Close ICpath in ldprivateproperty and stprivateproperty

Issue: https://gitee.com/openharmony/arkcompiler_ets_runtime/issues/IANU24?from=project-issue
Reason: Due to the imperfect realisation of IC-path in ldprivateproperty and stprivateproperty, when two object create by the same function, they will use the same profiletypeinfo. So it can't throw a typeError when C2 accessed the private property of C1 when run in pgo-int mode
Description: close the ICpath when handle ldprivateproperty and stprivateproperty temporarily
Signed-off-by: 15651885392 <xingshunxiang@huawei.com>
Change-Id: I829782a7b45ba2b556dce2ea3ad036708f329dec
This commit is contained in:
15651885392 2024-09-03 15:39:11 +08:00
parent a6a9af4ebb
commit 3663fdf617
6 changed files with 53 additions and 112 deletions

View File

@ -795,69 +795,28 @@ DECLARE_ASM_HANDLER(HandleGetasynciteratorImm8)
DECLARE_ASM_HANDLER(HandleLdPrivatePropertyImm8Imm16Imm16)
{
auto env = GetEnvironment();
GateRef lexicalEnv = GetEnvFromFrame(GetFrame(sp));
GateRef slotId = ZExtInt8ToInt32(ReadInst8_0(pc));
GateRef levelIndex = ReadInst16_1(pc);
GateRef slotIndex = ReadInst16_3(pc);
DEFVARIABLE(result, VariableType::JS_ANY(), Hole());
Label slowPath(env);
Label icPath(env);
Label exit(env);
Branch(TaggedIsUndefined(profileTypeInfo), &slowPath, &icPath);
Bind(&icPath);
{
GateRef key = GetKeyFromLexivalEnv(lexicalEnv, ZExtInt16ToInt32(levelIndex), ZExtInt16ToInt32(slotIndex));
AccessObjectStubBuilder builder(this);
result = builder.LoadPrivatePropertyByName(glue, acc, key, profileTypeInfo, slotId, callback);
Jump(&exit);
}
Bind(&slowPath);
{
result = CallRuntime(glue,
RTSTUB_ID(LdPrivateProperty),
{lexicalEnv, IntToTaggedInt(levelIndex), IntToTaggedInt(slotIndex), acc}); // acc as obj
Jump(&exit);
}
Bind(&exit);
result = CallRuntime(glue,
RTSTUB_ID(LdPrivateProperty),
{lexicalEnv, IntToTaggedInt(levelIndex), IntToTaggedInt(slotIndex), acc}); // acc as obj
CHECK_EXCEPTION_WITH_ACC(*result, INT_PTR(LDPRIVATEPROPERTY_IMM8_IMM16_IMM16));
}
DECLARE_ASM_HANDLER(HandleStPrivatePropertyImm8Imm16Imm16V8)
{
auto env = GetEnvironment();
GateRef lexicalEnv = GetEnvFromFrame(GetFrame(sp));
GateRef slotId = ZExtInt8ToInt32(ReadInst8_0(pc));
GateRef levelIndex = ReadInst16_1(pc);
GateRef slotIndex = ReadInst16_3(pc);
GateRef obj = GetVregValue(sp, ZExtInt8ToPtr(ReadInst8_5(pc)));
DEFVARIABLE(result, VariableType::JS_ANY(), Hole());
Label slowPath(env);
Label icPath(env);
Label exit(env);
Branch(TaggedIsUndefined(profileTypeInfo), &slowPath, &icPath);
Bind(&icPath);
{
GateRef key = GetKeyFromLexivalEnv(lexicalEnv, ZExtInt16ToInt32(levelIndex), ZExtInt16ToInt32(slotIndex));
AccessObjectStubBuilder builder(this);
result = builder.StorePrivatePropertyByName(glue, obj, key, acc, profileTypeInfo, slotId, callback);
Jump(&exit);
}
Bind(&slowPath);
{
result =
CallRuntime(glue,
RTSTUB_ID(StPrivateProperty),
{lexicalEnv, IntToTaggedInt(levelIndex), IntToTaggedInt(slotIndex), obj, acc}); // acc as value
Jump(&exit);
}
Bind(&exit);
result =
CallRuntime(glue,
RTSTUB_ID(StPrivateProperty),
{lexicalEnv, IntToTaggedInt(levelIndex), IntToTaggedInt(slotIndex), obj, acc}); // acc as value
CHECK_EXCEPTION_WITH_ACC(*result, INT_PTR(STPRIVATEPROPERTY_IMM8_IMM16_IMM16_V8));
}

