feat: 函数 length 属性（字节码函数/bind 包装器）+ getter/setter name 前缀

crates/oxide_vm/src/dispatch/call.rs

@@ -121,6 +121,7 @@ impl Vm {
         let needs_home_object = sub.needs_home_object;
         let upvalue_captures = sub.upvalue_captures.clone();
         let function_name = sub.function_name.clone();
+        let function_length = sub.function_length;
         let result = self.create_function_object(
             sub_idx,
             is_arrow,
@@ -130,13 +131,18 @@ impl Vm {
         );
         // 函数名推断：emit 端在变量声明/对象属性赋值点设置 function_name。
         let func_obj = unsafe { &mut *result.as_js_object_ptr() };
+        let length_si = self.kernel_core.perm_interner().intern("length").0;
         let name_si = self.kernel_core.perm_interner().intern("name").0;
+        // length/name 描述符均为不可写、不可枚举、可配置（SetFunctionLength /
+        // SetFunctionName 语义）；length 先于 name 定义保证属性序 [prototype, length, name]。
+        let attrs = PropAttributes::new(false, false, true);
+        let length_val = JsValue::int(function_length as i32);
+        self.define_data_property(func_obj, length_si, length_val, attrs)?;
         let name_val = function_name
             .as_deref()
             .map(|n| self.new_string(n))
             .unwrap_or_else(|| self.new_string(""));
-        // name 属性描述符：不可写、不可枚举、可配置（SetFunctionName 语义）。
-        self.define_data_property(func_obj, name_si, name_val, PropAttributes::new(false, false, true))?;
+        self.define_data_property(func_obj, name_si, name_val, attrs)?;
         if !upvalue_captures.is_empty() {
             // 链式捕获（parent_uv_idx）：从父闭包（创建者）的 upvalues 取 cell。
             let parent_upvalues: Vec<*mut Cell> = match self.current_callee() {

crates/oxide_vm/src/vm_props.rs

@@ -237,9 +237,16 @@ impl Vm {
         &mut self, setter: JsValue, receiver: JsValue, val: JsValue, use_frame_push: bool,
     ) -> Result<(), String> {
         vm_trace!("call_or_push_setter: frame_push={}", use_frame_push);
+        // native setter 抛错经 call_function_sync 以 String 返回（未 unwind）——
+        // 在此经 raise_call_error 恢复为可捕获的 JS 异常（与 getter 路径对称）。
+        let call_native = |vm: &mut Self| -> Result<(), String> {
+            if let Err(err) = vm.call_function_sync(setter, receiver, &[val]) {
+                vm.raise_call_error(&err)?;
+            }
+            Ok(())
+        };
         if !use_frame_push {
-            self.call_function_sync(setter, receiver, &[val])?;
-            return Ok(());
+            return call_native(self);
         }
         if !setter.is_object() {
             return self.raise_type_error("setter is not callable");
@@ -249,8 +256,7 @@ impl Vm {
             return self.raise_type_error("setter is not callable");
         }
         if setter_obj.native_fn().is_some() {
-            self.call_function_sync(setter, receiver, &[val])?;
-            return Ok(());
+            return call_native(self);
         }
         self.push_bytecode_frame(
             setter,