feat: ArrayBuffer slice 物种化构造与完整步序语义

crates/oxide_builtins/src/array_buffer.rs

@@ -1,5 +1,6 @@
 use oxide_kernel::shape_forge::EMPTY_SHAPE_ID;
 use oxide_types::object::{JsObject, NativeFnPtr};
+use oxide_types::private_key::{make_well_known_symbol_key, WELL_KNOWN_SYMBOL_SPECIES};
 use oxide_types::value::JsValue;
 
 use oxide_runtime_api::{NativeResult, VmHost};
@@ -412,29 +413,151 @@ pub fn array_buffer_resize<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
     NativeResult::Ok(JsValue::undefined())
 }
 
+/// ResolveBounds(len, start, end) 共享核：start 为 undefined（或缺省）归 0、
+/// end 为 undefined（或缺省）归 len，在场臂 ToIntegerOrInfinity 上下夹取
+/// （NaN → 0、±Infinity 饱和 0/len、负值按 len 偏移）。slice 与
+/// sliceToImmutable 同源共用。
+fn ab_resolve_bounds<H: VmHost>(
+    vm: &mut H, len: usize, start: Option<JsValue>, end: Option<JsValue>,
+) -> Result<(usize, usize), JsValue> {
+    let start_val = start.unwrap_or(JsValue::undefined());
+    let first = if start_val.is_undefined() { 0 } else { normalize_index(vm, start_val, len)? };
+    let end_val = end.unwrap_or(JsValue::undefined());
+    let final_ = if end_val.is_undefined() { len } else { normalize_index(vm, end_val, len)? };
+    Ok((first, final_))
+}
+
+/// SpeciesConstructor(O, %ArrayBuffer%)：完整 Get O.constructor（访问器/异常
+/// 传播）；undefined 回落 %ArrayBuffer%，其余非对象抛 TypeError；完整 Get
+/// C[Symbol.species]（null 归一为 undefined）；undefined 回落 %ArrayBuffer%，
+/// 非构造器抛 TypeError。
+fn ab_species_constructor<H: VmHost>(vm: &mut H, o_val: JsValue) -> Result<JsValue, JsValue> {
+    let o_obj = unsafe { &*o_val.as_js_object_ptr() };
+    let ctor_key = vm.kernel_core().perm_interner().intern("constructor").0;
+    let c = match vm.ordinary_get(o_obj, ctor_key, o_val) {
+        Ok(v) => v,
+        Err(msg) => return Err(crate::iterator::engine_error(vm, &msg)),
+    };
+    let default_ctor =
+        JsValue::from_js_object(vm.session().builtin_world().array_buffer_constructor.as_ptr() as *mut JsObject);
+    if c.is_undefined() {
+        return Ok(default_ctor);
+    }
+    if !c.is_object() {
+        return Err(crate::error::create_type_error(vm, "ArrayBuffer constructor is not an object"));
+    }
+    let species_key = make_well_known_symbol_key(WELL_KNOWN_SYMBOL_SPECIES);
+    let s = match vm.ordinary_get(unsafe { &*c.as_js_object_ptr() }, species_key, c) {
+        Ok(v) => v,
+        Err(msg) => return Err(crate::iterator::engine_error(vm, &msg)),
+    };
+    let s = if s.is_null() { JsValue::undefined() } else { s };
+    if s.is_undefined() {
+        Ok(default_ctor)
+    } else if !crate::array::is_constructor_value(s) {
+        Err(crate::error::create_type_error(vm, "ArrayBuffer species is not a constructor"))
+    } else {
+        Ok(s)
+    }
+}
+
 /// `ArrayBuffer.prototype.slice(start, end)`：复制字节区间生成新 ArrayBuffer。
+///
+/// # 步骤
+/// 1. 品牌守卫与 detached 源守卫先于参数读（抛错时参数无副作用）。
+/// 2. len 快照 → ResolveBounds（start undefined/缺省 → 0、end undefined/缺省
+///    → len，不调强转）→ newLen = max(final - first, 0)。
+/// 3. SpeciesConstructor(O, %ArrayBuffer%)（构造器/@@species 完整 Get，异常
+///    传播；undefined 臂回落 %ArrayBuffer%；非对象/非构造器 TypeError）。
+/// 4. Construct(ctor, «newLen») 经 vm.construct_ctor（native 值传递 / bytecode
+///    压构造帧，含 derived 构造器 super() 语义；构造器抛出值原样上抛）。
+/// 5. 结果五检：AB 载荷槽 → detached → immutable → SameValue(new, O) →
+///    new.byteLength < newLen，均 TypeError。
+/// 6. 构造窗口后重取源载荷（窗口内源可被 detach/晋升）：detached →
+///    TypeError；按活 currentLen 夹拷贝（count = min(newLen, currentLen -
