Fix class static property ordering: preserve insertion order for length/name

Add clear_attr_markers() helper that removes attribute hidden-keys without
removing the main key from IndexMap. Use it in InitProperty's VmFunction
handler so that IndexMap::insert updates the value in-place, preserving
the original insertion order for built-in keys like 'length' and 'name'
when overridden by static class methods.

Fixes cluster 23: fn-length-static-precedence-order and
fn-name-static-precedence-order tests now pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: ssrlive

src/core/property_descriptor.rs

@@ -719,6 +719,13 @@ pub fn write_attrs_to_legacy_map<'gc>(map: &mut indexmap::IndexMap<String, Value
 /// entries from a legacy hidden-key map.
 pub fn remove_property_completely<'gc>(map: &mut indexmap::IndexMap<String, Value<'gc>>, key: &str) {
     map.shift_remove(key);
+    clear_attr_markers(map, key);
+}
+
+/// Clear attribute markers and accessor hidden-keys for `key` WITHOUT removing
+/// the key itself.  This allows `IndexMap::insert` to update the value in-place
+/// (preserving insertion order) rather than appending at the end.
+pub fn clear_attr_markers<'gc>(map: &mut indexmap::IndexMap<String, Value<'gc>>, key: &str) {
     map.shift_remove(&format!("{}{}", GETTER_PREFIX, key));
     map.shift_remove(&format!("{}{}", SETTER_PREFIX, key));
     map.shift_remove(&format!("{}{}{}", READONLY_PREFIX, key, READONLY_SUFFIX));

src/core/vm.rs

@@ -1,10 +1,10 @@
 use crate::core::opcode::{Chunk, Opcode};
 use crate::core::property_descriptor::{
     GETTER_PREFIX, NONCONFIGURABLE_PREFIX, NONCONFIGURABLE_SUFFIX, PropAttrs, PropDesc, PropKind, SETTER_PREFIX, attrs_from_legacy_map,
-    desc_from_legacy_map, get_getter, has_getter, has_nonconfigurable_mark, has_nonenumerable_mark, has_readonly_mark, has_setter,
-    lookup_getter, lookup_setter, make_getter_key, make_readonly_key, make_setter_key, mark_nonconfigurable, mark_nonenumerable,
-    mark_readonly, read_attrs_from_legacy_map, remove_getter, remove_property_completely, remove_setter, set_getter, set_setter,
-    unmark_nonconfigurable, unmark_nonenumerable, unmark_readonly, write_attrs_to_legacy_map,
+    clear_attr_markers, desc_from_legacy_map, get_getter, has_getter, has_nonconfigurable_mark, has_nonenumerable_mark, has_readonly_mark,
+    has_setter, lookup_getter, lookup_setter, make_getter_key, make_readonly_key, make_setter_key, mark_nonconfigurable,
+    mark_nonenumerable, mark_readonly, read_attrs_from_legacy_map, remove_getter, remove_property_completely, remove_setter, set_getter,
+    set_setter, unmark_nonconfigurable, unmark_nonenumerable, unmark_readonly, write_attrs_to_legacy_map,
 };
 use crate::core::value::{VmArrayData, VmMapData, VmSetData, value_to_string};
 use crate::core::{Collect, Expr, GcTrace, JSError, Value, new_gc_cell_ptr};

src/core/vm/runner.rs

@@ -4805,7 +4805,10 @@ impl<'gc> VM<'gc> {
                 }
                 // Write to per-closure overlay when available
                 let mut borrow = target_props.borrow_mut(ctx);
-                remove_property_completely(&mut borrow, &key);
+                // Clear attribute markers but keep the key in place so that
+                // IndexMap::insert updates the value in-place (preserving the
+                // original insertion order for keys like `length` / `name`).
+                clear_attr_markers(&mut borrow, &key);
                 borrow.insert(key, val.clone());
                 if let Value::VmFunction(fn_ip, _) | Value::VmClosure(fn_ip, _, _) = &val {
                     self.fn_home_objects.insert(*fn_ip, obj.clone());