refactor: 添加 release 兜底逻辑与类型标签检查

crates/oxide_vm/src/builtins/boolean.rs

@@ -46,6 +46,7 @@ pub fn boolean_constructor(vm: &mut Vm, args: &[u8]) -> NativeResult {
     }
 
     let obj = unsafe { &mut *this_val.as_js_object_ptr() };
+    obj.type_tag = JsObject::OBJ_TYPE_BOOLEAN_OBJ;
     obj.push_prop(JsValue::bool(bool_val));
     NativeResult::Ok(this_val)
 }
@@ -59,9 +60,7 @@ pub fn boolean_prototype_value_of(vm: &mut Vm, args: &[u8]) -> NativeResult {
         ));
     }
     let obj = unsafe { &*this_val.as_js_object_ptr() };
-    let boolean_proto = vm.kernel().builtin_world().boolean_proto.as_ptr() as *mut JsObject;
-    let proto_ptr = obj.proto().as_js_object_ptr();
-    if proto_ptr.is_null() || !std::ptr::eq(proto_ptr, boolean_proto) {
+    if !obj.is_boolean_obj() {
         return NativeResult::Err(crate::builtins::error::create_type_error(
             vm,
             "Boolean.prototype.valueOf called on non-Boolean object",
@@ -80,9 +79,7 @@ pub fn boolean_prototype_to_string(vm: &mut Vm, args: &[u8]) -> NativeResult {
         ));
     }
     let obj = unsafe { &*this_val.as_js_object_ptr() };
-    let boolean_proto = vm.kernel().builtin_world().boolean_proto.as_ptr() as *mut JsObject;
-    let proto_ptr = obj.proto().as_js_object_ptr();
-    if proto_ptr.is_null() || !std::ptr::eq(proto_ptr, boolean_proto) {
+    if !obj.is_boolean_obj() {
         return NativeResult::Err(crate::builtins::error::create_type_error(
             vm,
             "Boolean.prototype.toString called on non-Boolean object",

crates/oxide_vm/src/builtins/date.rs

@@ -9,27 +9,16 @@ use crate::native::NativeResult;
 use crate::vm::Vm;
 
 fn get_timestamp(obj: &JsObject) -> f64 {
-    obj.get_prop_at(0).as_double()
+    let v = obj.get_prop_at(0);
+    if v.is_double() { v.as_double() } else { f64::NAN }
 }
 
 fn set_timestamp(obj: &mut JsObject, ms: f64) {
     obj.set_prop_at(0, JsValue::float(ms));
 }
 
-fn is_date(vm: &Vm, obj: &JsObject) -> bool {
-    let date_proto = vm.kernel().builtin_world().date_proto.as_ptr() as *mut JsObject;
-    if date_proto.is_null() {
-        return false;
-    }
-    let proto_ptr = obj.proto().as_js_object_ptr();
-    if proto_ptr.is_null() {
-        return false;
-    }
-    std::ptr::eq(proto_ptr, date_proto)
-}
-
 fn ensure_date(vm: &mut Vm, obj: &JsObject) -> Result<(), JsValue> {
-    if !is_date(vm, obj) {
+    if !obj.is_date_obj() {
         return Err(crate::builtins::error::create_type_error(vm, "called on incompatible receiver"));
     }
     Ok(())
@@ -176,7 +165,7 @@ pub fn date_constructor(vm: &mut Vm, args: &[u8]) -> NativeResult {
             if ptr.is_null() {
                 false
             } else {
-                is_date(vm, unsafe { &*ptr })
+                unsafe { &*ptr }.is_date_obj()
             }
         } {
             let obj = unsafe { &*val.as_js_object_ptr() };
@@ -201,6 +190,7 @@ pub fn date_constructor(vm: &mut Vm, args: &[u8]) -> NativeResult {
         EMPTY_SHAPE_ID,
         JsValue::from_js_object(vm.kernel().builtin_world().date_proto.as_ptr() as *mut JsObject),
     );
+    obj.type_tag = JsObject::OBJ_TYPE_DATE;
     obj.set_prop_at(0, JsValue::float(timestamp));
 
     let ptr = vm.epoch().alloc(obj);

crates/oxide_vm/src/builtins/regexp.rs

@@ -21,6 +21,12 @@ fn get_regexp_ptr(vm: &Vm, args: &[u8]) -> Result<*mut JsObject, JsValue> {
     if ptr.is_null() {
         return Err(JsValue::string(vm.kernel().string_forge().intern("TypeError: null object").0, 0));
     }
+    if !unsafe { &*ptr }.is_regexp_obj() {
+        return Err(JsValue::string(
+            vm.kernel().string_forge().intern("TypeError: RegExp.prototype method called on non-RegExp object").0,
+            0,
+        ));
+    }
     Ok(ptr)
 }
 
