fix: 修复闭包值传递链路

crates/oxide_vm/src/dispatch/call.rs

@@ -195,7 +195,18 @@ impl Vm {
             let obj = unsafe { &mut *callee.as_js_object_ptr() };
             let upvals = obj.upvalues_slice_mut();
             if uv_idx < upvals.len() {
-                let cell = self.gc_state.session_epoch.alloc(Cell::new(self.regs[rd], true));
+                // Try to get value from caller's cell table (MAKE_CELL ran after CREATE_CLOSURE)
+                let val = if self.cell_stack.len() >= 2 {
+                    let caller_cells = &self.cell_stack[self.cell_stack.len() - 2];
+                    if uv_idx < caller_cells.len() && !caller_cells[uv_idx].is_null() {
+                        unsafe { (*caller_cells[uv_idx]).value }
+                    } else {
+                        self.regs[rd]
+                    }
+                } else {
+                    self.regs[rd]
+                };
+                let cell = self.gc_state.session_epoch.alloc(Cell::new(val, true));
                 upvals[uv_idx] = cell as *mut Cell;
                 self.regs[rd] = cell.value;
                 return Ok(());

crates/oxide_vm/src/vm.rs

@@ -767,7 +767,6 @@ impl Vm {
         let callee_subs = &subs[sub_idx].sub_modules;
         if !callee_subs.is_empty() {
             self.sub_modules = Arc::new(callee_subs.clone());
-            self.immutables_cache = (0..=callee_subs.len()).map(|_| OnceLock::new()).collect();
         }
 
         self.active_reg_limit = sub_n_registers.max(1);

crates/oxide_vm/src/vm_runtime.rs

@@ -152,6 +152,8 @@ impl Vm {
     pub fn run(&mut self, module: &CompiledModule) -> Result<JsValue, String> {
         vm_debug!("run: starting bytecode execution, {} instructions", module.bytecode.len());
         self.clear_execution_state();
+        self.cell_stack.clear();
+        self.cell_stack.push(Vec::new());
         self.sub_modules = Arc::new(module.sub_modules.clone());
         self.immutables_cache = (0..=self.sub_modules.len()).map(|_| OnceLock::new()).collect();
         self.bytecode = module.bytecode.clone();

crates/oxide_vm/src/vm_support.rs

@@ -205,6 +205,7 @@ impl Vm {
         self.saved_bytecode_stack.clear();
         self.saved_immutables_stack.clear();
         self.save_stack.clear();
+        self.cell_stack.clear();
         self.try_stack.clear();
         self.exception_value = None;
         self.pending_exception = None;