fix: 修复全局边界安全与内存稳定性问题

crates/oxide_vm/src/builtins/data_view.rs

@@ -8,7 +8,7 @@ use crate::native::NativeResult;
 use crate::vm::Vm;
 
 #[derive(Clone, Copy)]
-struct DataViewData {
+pub(crate) struct DataViewData {
     buffer: JsValue,
     byte_offset: usize,
     byte_length: usize,
@@ -177,7 +177,72 @@ pub fn data_view_constructor(vm: &mut Vm, args: &[u8]) -> NativeResult {
         JsValue::int(byte_length as i32),
         PropAttributes::new(false, false, false),
     );
-    NativeResult::Ok(JsValue::from_js_object(vm.epoch().alloc(obj)))
+    NativeResult::Ok(JsValue::from_js_object(vm.alloc_object(obj)))
+}
+
+fn data_view_data_ptr(obj: &JsObject) -> Option<*mut DataViewData> {
+    if !obj.is_data_view_obj() {
+        return None;
+    }
+    obj.native_fn().map(|ptr| ptr.as_ptr() as *mut DataViewData)
+}
+
+pub(crate) fn data_view_native_edges(obj: &JsObject) -> Vec<JsValue> {
+    let Some(ptr) = data_view_data_ptr(obj) else {
+        return Vec::new();
+    };
+    if ptr.is_null() {
+        return Vec::new();
+    }
+    let data = unsafe { *ptr };
+    if data.buffer.is_object() {
+        vec![data.buffer]
+    } else {
+        Vec::new()
+    }
+}
+
+pub(crate) fn clone_data_view_native_with_rewrite<F>(old_obj: &JsObject, new_obj: &mut JsObject, mut rewrite: F)
+where
+    F: FnMut(JsValue) -> JsValue,
+{
+    let Some(ptr) = data_view_data_ptr(old_obj) else {
+        return;
+    };
+    if ptr.is_null() {
+        return;
+    }
+    let mut data = unsafe { *ptr };
+    data.buffer = rewrite(data.buffer);
+    let cloned = Box::into_raw(Box::new(data));
+    new_obj.set_native_fn(Some(unsafe { NativeFnPtr::from_raw(cloned as *const ()) }));
+}
+
+pub(crate) fn rewrite_data_view_native<F>(obj: &mut JsObject, mut rewrite: F)
+where
+    F: FnMut(JsValue) -> JsValue,
+{
+    let Some(ptr) = data_view_data_ptr(obj) else {
+        return;
+    };
+    if ptr.is_null() {
+        return;
+    }
+    unsafe {
+        (*ptr).buffer = rewrite((*ptr).buffer);
+    }
+}
+
+pub(crate) fn drop_data_view_native(obj: &mut JsObject) -> u64 {
+    let Some(ptr) = data_view_data_ptr(obj) else {
+        return 0;
+    };
+    if ptr.is_null() {
+        return 0;
+    }
+    unsafe { drop(Box::from_raw(ptr)) };
+    obj.set_native_fn(None);
+    std::mem::size_of::<DataViewData>() as u64
 }
 
 pub fn data_view_get_int8(vm: &mut Vm, args: &[u8]) -> NativeResult {