fix: sloppy 未声明写隐式全局创建 + strict ReferenceError——DEFINE_GLOBAL_PROP_C 0x98

crates/oxide_vm/src/ic_helper.rs

@@ -66,6 +66,7 @@ fn ext_word_count(bytecode: &[Instr], pc: usize) -> usize {
         | OpCode::DEFINE_ACCESSOR
         | OpCode::DEFINE_ACCESSOR_DYNAMIC
         | OpCode::DEFINE_PROP_ATTRS
+        | OpCode::DEFINE_GLOBAL_PROP_C
         | OpCode::DELETE_PROP_STATIC
         | OpCode::REST_OBJECT
         | OpCode::INIT_PRIVATE => 1,

crates/oxide_vm/src/vm.rs

@@ -1834,6 +1834,12 @@ impl Vm {
                     self.dispatch_define_global_prop(rd, a, b)?;
                 }
 
+                OpCode::DEFINE_GLOBAL_PROP_C => {
+                    let key_idx = self.bytecode[self.pc] as u16;
+                    self.pc += 1;
+                    self.dispatch_define_global_prop_c(a, key_idx)?;
+                }
+
                 OpCode::DEFINE_PROP_ATTRS => {
                     let attrs = self.bytecode[self.pc] as u8;
                     self.pc += 1;

crates/oxide_vm/src/vm_dispatch_ctrl.rs

@@ -1,7 +1,7 @@
 use crate::vm::{Completion, FrameArgs, FrameContinuation, TryHandler, Vm};
 use crate::vm_trace;
 use oxide_bytecode::opcode;
-use oxide_types::object::PropAttributes;
+use oxide_types::object::{JsObject, PropAttributes};
 use oxide_types::private_key::make_private_name_id;
 use oxide_types::value::JsValue;
 
@@ -294,6 +294,42 @@ impl Vm {
         Ok(())
     }
 
+    /// 定义隐式全局数据属性：ext 字 = 键常量池下标（u16），a 槽 = 值寄存器。
+    /// 全局对象由 session 直接解析——函数体内隐式全局写不依赖 this（regs[254]
+    /// 不一定是全局对象）。属性可写/可枚举/可配置（未声明标识符 PutValue 与
+    /// eval 脚本 var/函数声明的属性描述符）。
+    ///
+    /// # 边界与前提
+    /// - 键常量必须是字符串（emit 侧保证）；非字符串按错误返回。
+    /// - 全局对象不可扩展且属性缺失 → TypeError（两模式均抛，CreateGlobalVarBinding 语义）；
+    ///   已有不可写属性时 sloppy PutValue 静默 no-op，严格模式抛错。
+    pub(crate) fn dispatch_define_global_prop_c(&mut self, a: usize, key_idx: u16) -> Result<(), String> {
+        let idx = key_idx as usize;
+        vm_trace!("DEFINE_GLOBAL_PROP_C value={} idx={}", a, idx);
+        let key_val = self.immutables().get(idx).copied().unwrap_or(JsValue::undefined());
+        if !key_val.is_string() {
+            return Err(format!("DEFINE_GLOBAL_PROP_C constant index {idx} is not a string key"));
+        }
+        let si = self.property_key_si(key_val)?;
+        let value = self.regs[a];
+        let global_ptr = self.session.global_object().as_ptr() as *mut JsObject;
+        // SAFETY: 全局对象钉在 session 永久区，指针在 VM 生命周期内有效。
+        let obj = unsafe { &mut *global_ptr };
+        match self.define_data_property(obj, si, value, PropAttributes::new(true, true, true)) {
+            Ok(()) => Ok(()),
+            Err(msg) => {
+                // 不可扩展 + 新属性：规范两模式均抛；已有不可写属性：sloppy 静默、strict 抛。
+                let non_extensible_new = self.kernel_core.shape_forge().lookup_position(obj.shape_id(), si).is_none()
+                    && !obj.is_extensible();
+                if non_extensible_new || self.current_strict() {
+                    self.raise_error_kind("TypeError", &msg)
+                } else {
+                    Ok(())
+                }
+            }
+        }
+    }
+
     /// break 完成：`crossed`（rd 槽）为 emit 词法算出的逃出 finally 域数。
     /// 逐个穿越 finally 后跳转到目标；crossed 为 0 时直接跳转。
     /// ext 字携带逃出的迭代器层数：无 finally 穿越时立即关闭后跳转，有 finally

