!8416 Fix segfault in GC during AOT compilation

Merge pull request !8416 from Efremov Andrey/fix-aot-segfault

ecmascript/compiler/pgo_type/pgo_type_parser.cpp

@@ -93,7 +93,7 @@ void ClassParser::GenerateHClass(const PGOHClassGenerator &generator, const PGOT
 
         auto phValue = ptManager_->QueryHClass(protoPt, protoPt);
         JSHandle<JSHClass> phclass(thread, phValue);
-        JSHandle<JSObject> prototype = thread->GetEcmaVM()->GetFactory()->NewJSObject(phclass);
+        JSHandle<JSObject> prototype = thread->GetEcmaVM()->GetFactory()->NewJSObjectWithInit(phclass);
         generator.GenerateIHClass(iSampleType, prototype);
     }
 }
@@ -179,7 +179,7 @@ void FunctionParser::GenerateHClass(const PGOHClassGenerator &generator, const P
 
         auto phValue = ptManager_->QueryHClass(protoPt, protoPt);
         JSHandle<JSHClass> phclass(thread, phValue);
-        JSHandle<JSObject> prototype = thread->GetEcmaVM()->GetFactory()->NewJSObject(phclass);
+        JSHandle<JSObject> prototype = thread->GetEcmaVM()->GetFactory()->NewJSObjectWithInit(phclass);
         generator.GenerateIHClass(iSampleType, prototype);
     }
 }
@@ -248,7 +248,7 @@ void PGOTypeParser::GenerateHClassForClassType(ProfileType rootType, ProfileType
     }
     auto thread = ptManager_->GetJSThread();
     JSHandle<JSHClass> phclass(thread, phValue);
-    JSHandle<JSObject> prototype = thread->GetEcmaVM()->GetFactory()->NewJSObject(phclass);
+    JSHandle<JSObject> prototype = thread->GetEcmaVM()->GetFactory()->NewJSObjectWithInit(phclass);
     PGOSampleType rootSampleType(rootType);
     generator.GenerateIHClass(rootSampleType, prototype);
 }
@@ -265,7 +265,7 @@ void PGOTypeParser::GenerateHClassForPrototype(ProfileType rootType, const PGOHC
         auto phc = ptManager_->QueryHClass(rootType, rootType);
         auto thread = ptManager_->GetJSThread();
         JSHandle<JSHClass> phclass(thread, phc);
-        JSHandle<JSObject> prototype = thread->GetEcmaVM()->GetFactory()->NewJSObject(phclass);
+        JSHandle<JSObject> prototype = thread->GetEcmaVM()->GetFactory()->NewJSObjectWithInit(phclass);
         ptManager_->RecordHClass(classType, classType, prototype.GetTaggedType());
     }
 }

ecmascript/mem/parallel_marker-inl.h

@@ -50,6 +50,7 @@ inline void NonMovableMarker::MarkValue(uint32_t threadId, ObjectSlot &slot, Reg
 {
     JSTaggedValue value(slot.GetTaggedType());
     if (value.IsHeapObject()) {
+        ASSERT(!value.IsHole()); // check that value is not zero
         TaggedObject *obj = nullptr;
         if (!value.IsWeakForHeapObject()) {
             obj = value.GetTaggedObject();

test/aottest/BUILD.gn

@@ -206,6 +206,7 @@ group("ark_aot_ts_test") {
     "ordinaryhasinstance",
     "pgo_aot_call_deopt_bridge",
     "pgo_aot_newobj",
+    "pgo_array_prototype",
     "pgo_builtins",
     "pgo_call",
     "pgo_call_builtin_ctor",

test/aottest/pgo_array_prototype/BUILD.gn

@@ -0,0 +1,22 @@
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import("//arkcompiler/ets_runtime/test/test_helper.gni")
+
+host_aot_js_test_action("pgo_array_prototype") {
+  deps = []
+  is_enable_pgo = true
+  is_enable_opt_inlining = true
+  is_enable_trace_deopt = true
+  log_option = " --log-info=trace"
+}

test/aottest/pgo_array_prototype/expect_output.txt

@@ -0,0 +1,14 @@
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+3

test/aottest/pgo_array_prototype/pgo_array_prototype.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// Check that object with Array prototype is correctly handled in AOT
+foo.prototype = new Array(1, 2, 3);
+function foo() {}
+var f = new foo()
+print(f.length)

test/aottest/pgo_array_prototype/pgo_expect_output.txt

@@ -0,0 +1,14 @@
+# Copyright (c) 2023 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+3