fix: 数组 length 赋值 ArraySetLength 语义与超长逻辑长度（a.length 读取/收缩校验/空洞同步）

2026-10-24 18:51:13 +08:00 · 2026-08-12 12:52:02 +08:00
parent e87515a27f
commit d4cd52ba90
3 changed files with 79 additions and 2 deletions
@@ -934,7 +934,7 @@ impl Vm {
        vm_trace!("resolve_property: shape_id={} prop_name_si={}", obj.shape_id(), prop_name_si);
        let length_si = self.kernel_core.perm_interner().intern("length").0;
        if obj.is_array() && prop_name_si == length_si {
-            return Some(JsValue::int(obj.prop_count() as i32));
+            return Some(obj.logical_len_value());
        }
        if obj.is_array() {
            if let Some(index) = self.array_index_from_property_key(prop_name_si) {