diff --git a/crates/oxide_builtins/src/iterator.rs b/crates/oxide_builtins/src/iterator.rs index af61db5..fc126fb 100644 --- a/crates/oxide_builtins/src/iterator.rs +++ b/crates/oxide_builtins/src/iterator.rs @@ -65,9 +65,19 @@ pub(crate) fn try_make_iterator(vm: &mut H, value: JsValue) -> Result vm.set_or_create_prop_value(wrapper_obj, next_si, next_fn); // 把 IteratorClose 转发给内层迭代器，使 for-of 异常退出时可清理。 + // 仅当内层提供可调用的 return 方法时包装器才暴露 return：内建集合 + // （数组/字符串等索引迭代）无 return 方法，此时 GetMethod 应返回 undefined + // （IteratorClose 跳过），否则 return() 结果 undefined 会被误判为非对象报错。 let return_si = vm.kernel_core().perm_interner().intern("return").0; - let return_fn = make_native_function(vm, "return", iterator_wrapper_return:: as *const (), 0); - vm.set_or_create_prop_value(wrapper_obj, return_si, return_fn); + if inner.is_object() { + let inner_obj = unsafe { &*inner.as_js_object_ptr() }; + if let Ok(return_fn) = vm.ordinary_get(inner_obj, return_si, inner) { + if is_callable(return_fn) { + let wrapper_return = make_native_function(vm, "return", iterator_wrapper_return:: as *const (), 0); + vm.set_or_create_prop_value(wrapper_obj, return_si, wrapper_return); + } + } + } Ok(Some(JsValue::from_js_object(wrapper))) } diff --git a/crates/oxide_emit/src/closure.rs b/crates/oxide_emit/src/closure.rs index f464d9e..03ed4b2 100644 --- a/crates/oxide_emit/src/closure.rs +++ b/crates/oxide_emit/src/closure.rs @@ -22,6 +22,17 @@ impl Emitter { names } + /// 收集 for-in/for-of 头部声明（`var x` / 解构 pattern）绑定的名字。 + fn collect_for_left_decl_names(&self, left: &oxide_parser::ForStatementLeft, out: &mut HashSet) { + if let oxide_parser::ForStatementLeft::VariableDeclaration(vd) = left { + for d in &vd.declarations { + if let oxide_parser::BindingPattern::BindingIdentifier(bi) = &d.id { + out.insert(bi.name.to_string()); + } + } + } + } + /// 收集当前函数作用域声明的绑定名（参数 + 变量/函数声明，含嵌套 block，不含嵌套函数体）。 pub(crate) fn collect_own_binding_names(&self, param_names: &[&str], stmts: &[Statement]) -> HashSet { let mut names = HashSet::new(); @@ -66,6 +77,28 @@ impl Emitter { } self.collect_decl_names_stmt(std::slice::from_ref(&f.body), out); } + // for-in / for-of 头部的 var 声明是本函数局部绑定（遮蔽外层同名）， + // 须计入 own_bindings，否则闭包捕获分析会误判为捕获外层变量。 + Statement::ForInStatement(fi) => { + if let oxide_parser::ForStatementLeft::VariableDeclaration(vd) = &fi.left { + for d in &vd.declarations { + if let oxide_parser::BindingPattern::BindingIdentifier(bi) = &d.id { + out.insert(bi.name.to_string()); + } + } + } + self.collect_decl_names_stmt(std::slice::from_ref(&fi.body), out); + } + Statement::ForOfStatement(fo) => { + if let oxide_parser::ForStatementLeft::VariableDeclaration(vd) = &fo.left { + for d in &vd.declarations { + if let oxide_parser::BindingPattern::BindingIdentifier(bi) = &d.id { + out.insert(bi.name.to_string()); + } + } + } + self.collect_decl_names_stmt(std::slice::from_ref(&fo.body), out); + } Statement::SwitchStatement(sw) => { for case in &sw.cases { self.collect_decl_names_stmt(&case.consequent, out); @@ -87,13 +120,6 @@ impl Emitter { } } - /// 扫描 stmts 内（含任意深度嵌套函数）对 `ref_set` 的引用，写入 out。 - /// 递归进入嵌套函数时累加其局部绑定为遮蔽集，避免把内层局部误判为捕获。 - fn collect_capture_names(&self, stmts: &[Statement], ref_set: &HashSet, out: &mut HashSet) { - let shadow = HashSet::new(); - self.collect_capture_names_shadowed(stmts, ref_set, &shadow, out); - } - fn collect_capture_names_shadowed( &self, stmts: &[Statement], ref_set: &HashSet, shadow: &HashSet, out: &mut HashSet, ) { @@ -174,11 +200,16 @@ impl Emitter { } Statement::ForInStatement(fi) => { self.collect_capture_names_expr(&fi.right, ref_set, shadow, out); - self.collect_capture_names_stmt(&fi.body, ref_set, shadow, out); + // left 的 var 声明遮蔽外层同名绑定，body 内引用不视为捕获外层。 + let mut for_shadow = shadow.clone(); + self.collect_for_left_decl_names(&fi.left, &mut for_shadow); + self.collect_capture_names_shadowed(std::slice::from_ref(&fi.body), ref_set, &for_shadow, out); } Statement::ForOfStatement(fo) => { self.collect_capture_names_expr(&fo.right, ref_set, shadow, out); - self.collect_capture_names_stmt(&fo.body, ref_set, shadow, out); + let mut for_shadow = shadow.clone(); + self.collect_for_left_decl_names(&fo.left, &mut for_shadow); + self.collect_capture_names_shadowed(std::slice::from_ref(&fo.body), ref_set, &for_shadow, out); } Statement::BlockStatement(b) => self.collect_capture_names_shadowed(&b.body, ref_set, shadow, out), Statement::TryStatement(ts) => { @@ -501,7 +532,11 @@ impl Emitter { Statement::FunctionDeclaration(fd) => { let body: &[Statement] = fd.body.as_ref().map(|b| &b.statements[..]).unwrap_or(&[]); self.collect_fn_default_captured(&fd.params, own, out); - self.collect_capture_names(body, own, out); + // 函数参数与体内部声明遮蔽父级绑定：体内对这些名字的引用不算捕获父级。 + let mut fn_shadow = HashSet::new(); + fn_shadow.extend(self.collect_fn_param_names(&fd.params)); + fn_shadow.extend(self.collect_own_binding_names(&[], body)); + self.collect_capture_names_shadowed(body, own, &fn_shadow, out); } Statement::ClassDeclaration(cd) => { // 类构造器/方法体与字段表达式引用的父级绑定须建 cell，供子模块 upvalue 捕获。 diff --git a/crates/oxide_emit/src/shared/binding.rs b/crates/oxide_emit/src/shared/binding.rs index 0746e89..ce6a349 100644 --- a/crates/oxide_emit/src/shared/binding.rs +++ b/crates/oxide_emit/src/shared/binding.rs @@ -190,23 +190,74 @@ impl Emitter { fn emit_object_binding( &self, op: &ObjectPattern, src_reg: u32, kind: VariableDeclarationKind, is_const: bool, ctx: &mut CompileCtx, ) -> Result<(), String> { + // 对象解构先 ToObject(rhs)：null/undefined 抛 TypeError（含空 pattern）， + // 原始值包装为对应对象，保证属性读取与 rest 都以对象为源。 + // 写到临时寄存器，保留 src_reg 原值（声明初始化路径的返回值语义）。 + let obj_reg = ctx.alloc_reg(); + ctx.inst(Inst::new(OpCode::LOAD_VAR, Operand::Reg(obj_reg), Operand::Reg(src_reg), Operand::None)); + ctx.inst(Inst::new(OpCode::TO_OBJECT, Operand::Reg(obj_reg), Operand::None, Operand::None)); + // 有 rest 时构建运行时 excluded 数组：静态 key 直接 push 常量，computed key 求值结果 push 值。 