fix: Object.prototype.toString 类型标签（[object Array] 等）+ array_push 维护数组元素数

2026-08-07 22:06:09 +08:00
parent ca938e0655
commit f0f45c4ae0
2 changed files with 48 additions and 5 deletions
@@ -233,7 +233,10 @@ pub fn array_push<H: VmHost>(vm: &mut H, args: &[u8]) -> NativeResult {
    let arr_ptr = array_ptr!(vm, args);
    for &arg_reg in args.iter().skip(1) {
        let val = vm.promote_if_needed_for_write_ptr(arr_ptr, vm.reg(arg_reg));
-        unsafe { &mut *arr_ptr }.push_prop(val);
+        // 元素写入须维护 array_prop_count（set_prop_at 对数组自动更新）。
+        let arr = unsafe { &mut *arr_ptr };
+        let idx = arr.prop_count();
+        arr.set_prop_at(idx, val);
    }
    let len = unsafe { &*arr_ptr }.prop_count();
    NativeResult::Ok(JsValue::int(len as i32))