crates/oxide_vm/tests/implicit_global_write_tests.rs

@@ -0,0 +1,163 @@
+//! sloppy 未声明标识符写（隐式全局创建）语义测试：sloppy 未解析引用写在全局对象
+//! 建可写/可枚举/可配置数据属性；严格模式同一写抛 ReferenceError（编译期拦截）。
+//! 覆盖脚本顶层、函数体（全局对象经 session 解析，不依赖 this）、解构目标、
+//! 更新式/逻辑赋值、for-in/for-of 左侧与不可扩展全局对象分支。
+
+use oxide_compiler::compiler::Compiler;
+use oxide_types::value::JsValue;
+use oxide_vm::vm::Vm;
+
+fn eval(source: &str) -> Result<JsValue, String> {
+    let allocator = oxide_parser::Allocator::default();
+    let program = oxide_parser::parse(&allocator, source).map_err(|e| format!("Parse error: {:?}", e))?;
+    let module = Compiler::new().compile(&program).map_err(|e| format!("Compile error: {}", e))?;
+    let mut vm = Vm::new();
+    vm.run(&module)
+}
+
+fn eval_many(lines: &[&str]) -> Result<JsValue, String> {
+    eval(&lines.join("; "))
+}
+
+fn assert_err_contains(result: Result<JsValue, String>, expected: &str) {
+    match result {
+        Ok(_) => panic!("expected error containing '{}', got Ok", expected),
+        Err(e) => assert!(e.contains(expected), "expected error containing '{}', got: {}", expected, e),
+    }
+}
+
+/// 求值并把结果按字符串提取（`JsValue` Display 不携带字符串内容）。
+fn eval_str(source: &str) -> String {
+    let allocator = oxide_parser::Allocator::default();
+    let program = oxide_parser::parse(&allocator, source).expect("parse");
+    let module = Compiler::new().compile(&program).expect("compile");
+    let mut vm = Vm::new();
+    let result = vm.run(&module).expect("run");
+    vm.lookup_str(result).unwrap_or_else(|| format!("{result}"))
+}
+
+// ── sloppy 顶层未声明写：全局对象新建可写/可枚举/可配置数据属性 ──
+#[test]
+fn sloppy_undeclared_write_creates_global_property() {
+    let r = eval_many(&["x = 1", "globalThis.x === 1"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "sloppy 未声明写应建全局属性，实际 {:?}", r);
+}
+
+#[test]
+fn sloppy_undeclared_write_descriptor_writable_enumerable_configurable() {
+    let s = eval_str(
+        "y = 2; var d = Object.getOwnPropertyDescriptor(globalThis, 'y'); \
+         d.writable + ':' + d.enumerable + ':' + d.configurable",
+    );
+    assert_eq!(s, "true:true:true", "隐式全局属性描述符应全 true，实际 {s}");
+}
+
+// ── 可配置：隐式全局属性经 Object.defineProperty 可再描述（var 绑定不可配置） ──
+#[test]
+fn sloppy_undeclared_write_property_reconfigurable() {
+    let r =
+        eval_many(&["x = 1", "Object.defineProperty(globalThis, 'x', { value: 9 })", "globalThis.x === 9"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "可配置隐式全局属性应可再定义，实际 {:?}", r);
+}
+
+// ── 函数体内未声明写：全局对象经 session 解析（不依赖 this） ──
+#[test]
+fn sloppy_function_body_undeclared_write_lands_on_global() {
+    let r = eval_many(&["function f() { x = 7 }", "f()", "globalThis.x === 7"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "函数体内未声明写应落全局对象，实际 {:?}", r);
+}
+
+// ── 解构赋值目标：未声明标识符走同一隐式全局路径 ──
+#[test]
+fn sloppy_destructuring_undeclared_write_lands_on_global() {
+    let r = eval_many(&["({ q } = { q: 5 })", "globalThis.q === 5"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "解构未声明目标应落全局对象，实际 {:?}", r);
+}
+
+// ── 更新式赋值：未声明名 RMW 旧值 undefined，落全局 NaN（undefined + 1） ──
