From 94c0895cf09e6e07264a06914450999aba07e025 Mon Sep 17 00:00:00 2001 From: zhouguangyuan Date: Thu, 7 Nov 2024 18:26:37 +0800 Subject: [PATCH] do not get region of derived pointer Issue: https://gitee.com/openharmony/arkcompiler_ets_runtime/issues/IB2KJA Signed-off-by: ZhouGuangyuan Change-Id: Ia1602a0d0ad2ac71ef00fa561f9b6f61b66bf68d --- .../builtins/builtins_array_stub_builder.cpp | 8 +-- .../compiler/new_object_stub_builder.cpp | 6 +- ecmascript/compiler/stub_builder.cpp | 60 ++++++++++--------- ecmascript/compiler/stub_builder.h | 13 +++- ecmascript/mem/barriers-inl.h | 17 +++--- ecmascript/mem/barriers.h | 11 +++- ecmascript/tagged_array-inl.h | 2 +- ecmascript/tests/barrier_test.cpp | 12 ++-- 8 files changed, 74 insertions(+), 55 deletions(-) diff --git a/ecmascript/compiler/builtins/builtins_array_stub_builder.cpp b/ecmascript/compiler/builtins/builtins_array_stub_builder.cpp index e664078452..7c31b8bf69 100644 --- a/ecmascript/compiler/builtins/builtins_array_stub_builder.cpp +++ b/ecmascript/compiler/builtins/builtins_array_stub_builder.cpp @@ -235,13 +235,13 @@ void BuiltinsArrayStubBuilder::Unshift(GateRef glue, GateRef thisValue, GateRef BRANCH_NO_WEIGHT(isIntOrNumberKind, &isIntOrNumber, &isTagged); Bind(&isIntOrNumber); { - ArrayCopy(glue, arrayStart, moveTo, TruncInt64ToInt32(thisLen), + ArrayCopy(glue, arrayStart, elements, moveTo, TruncInt64ToInt32(thisLen), MemoryAttribute::NoBarrier()); Jump(&afterCopy); } Bind(&isTagged); { - ArrayCopy(glue, arrayStart, moveTo, TruncInt64ToInt32(thisLen)); + ArrayCopy(glue, arrayStart, elements, moveTo, TruncInt64ToInt32(thisLen)); Jump(&afterCopy); } Bind(&afterCopy); @@ -3302,7 +3302,7 @@ void BuiltinsArrayStubBuilder::FastToSpliced(GateRef glue, GateRef thisValue, Ga { GateRef srcStart = GetDataPtrInTaggedArray(srcElements); GateRef dstStart = GetDataPtrInTaggedArray(dstElements); - ArrayCopyAndHoleToUndefined(glue, srcStart, dstStart, actualStart); + ArrayCopyAndHoleToUndefined(glue, srcStart, dstElements, dstStart, actualStart); Jump(&insertArg); } Bind(&insertArg); @@ -3327,7 +3327,7 @@ void BuiltinsArrayStubBuilder::FastToSpliced(GateRef glue, GateRef thisValue, Ga GateRef srcStart = GetDataPtrInTaggedArray(srcElements, oldIndex); GateRef dstStart = GetDataPtrInTaggedArray(dstElements, newIndex); GateRef afterLength = Int32Sub(thisLength, oldIndex); - ArrayCopyAndHoleToUndefined(glue, srcStart, dstStart, afterLength); + ArrayCopyAndHoleToUndefined(glue, srcStart, dstElements, dstStart, afterLength); newIndex = Int32Add(newIndex, afterLength); Jump(&setLength); } diff --git a/ecmascript/compiler/new_object_stub_builder.cpp b/ecmascript/compiler/new_object_stub_builder.cpp index 2d07028b0f..50fb06396d 100644 --- a/ecmascript/compiler/new_object_stub_builder.cpp +++ b/ecmascript/compiler/new_object_stub_builder.cpp @@ -897,14 +897,14 @@ GateRef NewObjectStubBuilder::CopyArray(GateRef glue, GateRef elements, GateRef BRANCH(checkIsMutantTaggedArray, ©ToMutantTaggedArray, ©ToTaggedArray); Bind(©ToTaggedArray); { - ArrayCopy(glue, GetDataPtrInTaggedArray(elements), GetDataPtrInTaggedArray(*array), + ArrayCopy(glue, GetDataPtrInTaggedArray(elements), *array, GetDataPtrInTaggedArray(*array), newLen); Jump(&afterCopy); } Bind(©ToMutantTaggedArray); { - ArrayCopy(glue, GetDataPtrInTaggedArray(elements), GetDataPtrInTaggedArray(*array), newLen, - MemoryAttribute::NoBarrier()); + ArrayCopy(glue, GetDataPtrInTaggedArray(elements), *array, GetDataPtrInTaggedArray(*array), + newLen, MemoryAttribute::NoBarrier()); Jump(&afterCopy); } Bind(&afterCopy); diff --git a/ecmascript/compiler/stub_builder.cpp b/ecmascript/compiler/stub_builder.cpp index 6da9acf63e..00bad8d26f 100644 --- a/ecmascript/compiler/stub_builder.cpp +++ b/ecmascript/compiler/stub_builder.cpp @@ -10506,8 +10506,8 @@ GateRef StubBuilder::GetArgumentsElements(GateRef glue, GateRef argvTaggedArray, using CopyKind = StubBuilder::OverlapKind; template <> -void StubBuilder::ArrayCopy(GateRef glue, GateRef src, GateRef dst, GateRef length, - MemoryAttribute mAttr) +void StubBuilder::ArrayCopy(GateRef glue, GateRef srcAddr, GateRef dstObj, GateRef dstAddr, + GateRef length, MemoryAttribute mAttr) { auto env = GetEnvironment(); Label entry(env); @@ -10520,7 +10520,7 @@ void StubBuilder::ArrayCopy(GateRef glue, GateRef src, Gat Label storeHead(env); Label enterLoop(env); DEFVARIABLE(offset, VariableType::INT32(), Int32(0)); - + GateRef dstOff = PtrSub(TaggedCastToIntPtr(dstAddr), TaggedCastToIntPtr(dstObj)); const auto tSize = static_cast(JSTaggedValue::TaggedTypeSize()); static_assert((tSize & (tSize - 1)) == 0 && "TaggedTypeSize must be power of 2"); static_assert(LOOP_UNROLL_FACTOR == 2 && "changing LOOP_UNROLL_FACTOR also need fix the logic here"); @@ -10531,8 +10531,8 @@ void StubBuilder::ArrayCopy(GateRef glue, GateRef src, Gat { // Now use 2 as loop unroll factor, so only store once if reminder is not 0. // But if using other loop unroll factor, the store head should also be refactored. - GateRef value = Load(VariableType::JS_ANY(), src); - Store(VariableType::JS_ANY(), glue, dst, IntPtr(0), value, mAttr); + GateRef value = Load(VariableType::JS_ANY(), srcAddr); + Store(VariableType::JS_ANY(), glue, dstObj, dstOff, value, mAttr); offset = Int32(tSize); Jump(&enterLoop); } @@ -10547,10 +10547,10 @@ void StubBuilder::ArrayCopy(GateRef glue, GateRef src, Gat { GateRef off1 = ZExtInt32ToPtr(*offset); GateRef off2 = PtrAdd(off1, IntPtr(tSize)); - GateRef value1 = Load(VariableType::JS_ANY(), src, off1); - GateRef value2 = Load(VariableType::JS_ANY(), src, off2); - Store(VariableType::JS_ANY(), glue, dst, off1, value1, mAttr); - Store(VariableType::JS_ANY(), glue, dst, off2, value2, mAttr); + GateRef value1 = Load(VariableType::JS_ANY(), srcAddr, off1); + GateRef value2 = Load(VariableType::JS_ANY(), srcAddr, off2); + Store(VariableType::JS_ANY(), glue, dstObj, PtrAdd(dstOff, off1), value1, mAttr); + Store(VariableType::JS_ANY(), glue, dstObj, PtrAdd(dstOff, off2), value2, mAttr); offset = Int32Add(*offset, Int32(LOOP_UNROLL_FACTOR * tSize)); Jump(&endLoop); } @@ -10562,8 +10562,8 @@ void StubBuilder::ArrayCopy(GateRef glue, GateRef src, Gat } template <> -void StubBuilder::ArrayCopy(GateRef glue, GateRef src, GateRef dst, GateRef length, - MemoryAttribute mAttr) +void StubBuilder::ArrayCopy(GateRef glue, GateRef srcAddr, GateRef dstObj, GateRef dstAddr, + GateRef length, MemoryAttribute mAttr) { auto env = GetEnvironment(); Label entry(env); @@ -10578,7 +10578,7 @@ void StubBuilder::ArrayCopy(GateRef glue, GateRef src, Ga const auto tSize = static_cast(JSTaggedValue::TaggedTypeSize()); static_assert((tSize & (tSize - 1)) == 0 && "TaggedTypeSize must be power of 2"); static_assert(LOOP_UNROLL_FACTOR == 2 && "changing LOOP_UNROLL_FACTOR also need fix the logic here"); - + GateRef dstOff = PtrSub(TaggedCastToIntPtr(dstAddr), TaggedCastToIntPtr(dstObj)); DEFVARIABLE(offset, VariableType::INT32(), Int32Mul(length, Int32(tSize))); GateRef remainder = Int32And(length, Int32(LOOP_UNROLL_FACTOR - 1)); BRANCH_NO_WEIGHT(Int32NotEqual(remainder, Int32(0)), &storeEnd, &enterLoop); @@ -10587,8 +10587,8 @@ void StubBuilder::ArrayCopy(GateRef glue, GateRef src, Ga // Now use 2 as loop unroll factor, so only store once if reminder is not 0. // But if using other loop unroll factor, the store head should also be refactored. offset = Int32Sub(*offset, Int32(tSize)); - GateRef value = Load(VariableType::JS_ANY(), src, ZExtInt32ToPtr(*offset)); - Store(VariableType::JS_ANY(), glue, dst, ZExtInt32ToPtr(*offset), value, mAttr); + GateRef value = Load(VariableType::JS_ANY(), srcAddr, ZExtInt32ToPtr(*offset)); + Store(VariableType::JS_ANY(), glue, dstObj, PtrAdd(dstOff, *offset), value, mAttr); Jump(&enterLoop); } Bind(&enterLoop); @@ -10603,10 +10603,10 @@ void StubBuilder::ArrayCopy(GateRef glue, GateRef src, Ga offset = Int32Sub(*offset, Int32(LOOP_UNROLL_FACTOR * tSize)); GateRef off1 = ZExtInt32ToPtr(*offset); GateRef off2 = PtrAdd(off1, IntPtr(tSize)); - GateRef value1 = Load(VariableType::JS_ANY(), src, off1); - GateRef value2 = Load(VariableType::JS_ANY(), src, off2); - Store(VariableType::JS_ANY(), glue, dst, off1, value1, mAttr); - Store(VariableType::JS_ANY(), glue, dst, off2, value2, mAttr); + GateRef value1 = Load(VariableType::JS_ANY(), srcAddr, off1); + GateRef value2 = Load(VariableType::JS_ANY(), srcAddr, off2); + Store(VariableType::JS_ANY(), glue, dstObj, PtrAdd(dstOff,off1), value1, mAttr); + Store(VariableType::JS_ANY(), glue, dstObj, PtrAdd(dstOff,off2), value2, mAttr); Jump(&endLoop); } Bind(&endLoop); @@ -10617,35 +10617,36 @@ void StubBuilder::ArrayCopy(GateRef glue, GateRef src, Ga } template <> -void StubBuilder::ArrayCopy(GateRef glue, GateRef src, GateRef dst, GateRef length, - MemoryAttribute mAttr) +void StubBuilder::ArrayCopy(GateRef glue, GateRef srcAddr, GateRef dstObj, GateRef dstAddr, + GateRef length, MemoryAttribute mAttr) { auto env = GetEnvironment(); Label entry(env); env->SubCfgEntry(&entry); Label exit(env); GateRef needRightToLeft = LogicAndBuilder(env) - .And(IntPtrGreaterThan(dst, src)) - .And(IntPtrGreaterThan(PtrAdd(src, ZExtInt32ToPtr(length)), dst)) + .And(IntPtrGreaterThan(dstAddr, srcAddr)) + .And(IntPtrGreaterThan(PtrAdd(srcAddr, ZExtInt32ToPtr(length)), dstAddr)) .Done(); Label leftToRight(env); Label rightToLeft(env); BRANCH_NO_WEIGHT(needRightToLeft, &rightToLeft, &leftToRight); Bind(&rightToLeft); { - ArrayCopy(glue, src, dst, length, mAttr); + ArrayCopy(glue, srcAddr, dstObj, dstAddr, length, mAttr); Jump(&exit); } Bind(&leftToRight); { - ArrayCopy(glue, src, dst, length, mAttr); + ArrayCopy(glue, srcAddr, dstObj, dstAddr, length, mAttr); Jump(&exit); } Bind(&exit); env->SubCfgExit(); } -void StubBuilder::ArrayCopyAndHoleToUndefined(GateRef glue, GateRef src, GateRef dst, GateRef length, MemoryAttribute mAttr) +void StubBuilder::ArrayCopyAndHoleToUndefined(GateRef glue, GateRef srcAddr, GateRef dstObj, GateRef dstAddr, + GateRef length, MemoryAttribute mAttr) { auto env = GetEnvironment(); Label entry(env); @@ -10654,7 +10655,7 @@ void StubBuilder::ArrayCopyAndHoleToUndefined(GateRef glue, GateRef src, GateRef Label begin(env); Label body(env); Label endLoop(env); - + GateRef dstOff = PtrSub(TaggedCastToIntPtr(dstAddr), TaggedCastToIntPtr(dstObj)); DEFVARIABLE(index, VariableType::INT32(), Int32(0)); Jump(&begin); LoopBegin(&begin); @@ -10663,18 +10664,19 @@ void StubBuilder::ArrayCopyAndHoleToUndefined(GateRef glue, GateRef src, GateRef Bind(&body); { GateRef offset = PtrMul(ZExtInt32ToPtr(*index), IntPtr(JSTaggedValue::TaggedTypeSize())); - GateRef value = Load(VariableType::JS_ANY(), src, offset); + GateRef value = Load(VariableType::JS_ANY(), srcAddr, offset); Label isHole(env); Label isNotHole(env); BRANCH_UNLIKELY(TaggedIsHole(value), &isHole, &isNotHole); Bind(&isHole); { - Store(VariableType::JS_ANY(), glue, dst, offset, Undefined(), MemoryAttribute::NoBarrier()); + Store(VariableType::JS_ANY(), glue, dstObj, PtrAdd(dstOff, offset), Undefined(), + MemoryAttribute::NoBarrier()); Jump(&endLoop); } Bind(&isNotHole); - Store(VariableType::JS_ANY(), glue, dst, offset, value, mAttr); + Store(VariableType::JS_ANY(), glue, dstObj, PtrAdd(dstOff, offset), value, mAttr); Jump(&endLoop); } } diff --git a/ecmascript/compiler/stub_builder.h b/ecmascript/compiler/stub_builder.h index b6392330c4..bfa7b943e0 100644 --- a/ecmascript/compiler/stub_builder.h +++ b/ecmascript/compiler/stub_builder.h @@ -917,8 +917,11 @@ public: GateRef ElementsKindIsNumOrHoleNum(GateRef kind); GateRef ElementsKindIsHeapKind(GateRef kind); GateRef ElementsKindHasHole(GateRef kind); - void ArrayCopyAndHoleToUndefined(GateRef glue, GateRef src, GateRef dst, GateRef length, - MemoryAttribute mAttr = MemoryAttribute::Default()); + // dstAddr/srcAddr is the address will be copied to/from. + // It can be a derived pointer point to the middle of an object. + // Note: dstObj is the object address for dstAddr, it must point to the head of an object. + void ArrayCopyAndHoleToUndefined(GateRef glue, GateRef srcAddr, GateRef dstObj, GateRef dstAddr, + GateRef length, MemoryAttribute mAttr = MemoryAttribute::Default()); void MigrateArrayWithKind(GateRef glue, GateRef object, GateRef oldKind, GateRef newKind); GateRef MigrateFromRawValueToHeapValues(GateRef glue, GateRef object, GateRef needCOW, GateRef isIntKind); GateRef MigrateFromHeapValueToRawValue(GateRef glue, GateRef object, GateRef needCOW, GateRef isIntKind); @@ -1048,8 +1051,12 @@ public: // Unknown means all the kinds above are possible, it will select the suitable one in runtime. Unknown, }; + // dstAddr/srcAddr is the address will be copied to/from. + // It can be a derived pointer point to the middle of an object. + // + // Note: dstObj is the object address for dstAddr, it must point to the head of an object. template - void ArrayCopy(GateRef glue, GateRef src, GateRef dst, GateRef length, + void ArrayCopy(GateRef glue, GateRef srcAddr, GateRef dstObj, GateRef dstAddr, GateRef length, MemoryAttribute mAttr = MemoryAttribute::Default()); protected: static constexpr int LOOP_UNROLL_FACTOR = 2; diff --git a/ecmascript/mem/barriers-inl.h b/ecmascript/mem/barriers-inl.h index 4bfd8d9e75..f25c51ee1f 100644 --- a/ecmascript/mem/barriers-inl.h +++ b/ecmascript/mem/barriers-inl.h @@ -116,26 +116,27 @@ template ARK_NOINLINE bool BatchBitSet(const JSThread* thread, Region* objectRegion, JSTaggedValue* dst, size_t count); template -void Barriers::CopyObject(const JSThread* thread, JSTaggedValue* dst, JSTaggedValue* src, size_t count) +void Barriers::CopyObject(const JSThread *thread, const TaggedObject *dstObj, JSTaggedValue *dstAddr, + JSTaggedValue *srcAddr, size_t count) { // NOTE: The logic in CopyObject