+///    first)，first < currentLen 守卫），余位零填充。
+///
+/// # 边界与前提
+/// - 源 immutable 是合法输入（只读拷贝）；对 new 的 immutable 检只挡物种
+///   构造器返回的 immutable 产物。
+/// - 源对象经寄存器根保活；每次 JS 调用窗口后重新读接收者寄存器与载荷指针。
 pub fn array_buffer_slice<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
-    let this_val = vm.reg(if args.is_empty() { 0 } else { args[0] });
+    let this_reg = if args.is_empty() { 0 } else { args[0] };
+    let this_val = vm.reg(this_reg);
     let payload_ptr = native_try!(array_buffer_payload(vm, this_val));
-    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷。
+    // SAFETY: payload_ptr 经 array_buffer_payload 校验为合法 ArrayBuffer 载荷；
+    // 标量拷出后借用即结束，不跨 JS 调用窗口。
     let Some(data) = unsafe { &*payload_ptr }.data.as_ref() else {
         return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
     };
     let len = data.len();
-    let start = if args.len() > 1 {
-        native_try!(normalize_index(vm, vm.reg(args[1]), len))
-    } else {
-        0
+    let start = if args.len() > 1 { Some(vm.reg(args[1])) } else { None };
+    let end = if args.len() > 2 { Some(vm.reg(args[2])) } else { None };
+    let (first, final_) = native_try!(ab_resolve_bounds(vm, len, start, end));
+    let new_len = final_.saturating_sub(first);
+
+    // 物种读与构造各是 JS 调用窗口：getter/构造器可 detach、resize、晋升源。
+    let ctor = native_try!(ab_species_constructor(vm, this_val));
+    let new_val = match vm.construct_ctor(ctor, &[JsValue::int(new_len as i32)]) {
+        Ok(v) => v,
+        Err(err) => return NativeResult::Err(err),
     };
-    let end = if args.len() > 2 {
-        native_try!(normalize_index(vm, vm.reg(args[2]), len))
-    } else {
-        len
+
+    // 构造窗口后重取接收者与载荷（源对象可被晋升进 session，旧指针悬垂）。
+    let this_val = vm.reg(this_reg);
+    let payload_ptr = native_try!(array_buffer_payload(vm, this_val));
+    // SAFETY: 重取的 payload_ptr 指向存活载荷盒；标量拷出后借用即结束。
+    let Some(data) = unsafe { &*payload_ptr }.data.as_ref() else {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer internal state invalid"));
     };
-    let end = end.max(start);
-    // 切片产物恒定长，原型取默认 %ArrayBuffer.prototype%。
-    let proto = default_array_buffer_proto(vm);
-    NativeResult::Ok(JsValue::from_js_object(new_array_buffer(vm, data[start..end].to_vec(), 0, proto)))
+    // 结果五检：AB 载荷槽 → detached → immutable → SameValue → 长度。
+    let new_ptr = new_val.as_js_object_ptr();
+    if new_ptr.is_null() {
+        return NativeResult::Err(crate::error::create_type_error(
+            vm,
+            "ArrayBuffer slice result is not an ArrayBuffer",
+        ));
+    }
+    // SAFETY: new_val 为对象且指针非空，对象本 session 存活。
+    let Some(new_payload) = array_buffer_payload_ptr(unsafe { &*new_ptr }) else {
+        return NativeResult::Err(crate::error::create_type_error(
+            vm,
+            "ArrayBuffer slice result is not an ArrayBuffer",
+        ));
+    };
+    if new_payload.is_null() {
+        return NativeResult::Err(crate::error::create_type_error(
+            vm,
+            "ArrayBuffer slice result is not an ArrayBuffer",
+        ));
+    }
+    // SAFETY: new_payload 经 array_buffer_payload_ptr 校验为 ArrayBuffer 载荷盒。
+    let new_state = unsafe { &*new_payload };
+    if new_state.data.is_none() {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer slice result is detached"));
+    }
+    if new_state.immutable {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer slice result is immutable"));
+    }