let mut excluded = Vec::new(); + let mut excl_arr_reg = None; + let mut excl_push = 0usize; + if op.rest.is_some() { + excl_arr_reg = Some(self.emit_new_excluded_array(ctx)); + } for prop in &op.properties { - let (prop_reg, static_key) = self.emit_object_property_read_key(src_reg, &prop.key, prop.computed, ctx)?; + let (prop_reg, static_key, key_reg) = + self.emit_object_property_read_key(obj_reg, &prop.key, prop.computed, ctx)?; if let Some(key) = static_key { - excluded.push(key); + excluded.push(key.clone()); + if let Some(arr) = excl_arr_reg { + self.emit_push_excluded_key(arr, None, &key, excl_push, ctx); + excl_push += 1; + } + } else if let (Some(arr), Some(key_reg)) = (excl_arr_reg, key_reg) { + self.emit_push_excluded_key(arr, Some(key_reg), "", excl_push, ctx); + excl_push += 1; } self.emit_binding_pattern(&prop.value, prop_reg, kind, is_const, ctx)?; } if let Some(rest) = &op.rest { let rest_reg = ctx.alloc_reg(); let excluded_idx = ctx.add_constant(Constant::String(excluded.join("\0"))); - ctx.inst(Inst::rest_object(Operand::Reg(rest_reg), Operand::Reg(src_reg), excluded_idx as u32)); + ctx.inst(Inst::rest_object( + Operand::Reg(rest_reg), + Operand::Reg(obj_reg), + excluded_idx as u32, + excl_arr_reg.map(Operand::Reg), + )); self.emit_binding_pattern(&rest.argument, rest_reg, kind, is_const, ctx)?; } Ok(()) } + /// 新建运行时 excluded 数组（NEW_ARRAY），供 REST_OBJECT 排除 computed key。 + fn emit_new_excluded_array(&self, ctx: &mut CompileCtx) -> u32 { + let arr = ctx.alloc_reg(); + ctx.inst(Inst::new(OpCode::NEW_ARRAY, Operand::Reg(arr), Operand::None, Operand::None)); + arr + } + + /// 向 excluded 数组下标 `idx` 写入一个键：`key_val` 为运行时寄存器值，否则用 `key_str` 常量。 + fn emit_push_excluded_key( + &self, arr: u32, key_val: Option, key_str: &str, idx: usize, ctx: &mut CompileCtx, + ) { + let val_reg = match key_val { + Some(kv) => kv, + None => { + let ki = ctx.add_constant(Constant::String(key_str.to_string())); + let kr = ctx.alloc_reg(); + ctx.inst(Inst::load_const(Operand::Reg(kr), ki)); + kr + } + }; + let elem_idx = ctx.alloc_reg(); + let cidx = ctx.add_constant(Constant::Int(idx as i32)); + ctx.inst(Inst::load_const(Operand::Reg(elem_idx), cidx)); + ctx.inst(Inst::new(OpCode::SET_ELEM, Operand::Reg(arr), Operand::Reg(elem_idx), Operand::Reg(val_reg))); + } + fn emit_assignment_maybe_default( &self, target: &AssignmentTargetMaybeDefault, src_reg: u32, ctx: &mut CompileCtx, ) -> Result<(), String> { @@ -260,13 +311,28 @@ impl Emitter { pub(crate) fn emit_object_assignment( &self, op: &ObjectAssignmentTarget, src_reg: u32, ctx: &mut CompileCtx, ) -> Result<(), String> { + // 对象解构先 ToObject(rhs)：null/undefined 抛 TypeError（含空 pattern）， + // 原始值包装为对应对象，保证属性读取与 rest 都以对象为源。 + // 写到临时寄存器，保留 src_reg 原值（解构赋值表达式返回值 = rhs）。 + let obj_reg = ctx.alloc_reg(); + ctx.inst(Inst::new(OpCode::LOAD_VAR, Operand::Reg(obj_reg), Operand::Reg(src_reg), Operand::None)); + ctx.inst(Inst::new(OpCode::TO_OBJECT, Operand::Reg(obj_reg), Operand::None, Operand::None)); let mut excluded = Vec::new(); + let mut excl_arr_reg = None; + let mut excl_push = 0usize; + if op.rest.is_some() { + excl_arr_reg = Some(self.emit_new_excluded_array(ctx)); + } for prop in &op.properties { match prop { AssignmentTargetProperty::AssignmentTargetPropertyIdentifier(id) => { let key = id.binding.name.as_str().to_string(); excluded.push(key.clone()); - let mut prop_reg = self.emit_object_property_read(src_reg, &key, ctx); + if let Some(arr) = excl_arr_reg { + self.emit_push_excluded_key(arr, None, &key, excl_push, ctx); + excl_push += 1; + } + let mut prop_reg = self.emit_object_property_read(obj_reg, &key, ctx); if let Some(default_expr) = &id.init { let name = id.binding.name.as_str(); prop_reg = self.emit_default_if_undefined(prop_reg, default_expr, Some(name), ctx)?; @@ -281,10 +347,17 @@ impl Emitter { )); } AssignmentTargetProperty::AssignmentTargetPropertyProperty(prop) => { - let (prop_reg, static_key) = - self.emit_object_property_read_key(src_reg, &prop.name, prop.computed, ctx)?; + let (prop_reg, static_key, key_reg) = + self.emit_object_property_read_key(obj_reg, &prop.name, prop.computed, ctx)?; if let Some(key) = static_key { - excluded.push(key); + excluded.push(key.clone()); + if let Some(arr) = excl_arr_reg { + self.emit_push_excluded_key(arr, None, &key, excl_push, ctx); + excl_push += 1; + } + } else if let (Some(arr), Some(key_reg)) = (excl_arr_reg, key_reg) { + self.emit_push_excluded_key(arr, Some(key_reg), "", excl_push, ctx); + excl_push += 1; } self.emit_assignment_maybe_default(&prop.binding, prop_reg, ctx)?; } @@ -293,7 +366,12 @@ impl Emitter { if let Some(rest) = &op.rest { let rest_reg = ctx.alloc_reg(); let excluded_idx = ctx.add_constant(Constant::String(excluded.join("\0"))); - ctx.inst(Inst::rest_object(Operand::Reg(rest_reg), Operand::Reg(src_reg), excluded_idx as u32)); + ctx.inst(Inst::rest_object( + Operand::Reg(rest_reg), + Operand::Reg(obj_reg), + excluded_idx as u32, + excl_arr_reg.map(Operand::Reg), + )); self.emit_assign_target(&rest.target, rest_reg, ctx)?; } Ok(()) diff --git a/crates/oxide_emit/src/shared/chain.rs b/crates/oxide_emit/src/shared/chain.rs index 6770e30..55e7e80 100644 --- a/crates/oxide_emit/src/shared/chain.rs +++ b/crates/oxide_emit/src/shared/chain.rs @@ -281,11 +281,11 @@ impl Emitter { pub(crate) fn emit_object_property_read_key( &self, src_reg: u32, key: &PropertyKey, computed: bool, ctx: &mut CompileCtx, - ) -> Result<(u32, Option), String> { + ) -> Result<(u32, Option, Option), String> { if !computed { let key_name = self.static_property_name(key)?; let prop_reg = self.emit_object_property_read(src_reg, &key_name, ctx); - return Ok((prop_reg, Some(key_name))); + return Ok((prop_reg, Some(key_name), None)); } let prop_reg = ctx.alloc_reg(); ctx.inst(Inst::new(OpCode::LOAD_VAR, Operand::Reg(prop_reg), Operand::Reg(src_reg), Operand::None)); @@ -297,6 +297,6 @@ impl Emitter { Operand::Reg(key_reg), Operand::Reg(val_reg), )); - Ok((val_reg, None)) + Ok((val_reg, None, Some(key_reg))) } } diff --git a/crates/oxide_ir/src/contract.rs b/crates/oxide_ir/src/contract.rs index 92b8567..6d32d40 100644 --- a/crates/oxide_ir/src/contract.rs +++ b/crates/oxide_ir/src/contract.rs @@ -301,8 +301,11 @@ impl Inst { // for-in/of 迭代器：INIT 读 a；NEXT/DONE 读迭代器栈隐式状态 OpCode::FOR_IN_INIT | OpCode::FOR_OF_INIT => push_operand(&mut uses, &self.a), OpCode::FOR_IN_NEXT | OpCode::FOR_IN_DONE | OpCode::FOR_OF_NEXT | OpCode::FOR_OF_DONE => {} - // REST_OBJECT：读 a（ext 是 excluded_idx 常量） - OpCode::REST_OBJECT => push_operand(&mut uses, &self.a), + // REST_OBJECT：读 a（src）与可选 b（运行时 excluded 数组），ext 是 excluded_idx 常量 + OpCode::REST_OBJECT => { + push_operand(&mut uses, &self.a); + push_operand(&mut uses, &self.b); + } // SPREAD_OBJECT：原地改目标对象，读目标（rd）与源（a） OpCode::SPREAD_OBJECT => { push_operand(&mut uses, &self.rd); diff --git a/crates/oxide_ir/src/inst.rs b/crates/oxide_ir/src/inst.rs index 99f2f05..d514b7a 100644 --- a/crates/oxide_ir/src/inst.rs +++ b/crates/oxide_ir/src/inst.rs @@ -203,8 +203,10 @@ impl Inst { } /// 对象 rest 展开：`{...src, 排除 excluded_idx 常量列出的键}` 存入 `rest`。 - pub fn rest_object(rest: Operand, src: Operand, excluded_idx: u32) -> Self { - Self::with_ext(OpCode::REST_OBJECT, rest, src, Operand::None, &[excluded_idx]) + /// `excl_arr` 为可选运行时 excluded 键数组寄存器（computed key 求值结果）， + /// None 时仅用编译期 excluded_idx 常量。 + pub fn rest_object(rest: Operand, src: Operand, excluded_idx: u32, excl_arr: Option) -> Self { + Self::with_ext(OpCode::REST_OBJECT, rest, src, excl_arr.unwrap_or(Operand::None), &[excluded_idx]) } /// 对象字面量 spread 展开：把源 `src` 的可枚举自有属性写入目标对象 `rd`（原地改）。 diff --git a/crates/oxide_regalloc/src/graph.rs b/crates/oxide_regalloc/src/graph.rs index 9ed54f0..600e011 100644 --- a/crates/oxide_regalloc/src/graph.rs +++ b/crates/oxide_regalloc/src/graph.rs @@ -180,7 +180,7 @@ pub(super) fn build( at_i.push(fr.id); } } - // 两两加边 + // 两两加边（基于 live_before：约束 use/def 与执行前存活值） for a in 0..at_i.len() { for b in a + 1..at_i.len() { let (x, y) = (at_i[a], at_i[b]); @@ -188,6 +188,22 @@ pub(super) fn build( adj_sets.entry(y).or_default().insert(x); } } + // def 结果与执行后仍存活的值冲突（写覆盖）：live_after 含 def 后存活者。 + // live_before 已 kill def 自身，纯写指令（FOR_OF_NEXT 等）的结果若与长活 + // 寄存器同色会覆盖其值（elision 解构返回值被覆盖），须补此干涉边。 + if let Some(d) = f.insts[i].def_reg() { + if nodes.contains_key(&d) { + for &v in &node_ids { + if v == d { + continue; + } + if live.inst_live_after[i].get(v as usize).copied().unwrap_or(false) { + adj_sets.entry(d).or_default().insert(v); + adj_sets.entry(v).or_default().insert(d); + } + } + } + } } for (v, set) in adj_sets { if let Some(node) = nodes.get_mut(&v) { diff --git a/crates/oxide_regalloc/tests/runtime_eq.rs b/crates/oxide_regalloc/tests/runtime_eq.rs index 3beef64..8825b0b 100644 --- a/crates/oxide_regalloc/tests/runtime_eq.rs +++ b/crates/oxide_regalloc/tests/runtime_eq.rs @@ -54,6 +54,11 @@ fn regalloc_preserves_semantics() { "function f(n) { var s = 0; for (var i = 0; i < n; i++) { s += i * i; } return s; } f(10);", // 解构 "function f() { var [a, b] = [1, 2]; var { c, d } = { c: 3, d: 4 }; return a + b + c + d; } f();", + // elision 解构赋值：返回值寄存器与 FOR_OF_NEXT 结果须异色（def 干涉边回归） + "var result; var vals = [1, 2, 3]; result = [,] = vals; result[0] + result[1] + result[2];", + "var result; var vals = [1, 2, 3]; var x, y, z; result = [x, y, z] = vals; x + y + z;", + // 嵌套数组解构（内层迭代器覆盖外层 last result，done 检查须正确） + "var x; var vals = [[1]]; var result = [[x]] = vals; x;", // 闭包（upvalue cell 路径） "function f() { var x = 1; return function() { return x++; }; } var g = f(); var r = [g(), g(), g()]; r[0] + r[1] + r[2];", // 箭头函数 diff --git a/crates/oxide_vm/src/dispatch/call.rs b/crates/oxide_vm/src/dispatch/call.rs index faaeb75..18aaa69 100644 --- a/crates/oxide_vm/src/dispatch/call.rs +++ b/crates/oxide_vm/src/dispatch/call.rs @@ -5,7 +5,7 @@ use oxide_builtins::iterator::make_iterator_for_value; use oxide_builtins::{builtins_debug, builtins_trace}; use oxide_bytecode::opcode; use oxide_runtime_api::{to_boolean, NativeResult}; -use oxide_types::object::{Cell, JsObject}; +use oxide_types::object::{Cell, JsObject, PropAttributes}; use oxide_types::value::JsValue; use std::sync::Arc; @@ -135,7 +135,8 @@ impl Vm { .as_deref() .map(|n| self.new_string(n)) .unwrap_or_else(|| self.new_string("")); - self.set_or_create_prop_value(func_obj, name_si, name_val); + // name 属性描述符：不可写、不可枚举、可配置（SetFunctionName 语义）。 + self.define_data_property(func_obj, name_si, name_val, PropAttributes::new(false, false, true))?; if !upvalue_captures.is_empty() { // 链式捕获（parent_uv_idx）：从父闭包（创建者）的 upvalues 取 cell。 let parent_upvalues: Vec<*mut Cell> = match self.current_callee() { diff --git a/crates/oxide_vm/src/dispatch/misc.rs b/crates/oxide_vm/src/dispatch/misc.rs index 36930ec..fe8be35 100644 --- a/crates/oxide_vm/src/dispatch/misc.rs +++ b/crates/oxide_vm/src/dispatch/misc.rs @@ -58,6 +58,11 @@ impl Vm { if val.is_object() { return Ok(()); } + if val.is_null() || val.is_undefined() { + // 抛 JS 异常而非返回 Err：外围 try/catch 须能捕获（对象解构空 pattern）。 + self.raise_error_kind("TypeError", "Cannot convert null or undefined to object")?; + return Ok(()); + } let obj_val = oxide_runtime_api::to_object(val, self)?; self.regs[rd] = obj_val; Ok(()) diff --git a/crates/oxide_vm/src/vm.rs b/crates/oxide_vm/src/vm.rs index 0a6d111..e8e7087 100644 --- a/crates/oxide_vm/src/vm.rs +++ b/crates/oxide_vm/src/vm.rs @@ -1453,7 +1453,7 @@ impl Vm { } OpCode::REST_OBJECT => { - self.dispatch_rest_object(rd, a)?; + self.dispatch_rest_object(rd, a, b)?; } OpCode::SPREAD_OBJECT => { diff --git a/crates/oxide_vm/src/vm_dispatch_misc.rs b/crates/oxide_vm/src/vm_dispatch_misc.rs index 4b75280..0189c5c 100644 --- a/crates/oxide_vm/src/vm_dispatch_misc.rs +++ b/crates/oxide_vm/src/vm_dispatch_misc.rs @@ -521,6 +521,18 @@ impl Vm { let Some(iterator) = self.iters.pop_for_of() else { return Ok(()); }; + // 迭代已自然结束（最后一次 next 返回 done:true）时不调 return()； + // 仅当元素耗尽但迭代器未 done（提前退出）才执行 IteratorClose。 + let result = self.iters.last_for_of_result(); + if result.is_object() { + let result_obj = unsafe { &*result.as_js_object_ptr() }; + let done_si = self.kernel_core.perm_interner().intern("done").0; + if let Ok(done_val) = self.ordinary_get(result_obj, done_si, result) { + if to_boolean(done_val) { + return Ok(()); + } + } + } // 正常 / break / return 退出：此前无进行中的突然完成，return() 自身的抛出直接传播。 self.close_for_of_iterator(iterator, false) } @@ -558,7 +570,16 @@ impl Vm { self.exception_value = saved_exc; self.pending_error_kind = saved_kind; } else { - let _ = self.call_function_sync(return_fn, iterator, &[])?; + let inner = match self.call_function_sync(return_fn, iterator, &[]) { + Ok(v) => v, + // return() 抛出：恢复原始异常值并展开，使外围 try/catch 可捕获。 + Err(e) => return self.raise_call_error(&e).map(|_| ()), + }; + // IteratorClose 要求 return() 返回值是对象，否则抛 TypeError。 + if !inner.is_object() { + self.raise_type_error("iterator return() result is not an object")?; + return Ok(()); + } } } } @@ -577,7 +598,7 @@ impl Vm { } } - pub(crate) fn dispatch_rest_object(&mut self, rd: usize, a: usize) -> Result<(), String> { + pub(crate) fn dispatch_rest_object(&mut self, rd: usize, a: usize, b: usize) -> Result<(), String> { vm_trace!("REST_OBJECT rd={}", rd); // ext 字（excluded 常量下标）在任何路径都先消费，防止 ToObject 早返回后 // pc 错位把 ext 字当下一条指令解码（曾误读成 UNSPILL slot）。 @@ -608,7 +629,7 @@ impl Vm { self.regs[rd] = JsValue::from_js_object(rest_ptr); return Ok(()); } - let excluded = self + let excluded_const = self .immutables() .get(excluded_idx) .and_then(|v| { @@ -620,39 +641,96 @@ impl Vm { } }) .unwrap_or_default(); - let excluded: std::collections::HashSet<&str> = excluded.split('\0').filter(|s| !s.is_empty()).collect(); + let mut excluded: std::collections::HashSet = excluded_const + .split('\0') + .filter(|s| !s.is_empty()) + .map(|s| self.kernel_core.perm_interner().intern(s).0) + .collect(); + // 运行时 excluded：b 槽数组（computed key 求值结果）的元素 ToPropertyKey 后排除。 + if b != 0 { + let arr_val = self.regs[b]; + if arr_val.is_object() { + let arr_obj = unsafe { &*arr_val.as_js_object_ptr() }; + if arr_obj.is_array() { + for i in 0..arr_obj.array_prop_count { + let v = arr_obj.get_prop_at(i); + let si = self.property_key_si(v); + excluded.insert(si); + } + } + } + } + let src_obj = unsafe { &*src.as_js_object_ptr() }; + + // 收集-提交：先取齐 (键, 值)，取值阶段触发 getter（可能抛异常），再统一写 + // 目标对象，避免提交写与取值互相交错。只复制可枚举自有属性（CopyDataProperties）。 + let mut assignments: Vec<(u32, JsValue)> = Vec::new(); + + // 字符串包装对象：索引字符是可枚举自有属性（ToObject("str") 的 0..len-1）。 + if src_obj.type_tag == JsObject::OBJ_TYPE_STRING_OBJ { + let raw = src_obj.get_prop_at(0); + let s = unsafe { (*raw.as_string_ptr()).data.clone() }; + let code_units: Vec = s.encode_utf16().collect(); + for (i, unit) in code_units.iter().enumerate() { + let ch = char::from_u32(*unit as u32).map(|c| c.to_string()).unwrap_or_default(); + let si = self.kernel_core.perm_interner().intern(&i.to_string()).0; + assignments.push((si, self.new_string(&ch))); + } + } + + // 数组元素区：整数下标可枚举元素（hole 跳过）。 + if src_obj.is_array() { + for i in 0..src_obj.array_prop_count { + if src_obj.prop_meta_at(i).is_some_and(|m| m.is_hole()) { + continue; + } + let enumerable = src_obj + .prop_meta_at(i) + .map(|m| m.attributes.enumerable()) + .unwrap_or(PropAttributes::DEFAULT_DATA.enumerable()); + if enumerable { + let si = self.kernel_core.perm_interner().intern(&i.to_string()).0; + let val = match self.ordinary_get(src_obj, si, src) { + Ok(v) => v, + Err(e) => return self.raise_call_error(&e).map(|_| ()), + }; + assignments.push((si, val)); + } + } + } + + // 命名属性：shape 链（walk_own_keys 规范顺序），仅可枚举，跳过 pattern 已绑定的键。 + let keys = oxide_builtins::object::walk_own_keys(self, src_obj); + for (si, pos) in keys { + let store = if src_obj.is_array() { src_obj.array_prop_count + pos } else { pos }; + let enumerable = src_obj + .prop_meta_at(store) + .map(|m| m.attributes.enumerable()) + .unwrap_or(PropAttributes::DEFAULT_DATA.enumerable()); + if !enumerable { + continue; + } + if excluded.contains(&si) { + continue; + } + let val = match self.ordinary_get(src_obj, si, src) { + Ok(v) => v, + Err(e) => return self.raise_call_error(&e).map(|_| ()), + }; + assignments.push((si, val)); + } + + // 提交到 rest 对象。 let proto_ptr = self.session.builtin_world().object_proto.as_ptr() as *mut JsObject; let rest_ptr = self.alloc_object(JsObject::new_empty( oxide_kernel::shape_forge::EMPTY_SHAPE_ID, JsValue::from_js_object(proto_ptr), )); - let src_obj = unsafe { &*src.as_js_object_ptr() }; - let mut cursor = Some(src_obj.shape_id()); - while let Some(shape_id) = cursor { - if shape_id == oxide_kernel::shape_forge::EMPTY_SHAPE_ID { - break; - } - let Some(shape) = self.kernel_core.shape_forge().get_shape(shape_id) else { - break; - }; - if shape.property_name != u32::MAX && !is_private_name_key(shape.property_name) { - if let Some(name) = self.kernel_core.perm_interner().lookup(shape.property_name) { - if !excluded.contains(name) { - if let Some(pos) = self - .kernel_core - .shape_forge() - .lookup_position(src_obj.shape_id(), shape.property_name) - { - let val = src_obj.get_prop_at(pos); - let rest = unsafe { &mut *rest_ptr }; - let val = self.promote_if_needed_for_write_ptr(rest_ptr, val); - self.set_or_create_prop_value(rest, shape.property_name, val); - } - } - } - } - cursor = shape.parent; + let rest = unsafe { &mut *rest_ptr }; + for (si, val) in assignments { + let promoted = self.promote_if_needed_for_write_ptr(rest_ptr, val); + self.set_or_create_prop_value(rest, si, promoted); } self.regs[rd] = JsValue::from_js_object(rest_ptr); Ok(())