fix: 修复 array 元素溢出时分配内存错误问题

crates/oxide_types/src/object.rs

@@ -36,19 +36,26 @@ impl JsObject {
         }
     }
 
-    pub fn new_array(shape_id: ShapeId, proto: JsValue, n_elements: usize) -> Self {
-        assert!(
-            n_elements <= 4,
-            "arrays with >4 inline elements not yet supported"
-        );
-        Self {
+    pub fn new_array(
+        shape_id: ShapeId,
+        proto: JsValue,
+        n_elements: usize,
+        bump: &bumpalo::Bump,
+    ) -> Self {
+        let mut obj = Self {
             header: (shape_id & 0x00FF_FFFF) | (1 << 30) | (1 << 29),
             inline: [JsValue::undefined(); 4],
             overflow: std::ptr::null_mut(),
             proto,
             generation: 1,
             _pad: 0,
+        };
+        let count = (n_elements as u8).min(31);
+        obj.set_prop_count(count);
+        if n_elements > 4 {
+            obj.alloc_overflow(bump, n_elements);
         }
+        obj
     }
 
     pub fn shape_id(&self) -> ShapeId {
@@ -255,7 +262,8 @@ mod tests {
 
     #[test]
     fn new_array_flags() {
-        let obj = JsObject::new_array(5, JsValue::null(), 3);
+        let bump = bumpalo::Bump::new();
+        let obj = JsObject::new_array(5, JsValue::null(), 3, &bump);
         assert!(obj.is_array());
         assert_eq!(obj.shape_id(), 5);
     }

crates/oxide_vm/src/vm.rs

@@ -544,10 +544,12 @@ impl Vm {
                 OpCode::NEW_ARRAY => {
                     let proto_ptr = &*self.object_prototype as *const JsObject as *mut JsObject;
                     let n = opcode::imm16(instr) as usize;
+                    let bump = self.epoch.bump();
                     let obj = self.epoch.alloc(JsObject::new_array(
                         EMPTY_SHAPE_ID,
                         JsValue::from_js_object(proto_ptr),
                         n,
+                        bump,
                     ));
                     self.regs[rd] = JsValue::object(obj as *mut u8);
                 }