buffer)?;
-    let buffer = unsafe { &mut *buffer_ptr };
+    let payload_ptr = array_buffer_payload(vm, view.buffer)?;
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    let Some(buffer) = unsafe { &mut *payload_ptr }.data.as_deref_mut() else {
+        return Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     write_element(vm, view.kind, buffer, absolute_byte_offset(view, index), value);
     Ok(())
 }
@@ -1951,9 +1984,11 @@ pub fn uint8array_to_base64<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult
             .map_err(|e| crate::iterator::engine_error(vm, &e)));
         omit_padding = ta_to_boolean(v);
     }
-    let buffer_ptr = native_try!(array_buffer_data_ptr(vm, view.buffer));
-    let buffer = unsafe { &*buffer_ptr };
-    // SAFETY: buffer_ptr 来自活动 ArrayBuffer 对象，视图范围由构造保证界内。
+    let payload_ptr = native_try!(array_buffer_payload(vm, view.buffer));
+    // SAFETY: payload_ptr 来自活动 ArrayBuffer 对象，视图范围由构造保证界内。
+    let Some(buffer) = unsafe { &*payload_ptr }.data.as_deref() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     NativeResult::Ok(vm.new_string_owned(crate::ta_codec::encode_base64(
         &buffer[view.byte_offset..view.byte_offset + view.length],
         alphabet,
@@ -1965,9 +2000,11 @@ pub fn uint8array_to_base64<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult
 pub fn uint8array_to_hex<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
     let view = native_try!(validate_uint8_array(vm, this_val));
-    let buffer_ptr = native_try!(array_buffer_data_ptr(vm, view.buffer));
-    let buffer = unsafe { &*buffer_ptr };
-    // SAFETY: buffer_ptr 来自活动 ArrayBuffer 对象，视图范围由构造保证界内。
+    let payload_ptr = native_try!(array_buffer_payload(vm, view.buffer));
+    // SAFETY: payload_ptr 来自活动 ArrayBuffer 对象，视图范围由构造保证界内。
+    let Some(buffer) = unsafe { &*payload_ptr }.data.as_deref() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     NativeResult::Ok(
         vm.new_string_owned(crate::ta_codec::encode_hex(&buffer[view.byte_offset..view.byte_offset + view.length])),
     )
@@ -1980,9 +2017,11 @@ pub fn uint8array_set_from_base64<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeR
     let view = native_try!(validate_uint8_array(vm, this_val));
     let string = if args.len() > 1 { vm.reg(args[1]) } else { JsValue::undefined() };
     let options = if args.len() > 2 { vm.reg(args[2]) } else { JsValue::undefined() };
-    let buffer_ptr = native_try!(array_buffer_data_ptr(vm, view.buffer));
-    let buffer = unsafe { &mut *buffer_ptr };
-    // SAFETY: buffer_ptr 来自活动 ArrayBuffer 对象，视图范围由构造保证界内。
+    let payload_ptr = native_try!(array_buffer_payload(vm, view.buffer));
+    // SAFETY: payload_ptr 来自活动 ArrayBuffer 对象，视图范围由构造保证界内。
+    let Some(buffer) = unsafe { &mut *payload_ptr }.data.as_deref_mut() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     let start = view.byte_offset;
     let (read, written) = native_try!(ta_decode_base64(vm, string, options, Some(view.length), &mut |idx, b| {
         buffer[start + idx] = b;
@@ -1999,9 +2038,11 @@ pub fn uint8array_set_from_hex<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResu
     if !string.is_string() {
         return NativeResult::Err(type_error(vm, "string argument required"));
     }
-    let buffer_ptr = native_try!(array_buffer_data_ptr(vm, view.buffer));
-    let buffer = unsafe { &mut *buffer_ptr };
-    // SAFETY: buffer_ptr 来自活动 ArrayBuffer 对象，视图范围由构造保证界内。
+    let payload_ptr = native_try!(array_buffer_payload(vm, view.buffer));
+    // SAFETY: payload_ptr 来自活动 ArrayBuffer 对象，视图范围由构造保证界内。
+    let Some(buffer) = unsafe { &mut *payload_ptr }.data.as_deref_mut() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
+    };
     let start = view.byte_offset;
     let units = vm.string_units(string).into_owned();
     let (read, written) = match crate::ta_codec::decode_hex(&units, Some(view.length), &mut |idx, b| {

crates/oxide_vm/src/bindings/bind_array_buffer.rs

@@ -1,7 +1,9 @@
 use std::sync::Arc;
 
 use crate::bind_constructor;
-use crate::bindings::{apply_binding_table, bind_accessor_getter_key, configure_native_constructor};
+use crate::bindings::{
+    apply_binding_table, bind_accessor_getter, bind_accessor_getter_key, configure_native_constructor,
+};
 use oxide_kernel::kernel::{KernelCore, KernelSession};
 use oxide_types::object::JsObject;
 
