From 33690fb8032fb9f039b06071b40873828f40ade8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=88=B1=E7=89=B9=E6=AF=8F=E7=BE=8A=E9=98=9F?=
 <t2026104239910027@eduxiji.net>
Date: Fri, 7 Aug 2026 18:00:59 +0800
Subject: [PATCH] =?UTF-8?q?fix(vm):=20REST=5FOBJECT=20=E6=8F=90=E5=89=8D?=
 =?UTF-8?q?=E6=B6=88=E8=B4=B9=20ext=20=E5=AD=97=E9=98=B2=20ToObject=20?=
 =?UTF-8?q?=E6=97=A9=E8=BF=94=E5=9B=9E=E5=90=8E=20pc=20=E9=94=99=E4=BD=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 crates/oxide_vm/src/vm_dispatch_misc.rs | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/crates/oxide_vm/src/vm_dispatch_misc.rs b/crates/oxide_vm/src/vm_dispatch_misc.rs
index f702efc..8155948 100644
--- a/crates/oxide_vm/src/vm_dispatch_misc.rs
+++ b/crates/oxide_vm/src/vm_dispatch_misc.rs
@@ -561,6 +561,10 @@ impl Vm {
 
     pub(crate) fn dispatch_rest_object(&mut self, rd: usize, a: usize) -> Result<(), String> {
         vm_trace!("REST_OBJECT rd={}", rd);
+        // ext 字（excluded 常量下标）在任何路径都先消费，防止 ToObject 早返回后
+        // pc 错位把 ext 字当下一条指令解码（曾误读成 UNSPILL slot）。
+        let excluded_idx = self.bytecode[self.pc] as usize;
+        self.pc += 1;
         let src = self.regs[a];
         if !src.is_object() {
             // ToObject：null/undefined 抛；number/boolean/symbol 无自有属性 → 空对象；
@@ -586,8 +590,6 @@ impl Vm {
             self.regs[rd] = JsValue::from_js_object(rest_ptr);
             return Ok(());
         }
-        let excluded_idx = self.bytecode[self.pc] as usize;
-        self.pc += 1;
         let excluded = self
             .immutables()
             .get(excluded_idx)