!10022 Fix AOT bug in Array Pop when enable native inline

Merge pull request !10022 from zihan/fixArrpop

ecmascript/compiler/native_inline_lowering.cpp

@@ -1785,7 +1785,7 @@ void NativeInlineLowering::TryInlineArrayPop(GateRef gate, size_t argc, Builtins
         AddTraceLogs(gate, id);
     }
     GateRef ret = builder_.ArrayPop(thisValue, acc_.GetFrameState(gate));
-    acc_.ReplaceHirAndDeleteIfException(gate, builder_.GetStateDepend(), ret);
+    ReplaceGateWithPendingException(gate, ret);
 }
 
 void NativeInlineLowering::TryInlineArraySlice(GateRef gate, size_t argc, BuiltinsStubCSigns::ID id, bool skipThis)

ecmascript/compiler/typed_native_inline_lowering.cpp

@@ -3647,6 +3647,7 @@ void TypedNativeInlineLowering::LowerArrayPop(GateRef gate)
     Label isCOWArray(&builder_);
     Label getElements(&builder_);
     Label indexLessCapacity(&builder_);
+    Label slowGetElement(&builder_);
     Label setArrayLength(&builder_);
     Label checkTrim(&builder_);
     Label needTrim(&builder_);
@@ -3677,7 +3678,7 @@ void TypedNativeInlineLowering::LowerArrayPop(GateRef gate)
         builder_.Bind(&indexLessCapacity);
         {
             GateRef result = builder_.GetValueFromTaggedArray(elements, index);
-            BRANCH_CIR(builder_.TaggedIsHole(result), &setArrayLength, &checkTrim);
+            BRANCH_CIR(builder_.TaggedIsHole(result), &slowGetElement, &checkTrim);
             builder_.Bind(&checkTrim);
             {
                 ret = result;
@@ -3685,6 +3686,24 @@ void TypedNativeInlineLowering::LowerArrayPop(GateRef gate)
                 BRANCH_CIR(
                     builder_.Int32GreaterThan(unused, builder_.Int32(TaggedArray::MAX_END_UNUSED)), &needTrim, &noTrim);
             }
+            builder_.Bind(&slowGetElement);
+            {
+                Label hasException(&builder_);
+                Label notHasException(&builder_);
+                GateRef element = builder_.CallStub(glue, gate, CommonStubCSigns::GetPropertyByIndex,
+                                                    { glue, thisValue, index });
+                BRANCH_CIR(builder_.HasPendingException(glue), &hasException, &notHasException);
+                builder_.Bind(&hasException);
+                {
+                    ret = builder_.ExceptionConstant();
+                    builder_.Jump(&exit);
+                }
+                builder_.Bind(&notHasException);
+                {
+                    ret = element;
+                    builder_.Jump(&setArrayLength);
+                }
+            }
         }
         builder_.Bind(&needTrim);
         {

test/aottest/BUILD.gn

@@ -63,6 +63,7 @@ group("ark_aot_ts_test") {
     "array",
     "array_foreach_inline",
     "array_inline_exception",
+    "array_pop_inline",
     "ashr",
     "asyncgenerator",
     "asyncgeneratormultiloop",

test/aottest/array_pop_inline/BUILD.gn

@@ -0,0 +1,23 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import("//arkcompiler/ets_runtime/test/test_helper.gni")
+
+host_aot_test_action("array_pop_inline") {
+  deps = []
+  is_enable_pgo = true
+  is_enable_opt_inlining = true
+  is_only_typed_path = true
+  is_enable_inline_trace = true
+  log_option = " --log-info=trace"
+}

test/aottest/array_pop_inline/array_pop_inline.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+let array = [,];
+function pop() {
+  return array.pop();
+}
+print(array.length);
+array.__proto__[0] = 6
+print(array.length);
+print(array[0]);
+print(array.pop());

test/aottest/array_pop_inline/expect_output.txt

@@ -0,0 +1,18 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+1
+1
+6
+[trace] aot inline builtin: Array.prototype.pop, caller function name:func_main_0@array_pop_inline
+6

test/aottest/array_pop_inline/pgo_expect_output.txt

@@ -0,0 +1,17 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+1
+1
+6
+6