fix: sloppy 模式属性赋值静默 no-op——写失败按写方严格模式分派,内置写路径一律按严格

This commit is contained in:
2026-09-09 17:48:33 +08:00
parent 64f582d34b
commit c8bcff83f6
18 changed files with 529 additions and 89 deletions
+2 -2
View File
@@ -160,7 +160,7 @@ impl Vm {
let prop_val = self.ordinary_get(obj, prop_name_si, receiver)?;
let n = self.coerce_number_bounded(prop_val)?;
let new_val = JsValue::float(n + 1.0);
self.ordinary_set(obj, prop_name_si, new_val, receiver)?;
self.ordinary_set(obj, prop_name_si, new_val, receiver, self.current_strict())?;
self.regs[b] = new_val;
Ok(())
}
@@ -176,7 +176,7 @@ impl Vm {
let prop_val = self.ordinary_get(obj, prop_name_si, receiver)?;
let n = self.coerce_number_bounded(prop_val)?;
let new_val = JsValue::float(n - 1.0);
self.ordinary_set(obj, prop_name_si, new_val, receiver)?;
self.ordinary_set(obj, prop_name_si, new_val, receiver, self.current_strict())?;
self.regs[b] = new_val;
Ok(())
}
+6 -6
View File
@@ -435,7 +435,7 @@ impl Vm {
}
if obj.has_prop_meta() {
self.ordinary_set_dispatch(obj, prop_name_si, value, receiver)?;
self.ordinary_set_dispatch(obj, prop_name_si, value, receiver, self.current_strict())?;
return Ok(());
}
@@ -451,10 +451,10 @@ impl Vm {
// 写新属性(shape 转换):数组 length / 整数索引键仍走完整
// ordinary_set_dispatch 语义,其余走 CreateDataProperty 快路径。
if self.named_prop_create_needs_ordinary_set(obj, prop_name_si) {
self.ordinary_set_dispatch(obj, prop_name_si, value, receiver)?;
self.ordinary_set_dispatch(obj, prop_name_si, value, receiver, self.current_strict())?;
return Ok(());
}
self.create_named_prop_fast(obj, prop_name_si, value, receiver, ic_pc, true)?;
self.create_named_prop_fast(obj, prop_name_si, value, receiver, ic_pc, true, self.current_strict())?;
}
Ok(())
@@ -496,7 +496,7 @@ impl Vm {
}
let value = self.promote_if_needed_for_write_ptr(obj_ptr, self.regs[a]);
let obj = unsafe { &mut *obj_ptr };
self.ordinary_set_dispatch(obj, prop_name_si, value, self.regs[rd])?;
self.ordinary_set_dispatch(obj, prop_name_si, value, self.regs[rd], self.current_strict())?;
Ok(())
}
@@ -593,7 +593,7 @@ impl Vm {
}
let value = self.promote_if_needed_for_write_ptr(obj_ptr, self.regs[b]);
let obj = unsafe { &mut *obj_ptr };
self.ordinary_set_dispatch(obj, prop_name_si, value, self.regs[rd])?;
self.ordinary_set_dispatch(obj, prop_name_si, value, self.regs[rd], self.current_strict())?;
Ok(())
}
@@ -616,7 +616,7 @@ impl Vm {
// 直写绕过冻结语义。
if obj.has_prop_meta() {
let si = make_int_key(idx);
return self.ordinary_set_dispatch(obj, si, value, self.regs[rd]);
return self.ordinary_set_dispatch(obj, si, value, self.regs[rd], self.current_strict());
}
// 无 meta 快路径:不可扩展对象禁止新增元素(越界下标);已有元素直写不受限
// (无 meta 即默认可写)。