@@ -45,11 +47,6 @@ pub fn bind_array_buffer(core: &Arc<KernelCore>, session: &KernelSession, global
         proto,
         core,
         &[
-            (
-                "byteLength",
-                oxide_builtins::array_buffer::array_buffer_byte_length::<crate::vm::Vm> as *const (),
-                0,
-            ),
             ("slice", oxide_builtins::array_buffer::array_buffer_slice::<crate::vm::Vm> as *const (), 2),
             (
                 "toString",
@@ -59,6 +56,15 @@ pub fn bind_array_buffer(core: &Arc<KernelCore>, session: &KernelSession, global
         ],
     );
 
+    // byteLength 原型访问器（set 恒 undefined）：读载荷字节数，实例无 own 属性。
+    bind_accessor_getter(
+        core,
+        session,
+        proto,
+        "byteLength",
+        oxide_builtins::array_buffer::array_buffer_byte_length::<crate::vm::Vm> as *const (),
+    );
+
     bind_constructor!(
         core,
         global,

crates/oxide_vm/tests/builtins_array_buffer_tests.rs

@@ -24,10 +24,16 @@ fn array_buffer_global_and_static_method_exist() {
 }
 
 #[test]
-fn array_buffer_constructor_sets_byte_length_property() {
+fn array_buffer_constructor_reads_byte_length_via_proto_accessor() {
+    // byteLength 经原型访问器可读，实例无 own 数据属性。
     let mut vm = Vm::new();
-    let result = eval(&mut vm, "var buf = new ArrayBuffer(8); buf.byteLength").unwrap();
-    assert_eq!(result.as_int(), 8);
+    let result = eval(
+        &mut vm,
+        "var buf = new ArrayBuffer(8); buf.byteLength === 8 \
+         && Object.getOwnPropertyDescriptor(buf, 'byteLength') === undefined",
+    )
+    .unwrap();
+    assert!(result.as_bool());
 }
 
 #[test]

crates/oxide_vm/tests/builtins_arraybuffer_state_tests.rs

@@ -0,0 +1,71 @@
+use std::sync::Arc;
+
+use oxide_compiler::compiler::Compiler;
+use oxide_types::value::JsValue;
+use oxide_vm::vm::Vm;
+
+fn eval(vm: &mut Vm, source: &str) -> Result<JsValue, String> {
+    let allocator = oxide_parser::Allocator::default();
+    let program = oxide_parser::parse(&allocator, source).map_err(|e| format!("Parse error: {:?}", e))?;
+    let module = Compiler::new().compile(&program).map_err(|e| format!("Compile error: {}", e))?;
+    vm.run(&Arc::new(module))
+}
+
+/// 原型 byteLength 描述符钉：get 为函数、set 缺失、不可枚举、可配置。
+#[test]
+fn ab_bytelength_proto_is_accessor() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "var d = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'byteLength'); \
+         typeof d.get === 'function' && d.set === undefined \
+         && d.enumerable === false && d.configurable === true",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// 访问器 getter 函数对象元数据钉：name 标签与 length。
+#[test]
+fn ab_bytelength_getter_name_and_length() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "var d = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'byteLength'); \
+         d.get.name === 'get byteLength' && d.get.length === 0",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// 访问器返回值钉：构造长度经原型访问器读回。
+#[test]
+fn ab_bytelength_returns_constructed_len() {
+    let mut vm = Vm::new();
+    let result = eval(&mut vm, "new ArrayBuffer(0).byteLength === 0 && new ArrayBuffer(42).byteLength === 42").unwrap();
+    assert!(result.as_bool());
+}
+
+/// receiver 校验钉：非 ArrayBuffer this（原型自身 / undefined）抛 TypeError。
+#[test]
+fn ab_bytelength_this_checks() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "var d = Object.getOwnPropertyDescriptor(ArrayBuffer.prototype, 'byteLength'); \
+         var proto_threw = false; var undef_threw = false; \
+         try { ArrayBuffer.prototype.byteLength } catch (e) { proto_threw = e instanceof TypeError; } \
+         try { d.get.call(undefined) } catch (e) { undef_threw = e instanceof TypeError; } \
+         proto_threw && undef_threw",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// 实例无 own byteLength 属性钉（构造器不写数据属性）。
+#[test]
+fn ab_instance_has_no_own_bytelength() {
+    let mut vm = Vm::new();
+    let result = eval(&mut vm, "Object.getOwnPropertyNames(new ArrayBuffer(8)).length === 0").unwrap();
+    assert!(result.as_bool());
+}