fix: DefineOwnProperty 臂写参数寄存器补顶帧守卫

Cargo.lock

@@ -1160,7 +1160,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_builtins"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "chrono",
  "fast-float",
@@ -1185,7 +1185,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_bytecode"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "num-bigint",
  "oxide_log",
@@ -1193,7 +1193,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_cfg"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "oxide_bytecode",
  "oxide_emit",
@@ -1204,7 +1204,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_cli"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "ansi_term",
  "bumpalo",
@@ -1226,7 +1226,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_code_cache"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "lru",
  "oxide_bytecode",
@@ -1235,7 +1235,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_compiler"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1255,7 +1255,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_dce"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1269,7 +1269,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_emit"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "num-bigint",
  "oxc_allocator",
@@ -1284,7 +1284,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_engine"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "oxide_bytecode",
  "oxide_compiler",
@@ -1296,7 +1296,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_ir"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "oxide_bytecode",
  "oxide_log",
@@ -1305,7 +1305,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_kernel"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "bumpalo",
  "dashmap",
@@ -1319,7 +1319,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_liveness"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1331,7 +1331,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_log"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "tracing",
  "tracing-appender",
@@ -1340,7 +1340,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_parser"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "oxc_allocator",
  "oxc_ast",
@@ -1355,7 +1355,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_regalloc"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "oxide_bytecode",
  "oxide_cfg",
@@ -1371,7 +1371,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_runtime_api"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "num-bigint",
  "num-traits",
@@ -1384,7 +1384,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_test262"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "oxide_bytecode",
  "oxide_compiler",
@@ -1402,7 +1402,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_types"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "bumpalo",
  "dashmap",
@@ -1415,7 +1415,7 @@ dependencies = [
 
 [[package]]
 name = "oxide_vm"
-version = "0.13.23"
+version = "0.13.24"
 dependencies = [
  "bumpalo",
  "chrono",

Cargo.toml

@@ -23,7 +23,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.13.23"
+version = "0.13.24"
 edition = "2021"
 license = "MIT"
 rust-version = "1.80"

crates/oxide_builtins/src/object.rs

@@ -984,8 +984,9 @@ pub(crate) fn define_from_descriptor<H: VmHost>(
     }
 
     // mapped arguments exotic [[DefineOwnProperty]]：整数索引且映射存活时，旧描述符
-    // 可写且新描述符不可写则移除映射，新描述符含 value 则写参数寄存器；随后落穿
-    // 普通 define 路径（描述符收窄校验由 define_data_property 承担）。
+    // 可写且新描述符不可写则移除映射，新描述符含 value 且创建帧为顶帧时写参数
+    // 寄存器；随后落穿普通 define 路径（描述符收窄校验由 define_data_property
+    // 承担）。
     if unsafe { &*obj_ptr }.is_arguments_obj() {
         let state_ptr = unsafe { &*obj_ptr }.native_data() as *mut ArgumentsMapState;
         if !state_ptr.is_null() {
@@ -1006,8 +1007,13 @@ pub(crate) fn define_from_descriptor<H: VmHost>(
                             state.unmap(index as u16);
                         }
                         if let Some(v) = value_field {
-                            let reg = (state.param_base as u16 + index as u16) as u8;
-                            vm.set_reg(reg, v);
+                            // 参数寄存器仅创建帧为顶帧时写——嵌套调用期寄存器被被调方
+                            // 占用，写之串值，参数值在 save_stack，存储值仍为权威
+                            // 读源（与 [[Set]] 臂同口径）。
+                            if vm.is_top_frame(state.frame_depth) {
+                                let reg = (state.param_base as u16 + index as u16) as u8;
+                                vm.set_reg(reg, v);
+                            }
                         }
                     }
                 }

crates/oxide_runtime_api/src/host.rs

@@ -259,6 +259,11 @@ pub trait VmHost {
     /// - `state` 为 arguments 对象 `native_data` 中的同步状态盒；`frame_depth`
     ///   为创建帧下标，帧弹出后映射失效。
     fn arguments_mapping_alive(&self, state: &oxide_types::arguments_map::ArgumentsMapState) -> bool;
+    /// 判定帧栈下标 `frame_depth` 处的帧是否为顶帧（当前帧）。
+    ///
+    /// # 边界与前提
+    /// - `frame_depth` 为创建帧在帧栈中的下标；帧弹出后下标越界返回 `false`。
+    fn is_top_frame(&self, frame_depth: u32) -> bool;
 
     // 属性访问
     fn ordinary_get(&mut self, obj: &JsObject, prop_name_si: u32, receiver: JsValue) -> Result<JsValue, String>;

crates/oxide_vm/src/vm/vmhost.rs

@@ -218,6 +218,9 @@ impl oxide_runtime_api::VmHost for Vm {
     fn arguments_mapping_alive(&self, state: &oxide_types::arguments_map::ArgumentsMapState) -> bool {
         self.arguments_mapping_alive(state)
     }
+    fn is_top_frame(&self, frame_depth: u32) -> bool {
+        self.is_top_frame(frame_depth)
+    }
     fn ordinary_get(&mut self, obj: &JsObject, prop_name_si: u32, receiver: JsValue) -> Result<JsValue, String> {
         self.ordinary_get(obj, prop_name_si, receiver)
     }

crates/oxide_vm/src/vm_props.rs

@@ -20,6 +20,14 @@ impl Vm {
         self.frames.len() > depth && self.frames[depth].frame_id == state.frame_id
     }
 
+    /// 判定帧栈下标 `frame_depth` 处的帧是否为顶帧（当前帧）。
+    ///
+    /// # 边界与前提
+    /// - `frame_depth` 为创建帧在帧栈中的下标；帧弹出后下标越界返回 `false`。
+    pub(crate) fn is_top_frame(&self, frame_depth: u32) -> bool {
+        self.frames.len() == frame_depth as usize + 1
+    }
+
     /// 属性读入口：解析 `obj[prop_name_si]`，依次尝试数组 length 虚拟属性、
     /// 数组元素区、TypedArray 整数索引、命名属性槽，最后沿原型链查找。
     ///

crates/oxide_vm/tests/arguments_tests.rs

@@ -204,3 +204,28 @@ fn global_self_decrement_preserves_arguments() {
     let result = eval(&mut vm, "var c=1; function f(a){c--; return arguments.length} f(1)").unwrap();
     assert_eq!(result.as_int(), 1);
 }
+
+#[test]
+fn define_property_nested_call_does_not_clobber_callee_param() {
+    // 嵌套调用期对外层函数 arguments 索引属性 defineProperty 不写被调方帧的
+    // 参数寄存器（顶帧守卫）：被调方形参值不被串改。
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "function a(x){function b(y){Object.defineProperty(a.arguments,0,{value:5}); return y} return b(7)} a(1)",
+    )
+    .unwrap();
+    assert_eq!(result.as_int(), 7);
+}
+
+#[test]
+fn define_property_nested_call_updates_stored_value() {
+    // 嵌套调用期 defineProperty 更新存储值（读路径权威源）：回到顶帧后读为新值。
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "function a(x){function b(){Object.defineProperty(a.arguments,0,{value:5})} b(); return a.arguments[0]} a(1)",
+    )
+    .unwrap();
+    assert_eq!(result.as_int(), 5);
+}