fix: IC 快速路径 symbol 原始值走 Symbol.prototype 链

crates/oxide_vm/src/bindings/bind_symbol.rs

@@ -1,6 +1,6 @@
 use std::sync::Arc;
 
-use crate::bindings::{apply_binding_table, configure_native_constructor};
+use crate::bindings::{apply_binding_table, bind_accessor_getter, configure_native_constructor};
 use oxide_kernel::kernel::{KernelCore, KernelSession};
 use oxide_types::object::JsObject;
 use oxide_types::value::JsValue;
@@ -36,6 +36,15 @@ pub fn bind_symbol(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         ],
     );
 
+    // description 是访问器 getter（Symbol 原始值成员访问经 Symbol.prototype 链命中）。
+    bind_accessor_getter(
+        core,
+        session,
+        proto,
+        "description",
+        oxide_builtins::symbol::symbol_description_getter::<crate::vm::Vm> as *const (),
+    );
+
     for (name, val) in [
         (
             "match",

crates/oxide_vm/src/dispatch/property.rs

@@ -70,6 +70,11 @@ impl Vm {
             let proto = unsafe { &*proto_ptr };
             return self.ordinary_get(proto, prop_name_si, val).map(Some);
         }
+        if val.is_symbol() {
+            let proto_ptr = self.session.builtin_world().symbol_proto.as_ptr() as *mut JsObject;
+            let proto = unsafe { &*proto_ptr };
+            return self.ordinary_get(proto, prop_name_si, val).map(Some);
+        }
         Ok(None)
     }