fix: matchAll 迭代器 next 按规范重写为 RegExpExec 协议与内部槽语义

crates/oxide_vm/src/bindings/mod.rs

@@ -684,7 +684,7 @@ fn install_to_string_tags(core: &Arc<KernelCore>, session: &KernelSession) {
         (world.map_iterator_proto.as_ptr() as *mut JsObject, "Map Iterator"),
         (world.set_iterator_proto.as_ptr() as *mut JsObject, "Set Iterator"),
         (world.string_iterator_proto.as_ptr() as *mut JsObject, "String Iterator"),
-        (world.regexp_string_iterator_proto.as_ptr() as *mut JsObject, "String Iterator"),
+        (world.regexp_string_iterator_proto.as_ptr() as *mut JsObject, "RegExp String Iterator"),
         (world.math_object.as_ptr() as *mut JsObject, "Math"),
         (world.json_object.as_ptr() as *mut JsObject, "JSON"),
         (world.symbol_proto.as_ptr() as *mut JsObject, "Symbol"),

crates/oxide_vm/tests/match_all_native_leak_tests.rs

@@ -69,7 +69,8 @@ fn string_pattern_match_all_iterator_survives_full_collect() {
     assert_eq!(to_str(&vm, result), "ab,ab");
 }
 
-/// 非 global 正则路径的存活载体同样跨收集保持有效。
+/// 非 global 正则路径的存活载体同样跨收集保持有效：非 global 匹配器
+/// 只产一枚匹配后 done（[[Global]] false 分支），存活判据是该枚匹配。
 #[test]
 fn non_global_regexp_match_all_iterator_survives_full_collect() {
     let mut vm = Vm::new();
@@ -80,7 +81,7 @@ fn non_global_regexp_match_all_iterator_survives_full_collect() {
         "var out = []; var st = it.next(); while (!st.done) { out.push(String(st.value[0])); st = it.next(); } out.join(',')",
     )
     .unwrap();
-    assert_eq!(to_str(&vm, result), "ab,ab");
+    assert_eq!(to_str(&vm, result), "ab");
 }
 
 /// 载体经内部属性可达，但无 RegExp 属性面：toString 保持普通对象标签。