+    if new_val == this_val {
+        return NativeResult::Err(crate::error::create_type_error(
+            vm,
+            "ArrayBuffer slice result must not be the source buffer",
+        ));
+    }
+    if new_state.data.as_ref().map_or(0, |d| d.len()) < new_len {
+        return NativeResult::Err(crate::error::create_type_error(vm, "ArrayBuffer slice result is too small"));
+    }
+    // 活长度夹拷贝写入结果缓冲前区（构造器已零填充）：源中途收缩只拷现存
+    // 字节，first 越界零拷。
+    let current_len = data.len();
+    let count = if first < current_len { new_len.min(current_len - first) } else { 0 };
+    // SAFETY: new_payload 经 array_buffer_payload_ptr 校验；detached 臂已先行
+    // 排除，data 必为 Some，可变借用止于本语句。
+    if let Some(dest) = unsafe { (*new_payload).data.as_mut() } {
+        dest[..count].copy_from_slice(&data[first..first + count]);
+    }
+    NativeResult::Ok(new_val)
 }
 
 /// transfer 族新缓冲保持性：Preserve 源存储态上限原样拷贝，Fixed 定长，
@@ -772,11 +895,44 @@ mod tests {
         let r = eval_ab(
             &mut vm,
             "var calls = 0; \
-             var ab = new ArrayBuffer(4).transferToImmutable(); \
-             try { ab.resize({ valueOf() { calls++; return 0; } }); 'no-throw' } \
-             catch (err) { (err.name === 'TypeError' ? 'T' : 'X') + calls }",
+         var ab = new ArrayBuffer(4).transferToImmutable(); \
+         try { ab.resize({ valueOf() { calls++; return 0; } }); 'no-throw' } \
+         catch (err) { (err.name === 'TypeError' ? 'T' : 'X') + calls }",
         )
         .unwrap();
         assert_eq!(vm.lookup_str(r).unwrap(), "T0");
     }
+
+    /// slice end 缺省臂钉：end 为 undefined 归 len 不经强转（6, undefined) → 2；
+    /// start/end 全缺省 → 全长。
+    #[test]
+    fn slice_end_undefined_defaults_len() {
+        let mut vm = Vm::new();
+        let r = eval_ab(
+            &mut vm,
+            "new ArrayBuffer(8).slice(6, undefined).byteLength === 2 \
+             && new ArrayBuffer(8).slice(undefined).byteLength === 8 \
+             && new ArrayBuffer(8).slice(6).byteLength === 2 \
+             && new ArrayBuffer(8).slice(undefined, undefined).byteLength === 8",
+        )
+        .unwrap();
+        assert!(r.as_bool());
+    }
+
+    /// slice 构造窗口源 detach 重检钉：species 构造器内 detach 源 → 构造后
+    /// 重检抛 TypeError（不交付结果）。
+    #[test]
+    fn slice_source_detach_in_construct_throws() {
+        let mut vm = Vm::new();
+        let r = eval_ab(
+            &mut vm,
+            "(function () { var ab = new ArrayBuffer(8); \
+             var c = {}; c[Symbol.species] = function (len) { \
+                 $262.detachArrayBuffer(ab); return new ArrayBuffer(len); }; \
+             ab.constructor = c; \
+             try { ab.slice(); return 'no-throw'; } catch (err) { return err.name; } })()",
+        )
+        .unwrap();
+        assert_eq!(vm.lookup_str(r).unwrap(), "TypeError");
+    }
 }

crates/oxide_vm/tests/builtins_arraybuffer_state_tests.rs

@@ -818,3 +818,190 @@ fn ab_transfer_range_and_alloc_limits() {
     .unwrap();
     assert!(result.as_bool());
 }
+
+/// slice 窗口钉：全窗/前缀/后缀/负 start/负 end/start 越界/end 越界/
+/// start 超 end/空窗九形长度，源不 detach。
+#[test]
+fn ab_slice_window_pins() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "(function () { var ab = new ArrayBuffer(8); \
+         var bl = function (s) { return ab.slice(s[0], s[1]).byteLength; }; \
+         return bl([undefined, undefined]) === 8 && bl([0, 3]) === 3 && bl([6, undefined]) === 2 \
+         && bl([-2]) === 2 && bl([0, -2]) === 6 && bl([20]) === 0 \
