openharmony/arkcompiler_ets_runtime
1
0
Fork 0
mirror of https://gitee.com/openharmony/arkcompiler_ets_runtime synced 2024-10-07 16:13:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

!4643 [Bug]: 汇编解释器Constructor相关代码未对newTarget进行判断，导致直接取HClass崩溃

Browse Source 
Merge pull request !4643 from 李晨帅/newTargetNotHeapIR
This commit is contained in:
openharmony_ci 2023-08-21 02:24:41 +00:00 committed by Gitee
commit 33ed8e637d
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ecmascript/compiler/builtins/builtins_stubs.cpp
View File

@ -995,10 +995,13 @@ DECLARE_BUILTINS(BooleanConstructor)
auto env = GetEnvironment();
DEFVARIABLE(res, VariableType::JS_ANY(), Undefined());
Label newTargetIsHeapObject(env);
Label newTargetIsJSFunction(env);
Label slowPath(env);
Label exit(env);
Branch(TaggedIsHeapObject(newTarget), &newTargetIsHeapObject, &slowPath);
Bind(&newTargetIsHeapObject);
Branch(IsJSFunction(newTarget), &newTargetIsJSFunction, &slowPath);
Bind(&newTargetIsJSFunction);
{
@ -1038,10 +1041,13 @@ DECLARE_BUILTINS(DateConstructor)
auto env = GetEnvironment();
DEFVARIABLE(res, VariableType::JS_ANY(), Undefined());
Label newTargetIsHeapObject(env);
Label newTargetIsJSFunction(env);
Label slowPath(env);
Label exit(env);
Branch(TaggedIsHeapObject(newTarget), &newTargetIsHeapObject, &slowPath);
Bind(&newTargetIsHeapObject);
Branch(IsJSFunction(newTarget), &newTargetIsJSFunction, &slowPath);
Bind(&newTargetIsJSFunction);
{
@ -1120,10 +1126,13 @@ DECLARE_BUILTINS(ArrayConstructor)
auto env = GetEnvironment();
DEFVARIABLE(res, VariableType::JS_ANY(), Undefined());
Label newTargetIsHeapObject(env);
Label newTargetIsJSFunction(env);
Label slowPath(env);
Label exit(env);
Branch(TaggedIsHeapObject(newTarget), &newTargetIsHeapObject, &slowPath);
Bind(&newTargetIsHeapObject);
Branch(IsJSFunction(newTarget), &newTargetIsJSFunction, &slowPath);
Bind(&newTargetIsJSFunction);
{

12
test/moduletest/builtins/builtinsir.js
View File

@ -45,4 +45,16 @@ lastName: "Gates"
}
var a = new Uint32Array([1,2]);
print(person.fullName.apply(person1, a));
// xxxConstructor
var a = {
test() {
this.foo();
}
}
a.foo = Array;
a.test();
a.foo = Boolean;
a.test();
a.foo = Date;
a.test();
print("builtins ir end");