View File

@ -4567,42 +4567,11 @@ NO_UB_SANITIZE void EcmaInterpreter::RunInternal(JSThread *thread, const uint8_t
}
HANDLE_OPCODE(LDPRIVATEPROPERTY_IMM8_IMM16_IMM16) {
JSTaggedValue lexicalEnv = GET_FRAME(sp)->env;
uint32_t slotId = READ_INST_8_0();
uint32_t levelIndex = READ_INST_16_1();
uint32_t slotIndex = READ_INST_16_3();
JSTaggedValue obj = GET_ACC();
LOG_INST() << "intrinsics::ldprivateproperty" << " levelIndex:" << levelIndex
<< ", slotIndex:" << slotIndex << ", obj:" << obj.GetRawData();
#if ECMASCRIPT_ENABLE_IC
auto profileTypeInfo = GetRuntimeProfileTypeInfo(sp);
if (!profileTypeInfo.IsUndefined()) {
auto profileTypeArray = ProfileTypeInfo::Cast(profileTypeInfo.GetTaggedObject());
JSTaggedValue firstValue = profileTypeArray->Get(slotId);
JSTaggedValue res = JSTaggedValue::Hole();
if (LIKELY(firstValue.IsHeapObject())) {
JSTaggedValue secondValue = profileTypeArray->Get(slotId + 1);
res = ICRuntimeStub::TryLoadICByName(thread, obj, firstValue, secondValue);
}
if (LIKELY(!res.IsHole())) {
INTERPRETER_RETURN_IF_ABRUPT(res);
SET_ACC(res);
DISPATCH(LDPRIVATEPROPERTY_IMM8_IMM16_IMM16);
} else if (!firstValue.IsHole()) { // IC miss and not enter the megamorphic state, store as polymorphic
JSTaggedValue currentLexicalEnv = lexicalEnv;
for (uint32_t i = 0; i < levelIndex; i++) {
currentLexicalEnv = LexicalEnv::Cast(currentLexicalEnv.GetTaggedObject())->GetParentEnv();
ASSERT(!currentLexicalEnv.IsUndefined());
}
JSTaggedValue key = LexicalEnv::Cast(currentLexicalEnv.GetTaggedObject())->GetProperties(slotIndex);
res = ICRuntimeStub::LoadICByName(thread, profileTypeArray, obj, key, slotId);
INTERPRETER_RETURN_IF_ABRUPT(res);
SET_ACC(res);
DISPATCH(LDPRIVATEPROPERTY_IMM8_IMM16_IMM16);
}
}
#endif
JSTaggedValue res = SlowRuntimeStub::LdPrivateProperty(thread, lexicalEnv, levelIndex, slotIndex, obj);
INTERPRETER_RETURN_IF_ABRUPT(res);
SET_ACC(res);
@ -4610,7 +4579,6 @@ NO_UB_SANITIZE void EcmaInterpreter::RunInternal(JSThread *thread, const uint8_t
}
HANDLE_OPCODE(STPRIVATEPROPERTY_IMM8_IMM16_IMM16_V8) {
JSTaggedValue lexicalEnv = GET_FRAME(sp)->env;
uint32_t slotId = READ_INST_8_0();
uint32_t levelIndex = READ_INST_16_1();
uint32_t slotIndex = READ_INST_16_3();
uint32_t v0 = READ_INST_8_5();
@ -4621,37 +4589,6 @@ NO_UB_SANITIZE void EcmaInterpreter::RunInternal(JSThread *thread, const uint8_t
<<", obj:" << obj.GetRawData() << ", value:" << value.GetRawData();
SAVE_ACC();
#if ECMASCRIPT_ENABLE_IC
auto profileTypeInfo = GetRuntimeProfileTypeInfo(sp);
if (!profileTypeInfo.IsUndefined()) {
auto profileTypeArray = ProfileTypeInfo::Cast(profileTypeInfo.GetTaggedObject());
JSTaggedValue firstValue = profileTypeArray->Get(slotId);
JSTaggedValue res = JSTaggedValue::Hole();
if (LIKELY(firstValue.IsHeapObject())) {
JSTaggedValue secondValue = profileTypeArray->Get(slotId + 1);
res = ICRuntimeStub::TryStoreICByName(thread, obj, firstValue, secondValue, value);
}
if (LIKELY(!res.IsHole())) {
INTERPRETER_RETURN_IF_ABRUPT(res);
RESTORE_ACC();
DISPATCH(STPRIVATEPROPERTY_IMM8_IMM16_IMM16_V8);
} else if (!firstValue.IsHole()) { // IC miss and not enter the megamorphic state, store as polymorphic
JSTaggedValue currentLexicalEnv = lexicalEnv;
for (uint32_t i = 0; i < levelIndex; i++) {
currentLexicalEnv = LexicalEnv::Cast(currentLexicalEnv.GetTaggedObject())->GetParentEnv();
ASSERT(!currentLexicalEnv.IsUndefined());
}
JSTaggedValue key = LexicalEnv::Cast(currentLexicalEnv.GetTaggedObject())->GetProperties(slotIndex);
res = ICRuntimeStub::StoreICByName(thread, profileTypeArray, obj, key, value, slotId);
INTERPRETER_RETURN_IF_ABRUPT(res);
RESTORE_ACC();
DISPATCH(STPRIVATEPROPERTY_IMM8_IMM16_IMM16_V8);
}
}
#endif
JSTaggedValue res = SlowRuntimeStub::StPrivateProperty(thread, lexicalEnv, levelIndex, slotIndex, obj, value);
INTERPRETER_RETURN_IF_ABRUPT(res);
RESTORE_ACC();

