fix: IC 快速路径 symbol 原始值走 Symbol.prototype 链

crates/oxide_vm/tests/builtins_symbol_tests.rs

@@ -283,3 +283,69 @@ fn symbol_key_read_via_get_own_property_symbols_index() {
     .unwrap();
     assert!(result.as_bool());
 }
+
+// --- Symbol 原始值成员访问走 Symbol.prototype 链 ---
+
+#[test]
+fn symbol_primitive_to_string_via_symbol_proto() {
+    let mut vm = Vm::new();
+    let result = eval(&mut vm, "Symbol('66').toString()").unwrap();
+    assert_eq!(to_str(&vm, result), "Symbol(66)");
+}
+
+#[test]
+fn symbol_primitive_value_of_via_symbol_proto() {
+    let mut vm = Vm::new();
+    let result = eval(&mut vm, "var s = Symbol('x'); s.valueOf() === s").unwrap();
+    assert!(result.as_bool());
+}
+
+#[test]
+fn symbol_primitive_chain_reaches_object_proto_method() {
+    let mut vm = Vm::new();
+    let result = eval(&mut vm, "Symbol('x').hasOwnProperty('description')").unwrap();
+    assert!(!result.as_bool());
+}
+
+#[test]
+fn symbol_primitive_description_getter() {
+    let mut vm = Vm::new();
+    let result = eval(&mut vm, "Symbol('desc').description").unwrap();
+    assert_eq!(to_str(&vm, result), "desc");
+}
+
+#[test]
+fn symbol_without_description_returns_undefined() {
+    let mut vm = Vm::new();
+    let result = eval(&mut vm, "Symbol().description").unwrap();
+    assert!(result.is_undefined());
+}
+
+#[test]
+fn symbol_wrapper_object_description_unboxes() {
+    let mut vm = Vm::new();
+    let result = eval(&mut vm, "Object(Symbol('w')).description").unwrap();
+    assert_eq!(to_str(&vm, result), "w");
+}
+
+#[test]
+fn symbol_description_non_symbol_receiver_throws_type_error() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "try { Object.getOwnPropertyDescriptor(Symbol.prototype, 'description').get.call(42); false } catch (e) { e instanceof TypeError }",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}
+
+#[test]
+fn symbol_proto_direct_description_access_throws_type_error() {
+    let mut vm = Vm::new();
+    let result = eval(
+        &mut vm,
+        "try { Symbol.prototype.description; false } catch (e) { e instanceof TypeError }",
+    )
+    .unwrap();
+    assert!(result.as_bool());
+}

crates/oxide_vm/tests/ic_polymorphic_tests.rs

@@ -181,3 +181,18 @@ fn primitive_receiver_skips_ic_ext_words() {
     );
     assert_eq!(r, "303", "字符串 length 经 primitive 分支返回 3，扩展字跳越无错位");
 }
+
+/// 非对象 receiver（symbol）经 IC primitive 分支走 Symbol.prototype 链：
+/// toString/description 均经原型解析，扩展字跳越无错位。
+#[test]
+fn symbol_primitive_receiver_walks_symbol_proto() {
+    let (r, _hits, _misses) = run_once(
+        r#"var s = Symbol('x');
+           var ok = 0;
+           for (var i = 0; i < 100; i++) {
+             ok += (s.toString() === 'Symbol(x)') ? 1 : 0;
+           }
+           ok + ((s.description === 'x') ? 1 : 0)"#,
+    );
+    assert_eq!(r, "101", "symbol 原始值 toString/description 经 Symbol.prototype 解析");
+}