+#[test]
+fn sloppy_update_operator_undeclared_write_lands_on_global() {
+    let r = eval_many(&["z++", "Number.isNaN(globalThis.z)"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "z++ 未声明写应落全局 NaN（undefined+1），实际 {:?}", r);
+}
+
+#[test]
+fn sloppy_compound_operator_undeclared_write_is_nan() {
+    let s = eval_str("w += 1; typeof w");
+    assert_eq!(s, "number", "w += 1 未声明名应为 NaN（typeof number），实际 {s}");
+}
+
+// ── 逻辑赋值：未声明名 ||= 短路建全局 ──
+#[test]
+fn sloppy_logical_assign_undeclared_write_lands_on_global() {
+    let r = eval_many(&["p ||= 5", "globalThis.p === 5"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "p ||= 5 未声明写应落全局为 5，实际 {:?}", r);
+}
+
+// ── for-in 左侧未声明标识符：首个键后建全局 ──
+#[test]
+fn sloppy_for_in_undeclared_write_lands_on_global() {
+    let r = eval_many(&["for (k in { a: 1 }) {}", "globalThis.k === 'a'"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "for-in 未声明左侧应落全局为 'a'，实际 {:?}", r);
+}
+
+// ── for-of 左侧未声明标识符：末次迭代值落全局 ──
+#[test]
+fn sloppy_for_of_undeclared_write_lands_on_global() {
+    let r = eval_many(&["for (v of [1, 2]) {}", "globalThis.v === 2"]).unwrap();
+    assert!(r.is_bool() && r.as_bool(), "for-of 未声明左侧应落全局为 2，实际 {:?}", r);
+}
+
+// ── 严格模式：顶层未声明写抛 ReferenceError（消息与读侧一致） ──
+#[test]
+fn strict_top_level_undeclared_write_throws() {
+    let result = eval("'use strict'; x = 1");
+    assert_err_contains(result, "x is not defined");
+}
+
+// ── 严格模式：函数体内未声明写抛 ReferenceError ──
+#[test]
+fn strict_function_body_undeclared_write_throws() {
+    let result = eval("function f() { 'use strict'; y = 2 }; f()");
+    assert_err_contains(result, "y is not defined");
+}
+
+// ── 严格 for-in：空对象无键不抛（PutValue 仅首键后发生） ──
+#[test]
+fn strict_for_in_empty_object_does_not_throw() {
+    let r = eval("'use strict'; for (k in {}) {}; true").unwrap();
+    assert!(r.is_bool() && r.as_bool(), "严格空 for-in 不应抛错，实际 {:?}", r);
+}
+
+// ── 严格 for-of：空迭代器不抛 ──
+#[test]
+fn strict_for_of_empty_does_not_throw() {
+    let r = eval("'use strict'; for (v of []) {}; true").unwrap();
+    assert!(r.is_bool() && r.as_bool(), "严格空 for-of 不应抛错，实际 {:?}", r);
+}
+
+// ── 全局对象不可扩展 + 属性缺失：sloppy 未声明写抛 TypeError ──
+#[test]
+fn sloppy_undeclared_write_on_non_extensible_global_throws() {
+    let result = eval("Object.preventExtensions(globalThis); t = 1");
+    assert_err_contains(result, "not extensible");
+}
+
+// ── 全局对象不可扩展 + 属性缺失：严格未声明写先抛 ReferenceError ──
+#[test]
+fn strict_undeclared_write_on_non_extensible_global_throws_reference() {
+    let result = eval("'use strict'; Object.preventExtensions(globalThis); t = 1");
+    assert_err_contains(result, "t is not defined");
+}
+
+// ── 既有不可写非可配置全局属性：sloppy 未声明写静默 no-op 不抛错 ──
+#[test]
+fn sloppy_undeclared_write_to_readonly_global_property_silent() {
+    let r = eval_many(&[
+        "Object.defineProperty(globalThis, 'gw', { value: 0, writable: false, configurable: false })",
+        "gw = 1",
+        "globalThis.gw === 0",
+    ])
+    .unwrap();
+    assert!(r.is_bool() && r.as_bool(), "sloppy 对既有不可写全局属性写应静默 no-op，实际 {:?}", r);
+}