From dd0fbb3fceb871abcffade28e2fcfe9e9463146d Mon Sep 17 00:00:00 2001
From: sunzhe23 <sunzhe23@huawei.com>
Date: Tue, 22 Feb 2022 22:35:15 -0800
Subject: [PATCH]  issue:#I4UX5L  Reason: fix FastStub SetPropertyByName crash
 bug

 Description: SetLayoutToHClass set the wrong machine type, and cause a crash.

Signed-off-by: sunzhe23 <sunzhe23@huawei.com>
---
 ecmascript/compiler/fast_stub_define.h |  4 ++--
 ecmascript/compiler/stub-inl.h         |  4 ++--
 ecmascript/compiler/stub.cpp           | 14 ++------------
 ecmascript/compiler/stub.h             |  2 +-
 4 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/ecmascript/compiler/fast_stub_define.h b/ecmascript/compiler/fast_stub_define.h
index ce967476..242b40e0 100644
--- a/ecmascript/compiler/fast_stub_define.h
+++ b/ecmascript/compiler/fast_stub_define.h
@@ -155,7 +155,6 @@ namespace panda::ecmascript::kungfu {
     V(TryLoadICByValue, 5)              \
     V(TryStoreICByName, 5)              \
     V(TryStoreICByValue, 6)             \
-    V(TestAbsoluteAddressRelocation, 2) \
     INTERPRETER_STUB_HELPER_LIST(V)
 
 
@@ -164,7 +163,8 @@ namespace panda::ecmascript::kungfu {
     V(FastMulGCTest, 3)             \
     V(PhiGateTest, 1)               \
     V(LoopTest, 1)                  \
-    V(LoopTest1, 1)
+    V(LoopTest1, 1)                 \
+    V(TestAbsoluteAddressRelocation, 2)
 
 #define CALL_STUB_LIST(V)        \
     FAST_RUNTIME_STUB_LIST(V)    \
diff --git a/ecmascript/compiler/stub-inl.h b/ecmascript/compiler/stub-inl.h
index 8e604eee..83282e1e 100644
--- a/ecmascript/compiler/stub-inl.h
+++ b/ecmascript/compiler/stub-inl.h
@@ -1468,10 +1468,10 @@ GateRef Stub::SetProtoChangeDetailsToHClass(StubMachineType type, GateRef glue,
     return Store(type, glue, hClass, offset, protoChange);
 }
 
-GateRef Stub::SetLayoutToHClass(GateRef glue, GateRef hClass, GateRef attr)
+GateRef Stub::SetLayoutToHClass(StubMachineType type, GateRef glue, GateRef hClass, GateRef attr)
 {
     GateRef offset = GetIntPtrConstant(JSHClass::LAYOUT_OFFSET);
-    return Store(StubMachineType::TAGGED_POINTER, glue, hClass, offset, attr);
+    return Store(type, glue, hClass, offset, attr);
 }
 
 GateRef Stub::SetParentToHClass(StubMachineType type, GateRef glue, GateRef hClass, GateRef parent)
diff --git a/ecmascript/compiler/stub.cpp b/ecmascript/compiler/stub.cpp
index 93d6b81d..f1b4ace0 100644
--- a/ecmascript/compiler/stub.cpp
+++ b/ecmascript/compiler/stub.cpp
@@ -2254,18 +2254,8 @@ void Stub::CopyAllHClass(GateRef glue, GateRef dstHClass, GateRef srcHClass)
     auto env = GetEnvironment();
     Label entry(env);
     env->PushCurrentLabel(&entry);
-    Label exit(env);
-    Label isEcmaObject(env);
-    Label notEcmaObject(env);
     auto proto = GetPrototypeFromHClass(srcHClass);
-    Branch(IsEcmaObject(proto), &isEcmaObject, &exit);
-    Bind(&isEcmaObject);
-    {
-        SetIsProtoTypeToHClass(glue, LoadHClass(proto), TrueConstant());
-        Jump(&exit);
-    }
-    Bind(&exit);
-    SetPrototypeToHClass(StubMachineType::TAGGED_POINTER, glue, dstHClass, proto);
+    SetPrototypeToHClass(StubMachineType::INT64, glue, dstHClass, proto);
     SetBitFieldToHClass(glue, dstHClass, GetBitFieldFromHClass(srcHClass));
     SetNumberOfPropsToHClass(glue, dstHClass, GetNumberOfPropsFromHClass(srcHClass));
     SetParentToHClass(StubMachineType::INT64, glue, dstHClass, GetInt64Constant(JSTaggedValue::VALUE_NULL));
@@ -2273,7 +2263,7 @@ void Stub::CopyAllHClass(GateRef glue, GateRef dstHClass, GateRef srcHClass)
     SetProtoChangeDetailsToHClass(StubMachineType::INT64, glue, dstHClass,
                                   GetInt64Constant(JSTaggedValue::VALUE_NULL));
     SetEnumCacheToHClass(StubMachineType::INT64, glue, dstHClass, GetInt64Constant(JSTaggedValue::VALUE_NULL));
-    SetLayoutToHClass(glue, dstHClass, GetLayoutFromHClass(srcHClass));
+    SetLayoutToHClass(StubMachineType::INT64, glue, dstHClass, GetLayoutFromHClass(srcHClass));
     env->PopCurrentLabel();
     return;
 }
diff --git a/ecmascript/compiler/stub.h b/ecmascript/compiler/stub.h
index 94eddb3b..a82fda33 100644
--- a/ecmascript/compiler/stub.h
+++ b/ecmascript/compiler/stub.h
@@ -667,7 +667,7 @@ public:
     inline GateRef SetPrototypeToHClass(StubMachineType type, GateRef glue, GateRef hClass, GateRef proto);
     inline GateRef SetProtoChangeDetailsToHClass(StubMachineType type, GateRef glue, GateRef hClass,
 	                                               GateRef protoChange);
-    inline GateRef SetLayoutToHClass(GateRef glue, GateRef hClass, GateRef attr);
+    inline GateRef SetLayoutToHClass(StubMachineType type, GateRef glue, GateRef hClass, GateRef attr);
     inline GateRef SetParentToHClass(StubMachineType type, GateRef glue, GateRef hClass, GateRef parent);
     inline GateRef SetEnumCacheToHClass(StubMachineType type, GateRef glue, GateRef hClass, GateRef key);
     inline GateRef SetTransitionsToHClass(StubMachineType type, GateRef glue, GateRef hClass, GateRef transition);