should be synced with WriteBarrier. // if any new feature/bugfix be added in CopyObject, it should also be added to WriteBarrier. // step 1. copy from src to dst directly. - CopyObjectPrimitive(dst, src, count); + CopyObjectPrimitive(dstAddr, srcAddr, count); if constexpr (!needWriteBarrier) { return; } // step 2. According to object region, update the corresponding bit set batch. - Region* objectRegion = Region::ObjectAddressToRange(ToUintPtr(dst)); + Region* objectRegion = Region::ObjectAddressToRange(ToUintPtr(dstObj)); if (!objectRegion->InSharedHeap()) { bool allValueNotHeap = false; if (objectRegion->InYoungSpace()) { - allValueNotHeap = BatchBitSet(thread, objectRegion, dst, count); + allValueNotHeap = BatchBitSet(thread, objectRegion, dstAddr, count); } else if (objectRegion->InGeneralOldSpace()) { - allValueNotHeap = BatchBitSet(thread, objectRegion, dst, count); + allValueNotHeap = BatchBitSet(thread, objectRegion, dstAddr, count); } else { - allValueNotHeap = BatchBitSet(thread, objectRegion, dst, count); + allValueNotHeap = BatchBitSet(thread, objectRegion, dstAddr, count); } if (allValueNotHeap) { return; @@ -148,14 +149,14 @@ void Barriers::CopyObject(const JSThread* thread, JSTaggedValue* dst, JSTaggedVa return; } for (uint32_t i = 0; i < count; i++) { - JSTaggedValue taggedValue = *(dst + i); + JSTaggedValue taggedValue = *(dstAddr + i); if (!taggedValue.IsHeapObject()) { continue; } Region* valueRegion = Region::ObjectAddressToRange(taggedValue.GetTaggedObject()); ASSERT(!objectRegion->InSharedHeap() || valueRegion->InSharedHeap()); if (marking && !valueRegion->InSharedHeap()) { - const uintptr_t slotAddr = ToUintPtr(dst) + JSTaggedValue::TaggedTypeSize() * i; + const uintptr_t slotAddr = ToUintPtr(dstAddr) + JSTaggedValue::TaggedTypeSize() * i; Barriers::Update(thread, slotAddr, objectRegion, taggedValue.GetTaggedObject(), valueRegion); // NOTE: ConcurrentMarking and SharedConcurrentMarking can be enabled at the same time, but a specific // value can't be "not shared heap" and "in SharedSweepableSpace" at the same time. So using "if - else if" diff --git a/ecmascript/mem/barriers.h b/ecmascript/mem/barriers.h index b6200f3c05..0a6806da05 100644 --- a/ecmascript/mem/barriers.h +++ b/ecmascript/mem/barriers.h @@ -48,9 +48,18 @@ public: template static void SetObject(const JSThread *thread, void *obj, size_t offset, JSTaggedType value); + // dstAddr/srcAddr is the address will be copied to/from. + // It can be a derived pointer point to the middle of an object. + // + // Note: dstObj is the object address for dstAddr, it must point to the head of an object. template - static void CopyObject(const JSThread *thread, JSTaggedValue* dst, JSTaggedValue* src, size_t count); + static void CopyObject(const JSThread *thread, const TaggedObject *dstObj, JSTaggedValue *dstAddr, + JSTaggedValue *srcAddr, size_t count); + // dstAddr/srcAddr is the address will be copied to/from. + // It can be a derived pointer point to the middle of an object. + // + // Note: dstObj is the object address for dstAddr, it must point to the head of an object. template static void CopyObjectPrimitive(JSTaggedValue* dst, JSTaggedValue* src, size_t count); static void SynchronizedSetClass(const JSThread *thread, void *obj, JSTaggedType value); diff --git a/ecmascript/tagged_array-inl.h b/ecmascript/tagged_array-inl.h index 73931cc6bd..8105f3b42a 100644 --- a/ecmascript/tagged_array-inl.h +++ b/ecmascript/tagged_array-inl.h @@ -74,7 +74,7 @@ inline void TaggedArray::Copy(const JSThread* thread, uint32_t dstStart, uint32_ size_t taggedTypeSize = JSTaggedValue::TaggedTypeSize(); JSTaggedValue* to = reinterpret_cast(ToUintPtr(GetData()) + taggedTypeSize * dstStart); JSTaggedValue* from = reinterpret_cast(ToUintPtr(srcArray->GetData()) + taggedTypeSize * srcStart); - Barriers::CopyObject(thread, to, from, count); + Barriers::CopyObject(thread, this, to, from, count); } } // namespace panda::ecmascript #endif // ECMASCRIPT_TAGGED_ARRAY_INL_H diff --git a/ecmascript/tests/barrier_test.cpp b/ecmascript/tests/barrier_test.cpp index dff7847194..6ec1b1e85b 100644 --- a/ecmascript/tests/barrier_test.cpp +++ b/ecmascript/tests/barrier_test.cpp @@ -49,7 +49,7 @@ HWTEST_F_L0(BarrierTest, YoungToYoungBatchCopy) JSTaggedValue* to = reinterpret_cast(ToUintPtr(dstArray->GetData())); JSTaggedValue* from = reinterpret_cast(ToUintPtr(srcArray->GetData())); - Barriers::CopyObject(thread, to, from, arrayLength); + Barriers::CopyObject(thread, *dstArray, to, from, arrayLength); // young to young, all the bitset should not be changed. dstRegion->IterateAllNewToEdenBits([&NewToEdenBeforeCopy](void* mem) { @@ -112,7 +112,7 @@ HWTEST_F_L0(BarrierTest, BatchCopyNoBarrier) JSTaggedValue* to2 = reinterpret_cast(ToUintPtr(dstArray2->GetData())); JSTaggedValue* from2 = reinterpret_cast(ToUintPtr(srcArray->GetData())); // barrier should also work for no heap value - Barriers::CopyObject(thread, to2, from2, arrayLength); + Barriers::CopyObject(thread, *dstArray, to2, from2, arrayLength); // check for (uint32_t i = 0; i < arrayLength; i++) { EXPECT_EQ(dstArray2->Get(thread, i), srcArray->Get(thread, i)); @@ -146,7 +146,7 @@ HWTEST_F_L0(BarrierTest, LocalToShareBatchCopy) JSTaggedValue* to = reinterpret_cast(ToUintPtr(dstArray->GetData())); JSTaggedValue* from = reinterpret_cast(ToUintPtr(srcArray->GetData())); - Barriers::CopyObject(thread, to, from, arrayLength); + Barriers::CopyObject(thread, *dstArray, to, from, arrayLength); std::set LocalToShareSlot; for (uint32_t i = 0; i < arrayLength; i++) { @@ -202,7 +202,7 @@ HWTEST_F_L0(BarrierTest, LocalToReadOnlyShareBatchCopy) JSTaggedValue* to = reinterpret_cast(ToUintPtr(dstArray->GetData())); JSTaggedValue* from = reinterpret_cast(ToUintPtr(srcArray->GetData())); - Barriers::CopyObject(thread, to, from, arrayLength); + Barriers::CopyObject(thread, *dstArray, to, from, arrayLength); std::set LocalToShareSlot; for (uint32_t i = 0; i < arrayLength; i++) { @@ -256,7 +256,7 @@ HWTEST_F_L0(BarrierTest, LocalToShareMixBatchCopy) JSTaggedValue* to = reinterpret_cast(ToUintPtr(dstArray->GetData())); JSTaggedValue* from = reinterpret_cast(ToUintPtr(srcArray->GetData())); - Barriers::CopyObject(thread, to, from, arrayLength); + Barriers::CopyObject(thread, *dstArray, to, from, arrayLength); std::set LocalToShareSlot; for (uint32_t i = 0; i < arrayLength; i++) { @@ -324,7 +324,7 @@ HWTEST_F_L0(BarrierTest, OldToNewBatchCopy) JSTaggedValue* to = reinterpret_cast(ToUintPtr(dstArray->GetData())); JSTaggedValue* from = reinterpret_cast(ToUintPtr(srcArray->GetData())); - Barriers::CopyObject(thread, to, from, arrayLength); + Barriers::CopyObject(thread, *dstArray, to, from, arrayLength); // young to young, all the bitset should not be changed. dstRegion->IterateAllNewToEdenBits([&OldToNewSlot, &OldToNewBeforeCopy, &dstArray, arrayLength](void* mem) {