+         && bl([2, 20]) === 6 && bl([5, 2]) === 0 && bl([3, 3]) === 0 \
+         && ab.detached === false })()",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// slice 空窗钉：产物附着 0 长（区别于 detach 空缓冲）。
+#[test]
+fn ab_slice_empty_window_not_detached() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "(function () { var r = new ArrayBuffer(4).slice(3, 3); \
+         return r.byteLength === 0 && r.detached === false && r.immutable === false })()",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// slice 内容钉：[1..8] 源 slice(2,6) → [3,4,5,6]，产物独立于源。
+#[test]
+fn ab_slice_content_copy() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "(function () { var ab = new ArrayBuffer(8); var v = new Uint8Array(ab); \
+         for (var i = 0; i < 8; i++) v[i] = i + 1; \
+         var d = new Uint8Array(ab.slice(2, 6)); \
+         return d.length === 4 && d[0] === 3 && d[1] === 4 && d[2] === 5 && d[3] === 6 \
+         && (v[0] = 90, new Uint8Array(ab.slice(2, 6))[0] === 3) })()",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// slice 构造窗内源收缩钉：species 构造器内 resize(1) 后返回 AB(8) →
+/// 不抛、结果 8 长、前 1 字节为源现存、余零填充（活 currentLen 夹拷贝）。
+#[test]
+fn ab_slice_source_shrink_in_construct() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "(function () { var ab = new ArrayBuffer(8, {maxByteLength: 16}); \
+         var v = new Uint8Array(ab); v[0] = 9; \
+         var c = {}; c[Symbol.species] = function (len) { \
+             ab.resize(1); return new ArrayBuffer(8); }; \
+         ab.constructor = c; \
+         var r = ab.slice(); \
+         var d = new Uint8Array(r); \
+         return r.byteLength === 8 && ab.byteLength === 1 \
+         && d[0] === 9 && d[1] === 0 && d[6] === 0 && d[7] === 0 })()",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// slice 物种回落三形钉：constructor undefined / species undefined /
+/// species null → 默认原型 + 内容正确（防回归钉，语料现巧合绿）。
+#[test]
+fn ab_slice_species_default_fallbacks() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "(function () { \
+         var ab1 = new ArrayBuffer(8); ab1.constructor = undefined; \
+         var r1 = ab1.slice(); \
+         var c2 = {}; var ab2 = new ArrayBuffer(8); ab2.constructor = c2; \
+         var r2 = ab2.slice(); \
+         var c3 = {}; c3[Symbol.species] = null; var ab3 = new ArrayBuffer(8); ab3.constructor = c3; \
+         var r3 = ab3.slice(); \
+         var v = new Uint8Array(ab1); v[0] = 7; \
+         var d = new Uint8Array(ab1.slice()); \
+         return Object.getPrototypeOf(r1) === ArrayBuffer.prototype && r1.byteLength === 8 \
+         && Object.getPrototypeOf(r2) === ArrayBuffer.prototype \
+         && Object.getPrototypeOf(r3) === ArrayBuffer.prototype \
+         && d[0] === 7 })()",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// slice 物种交付钉：构造器实参 «8» 逐次捕获、返回自建 AB → 交付原值且
+/// 内容拷贝入产物。
+#[test]
+fn ab_slice_species_custom_returns() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "(function () { var calls = []; var c = {}; \
+         c[Symbol.species] = function (len) { calls.push(len); return new ArrayBuffer(8); }; \
+         var ab = new ArrayBuffer(8); var v = new Uint8Array(ab); \
+         for (var i = 0; i < 8; i++) v[i] = i + 1; \
+         ab.constructor = c; \
+         var r = ab.slice(); \
+         var d = new Uint8Array(r); \
+         return r.byteLength === 8 && calls.join(',') === '8' \
+         && d[0] === 1 && d[7] === 8 && ab.detached === false })()",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// slice 物种 TypeError 五形钉：constructor null/true/\"\"、species