View File

@ -28,3 +28,5 @@ Symbol(symbol)
testReadIcSlotInPrivatePropertyIns success
TypeError : invalid or cannot find private key
TypeError : invalid or cannot find private key
TypeError: invalid or cannot find private key
TypeError: invalid or cannot find private key

View File

@ -28,3 +28,5 @@ Symbol(symbol)
testReadIcSlotInPrivatePropertyIns success
TypeError : invalid or cannot find private key
TypeError : invalid or cannot find private key
TypeError: invalid or cannot find private key
TypeError: invalid or cannot find private key

View File

@ -185,3 +185,44 @@ class OutSide {
} catch(e) {
print(e.name + " : " + e.message);
}
// Invalid private key check for ldPrivateProperty2
let createClass = function () {
return class {
static #m = 111;
static access() {
return this.#m;
}
}
};
let C1 = createClass();
let C2 = createClass();
try {
C2.access();
C1.access.call(C2); // C2 try to access private property of C1, forbidden
} catch(e) {
print(e)
}
// Invalid private key check for stPrivateProperty2
let createClass2 = function () {
return class {
static #m = 111;
static store() {
return this.#m = 11;
}
}
};
let C3 = createClass2();
let C4 = createClass2();
try {
C3.store();
C4.store.call(C3); // C3 try to access private property of C4, forbidden
} catch(e) {
print(e)
}

View File

@ -11,5 +11,5 @@
# See the License for the specific language governing permissions and
# limitations under the License.
TypeError : Cannot read property of undefined
TypeError : invalid or cannot find private key
undefined