fix: 修复属性分配溢出导致内存访问错误问题

crates/oxide_types/src/object.rs

@@ -146,8 +146,9 @@ impl JsObject {
     }
 
     pub fn set_prop_expand(&mut self, offset: u8, val: JsValue, bump: &bumpalo::Bump) {
-        if offset >= 4 && (self.overflow.is_null() || offset >= self.prop_count()) {
+        if offset >= 4 {
-            self.alloc_overflow(bump, (offset as usize) + 1);
+            let needed = (offset as usize) + 1;
+            self.alloc_overflow(bump, needed.max(8));
         }
         self.set_prop(offset, val);
     }