!8827 Fix Segmentation Fault Caused by Collection Objects

Merge pull request !8827 from MothBuzzing/master
This commit is contained in:
openharmony_ci 2024-08-31 11:59:44 +00:00 committed by Gitee
commit 1a479f5580
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
4 changed files with 20 additions and 2 deletions

View File

@ -375,6 +375,11 @@ public:
return Create(NOT_ATOMIC, NEED_BARRIER);
}
static MemoryAttribute UnknownBarrier()
{
return Create(NOT_ATOMIC, UNKNOWN_BARRIER);
}
static MemoryAttribute DefaultWithShareBarrier()
{
return Create(NOT_ATOMIC, UNKNOWN_BARRIER, SHARED);

View File

@ -2061,7 +2061,7 @@ void NewObjectStubBuilder::CreateJSCollectionIterator(
// SetIterated
GateRef iteratorOffset = IntPtr(iterOffset);
Store(VariableType::JS_POINTER(), glue_, result->ReadVariable(), iteratorOffset, linked,
MemoryAttribute::NeedBarrier());
MemoryAttribute::UnknownBarrier());
// SetIteratorNextIndex
GateRef nextIndexOffset = IntPtr(IteratorType::NEXT_INDEX_OFFSET);

View File

@ -13,3 +13,4 @@
true
false
true

View File

@ -20,4 +20,16 @@ var obj ={
__proto__: proto
}
print(obj.__proto__ == proto)
print(obj.__proto__ == proto2);
print(obj.__proto__ == proto2);
class C12 extends Set {
}
const v13 = new C12();
const o59 = {
__proto__: v13,
};
try {
o59.values();
} catch (error) {
print(o59.__proto__ == v13);
}