@@ -112,6 +118,7 @@ pub fn regexp_constructor(vm: &mut Vm, args: &[u8]) -> NativeResult {
     set_prop(&mut obj, "dotAll", JsValue::bool(false), vm);
     set_prop(&mut obj, "sticky", JsValue::bool(false), vm);
     set_prop(&mut obj, "unicode", JsValue::bool(false), vm);
+    obj.type_tag = JsObject::OBJ_TYPE_REGEXP;
 
     let obj_ptr = vm.epoch().alloc(obj);
     NativeResult::Ok(JsValue::from_js_object(obj_ptr))

crates/oxide_vm/src/builtins/string.rs

@@ -11,35 +11,24 @@ fn this_string(vm: &Vm, args: &[u8]) -> String {
     coercion::to_string(vm.kernel().string_forge().as_ref(), vm.reg(args[0]))
 }
 
-fn boxed_primitive_value(this_val: JsValue) -> Option<JsValue> {
-    if !this_val.is_object() {
-        return None;
-    }
-    let ptr = this_val.as_js_object_ptr();
-    if ptr.is_null() {
-        return None;
-    }
-    let obj = unsafe { &*ptr };
-    let val = obj.get_prop_at(0);
-    if val.is_undefined() && obj.prop_count() == 0 {
-        None
-    } else {
-        Some(val)
-    }
-}
-
 pub fn string_value_of(vm: &mut Vm, args: &[u8]) -> NativeResult {
     let this_val = vm.reg(args[0]);
     if this_val.is_string() {
         return NativeResult::Ok(this_val);
     }
-    match boxed_primitive_value(this_val) {
-        Some(v) => NativeResult::Ok(v),
-        None => NativeResult::Err(crate::builtins::error::create_type_error(
-            vm,
-            "String.prototype.valueOf called on non-String object",
-        )),
+    if this_val.is_object() {
+        let ptr = this_val.as_js_object_ptr();
+        if !ptr.is_null() {
+            let obj = unsafe { &*ptr };
+            if obj.is_string_obj() {
+                return NativeResult::Ok(obj.get_prop_at(0));
+            }
+        }
     }
+    NativeResult::Err(crate::builtins::error::create_type_error(
+        vm,
+        "String.prototype.valueOf called on non-String object",
+    ))
 }
 
 fn make_string_array(vm: &mut Vm, parts: &[String]) -> JsValue {

crates/oxide_vm/src/coercion.rs

@@ -293,19 +293,20 @@ pub fn to_object(val: JsValue, vm: &mut Vm) -> Result<JsValue, &'static str> {
     if val.is_null() || val.is_undefined() {
         return Err("TypeError: Cannot convert null or undefined to object");
     }
-    let proto_ptr = if val.is_string() {
-        vm.kernel().builtin_world().string_proto.as_ptr() as *mut JsObject
+    let (proto_ptr, type_tag) = if val.is_string() {
+        (vm.kernel().builtin_world().string_proto.as_ptr() as *mut JsObject, JsObject::OBJ_TYPE_STRING_OBJ)
     } else if val.is_int() || val.is_double() {
-        vm.kernel().builtin_world().number_proto.as_ptr() as *mut JsObject
+        (vm.kernel().builtin_world().number_proto.as_ptr() as *mut JsObject, JsObject::OBJ_TYPE_NUMBER_OBJ)
     } else if val.is_bool() {
-        vm.kernel().builtin_world().boolean_proto.as_ptr() as *mut JsObject
+        (vm.kernel().builtin_world().boolean_proto.as_ptr() as *mut JsObject, JsObject::OBJ_TYPE_BOOLEAN_OBJ)
     } else {
-        &*vm.object_prototype as *const JsObject as *mut JsObject
+        (&*vm.object_prototype as *const JsObject as *mut JsObject, JsObject::OBJ_TYPE_PLAIN)
     };
     let proto_val = JsValue::from_js_object(proto_ptr);
     let obj = vm.epoch.alloc(JsObject::new_empty(EMPTY_SHAPE_ID, proto_val));
     let obj_val = JsValue::from_js_object(obj);
     let obj_ref = unsafe { &mut *obj };
+    obj_ref.type_tag = type_tag;
     obj_ref.ensure_hash_props().push(val);
     obj_ref.set_prop_count(1);
     Ok(obj_val)