+/// 对象/Function.prototype 均 TypeError。
+#[test]
+fn ab_slice_species_type_error_family() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "(function () { function ty(fn) { try { fn(); return false; } catch (e) { return e instanceof TypeError; } } \
+         var ab = new ArrayBuffer(8); \
+         ab.constructor = null; var t1 = ty(function () { ab.slice(); }); \
+         ab.constructor = true; var t2 = ty(function () { ab.slice(); }); \
+         ab.constructor = ''; var t3 = ty(function () { ab.slice(); }); \
+         var c = {}; ab.constructor = c; \
+         c[Symbol.species] = {}; var t4 = ty(function () { ab.slice(); }); \
+         c[Symbol.species] = Function.prototype; var t5 = ty(function () { ab.slice(); }); \
+         return t1 && t2 && t3 && t4 && t5 })()",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// slice 结果五检前四形钉：物种返回非 AB / 返回 O 自身 / 返回小缓冲 →
+/// TypeError；返回大缓冲 → 交付（内容只填前缀）。
+#[test]
+fn ab_slice_species_result_checks() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "(function () { function ty(fn) { try { fn(); return false; } catch (e) { return e instanceof TypeError; } } \
+         var a1 = new ArrayBuffer(8); var c1 = {}; \
+         c1[Symbol.species] = function () { return {}; }; a1.constructor = c1; \
+         var t1 = ty(function () { a1.slice(); }); \
+         var a2 = new ArrayBuffer(8); var c2 = {}; \
+         c2[Symbol.species] = function () { return a2; }; a2.constructor = c2; \
+         var t2 = ty(function () { a2.slice(); }); \
+         var a3 = new ArrayBuffer(8); var c3 = {}; \
+         c3[Symbol.species] = function () { return new ArrayBuffer(4); }; a3.constructor = c3; \
+         var t3 = ty(function () { a3.slice(); }); \
+         var a4 = new ArrayBuffer(8); var v = new Uint8Array(a4); v[0] = 5; \
+         var c4 = {}; c4[Symbol.species] = function () { return new ArrayBuffer(10); }; a4.constructor = c4; \
+         var r4 = a4.slice(); var d4 = new Uint8Array(r4); \
+         return t1 && t2 && t3 && r4.byteLength === 10 && d4[0] === 5 && d4[8] === 0 })()",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+/// slice 源 detach 四形钉：源已 detach（参数未读）、start/end valueOf 内
+/// detach、species 构造内 detach（构造后重检步）均 TypeError。
+#[test]
+fn ab_slice_source_detach_family() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "(function () { function ty(fn) { try { fn(); return false; } catch (e) { return e instanceof TypeError; } } \
+         var a1 = new ArrayBuffer(8); $262.detachArrayBuffer(a1); \
+         var calls1 = []; var s1 = { valueOf: function () { calls1.push('s'); return 0; } }; \
+         var t1 = ty(function () { a1.slice(s1); }); \
+         var a2 = new ArrayBuffer(8); \
+         var s2 = { valueOf: function () { $262.detachArrayBuffer(a2); return 0; } }; \
+         var t2 = ty(function () { a2.slice(s2); }); \
+         var a3 = new ArrayBuffer(8); \
+         var e3 = { valueOf: function () { $262.detachArrayBuffer(a3); return 2; } }; \
+         var t3 = ty(function () { a3.slice(1, e3); }); \
+         var a4 = new ArrayBuffer(8); var c4 = {}; \
+         c4[Symbol.species] = function (len) { $262.detachArrayBuffer(a4); return new ArrayBuffer(len); }; \
+         a4.constructor = c4; var t4 = ty(function () { a4.slice(); }); \
+         return t1 && calls1.length === 0 && t2 && t3 && t4 })()",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}