feat: arguments 对象绑定（CREATE_ARGUMENTS + 帧实参 spill 区）

crates/oxide_vm/src/vm_runtime.rs

@@ -81,6 +81,8 @@ impl Vm {
             spill_stack: std::mem::take(&mut self.spill_stack),
             cell_stack: std::mem::take(&mut self.cell_stack),
             inline_callee: self.inline_callee,
+            inline_args_base: self.inline_args_base,
+            inline_args_count: self.inline_args_count,
         });
 
         self.regs = [JsValue::undefined(); 256];
@@ -91,6 +93,10 @@ impl Vm {
         self.root_reg_limit = self.active_reg_limit;
         self.cell_stack.push(Vec::with_capacity(sub.cells_needed as usize));
         self.inline_callee = Some(callee);
+        // inline 同步调用无 CallFrame：完整实参写入 spill 栈实参区，供 CREATE_ARGUMENTS 读取。
+        self.inline_args_base = self.spill_stack.len() as u32;
+        self.spill_stack.extend_from_slice(args);
+        self.inline_args_count = args.len().min(u16::MAX as usize) as u16;
         for i in 0..sub.n_args as usize {
             self.regs[sub.param_base as usize + i] = args.get(i).copied().unwrap_or(JsValue::undefined());
         }
@@ -136,6 +142,8 @@ impl Vm {
         self.spill_stack = saved.spill_stack;
         self.cell_stack = saved.cell_stack;
         self.inline_callee = saved.inline_callee;
+        self.inline_args_base = saved.inline_args_base;
+        self.inline_args_count = saved.inline_args_count;
 
         result
     }