array.splice进入JSStableArray::Splice后,经过JSArray::ArraySpeciesCreate后,thisObjHandle不再是StableJSArray

Signed-off-by: hwx1163501 <hanjing35@huawei.com>
issue:https://gitee.com/openharmony/arkcompiler_ets_runtime/issues/I8MFFT
This commit is contained in:
hwx1163501 2023-12-07 10:26:29 +08:00
parent cbb1caa980
commit ba9ec46644
6 changed files with 26 additions and 12 deletions

View File

@ -2311,14 +2311,14 @@ JSTaggedValue BuiltinsArray::Splice(EcmaRuntimeCallInfo *argv)
if (len + insertCount - actualDeleteCount > base::MAX_SAFE_INTEGER) {
THROW_TYPE_ERROR_AND_RETURN(thread, "out of range.", JSTaggedValue::Exception());
}
if (thisHandle->IsStableJSArray(thread)) {
return JSStableArray::Splice(JSHandle<JSArray>::Cast(thisHandle), argv, start, insertCount, actualDeleteCount);
}
// 12. Let A be ArraySpeciesCreate(O, actualDeleteCount).
JSTaggedValue newArray = JSArray::ArraySpeciesCreate(thread, thisObjHandle,
JSTaggedNumber(static_cast<double>(actualDeleteCount)));
RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread);
if (thisHandle->IsStableJSArray(thread)) {
return JSStableArray::Splice(JSHandle<JSArray>::Cast(thisHandle), argv, start, insertCount,
actualDeleteCount, newArray);
}
JSHandle<JSObject> newArrayHandle(thread, newArray);
// 14. Let k be 0.
// 15. Repeat, while k < actualDeleteCount

View File

@ -87,15 +87,14 @@ JSTaggedValue JSStableArray::Pop(JSHandle<JSArray> receiver, EcmaRuntimeCallInfo
}
JSTaggedValue JSStableArray::Splice(JSHandle<JSArray> receiver, EcmaRuntimeCallInfo *argv,
uint32_t start, uint32_t insertCount, uint32_t actualDeleteCount)
uint32_t start, uint32_t insertCount, uint32_t actualDeleteCount,
JSTaggedValue newArray)
{
JSThread *thread = argv->GetThread();
uint32_t len = receiver->GetArrayLength();
uint32_t argc = argv->GetArgsNumber();
JSHandle<JSObject> thisObjHandle(receiver);
JSTaggedValue newArray = JSArray::ArraySpeciesCreate(thread, thisObjHandle, JSTaggedNumber(actualDeleteCount));
RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread);
JSHandle<JSObject> newArrayHandle(thread, newArray);
JSHandle<JSTaggedValue> thisObjVal(thisObjHandle);

View File

@ -27,8 +27,8 @@ public:
enum SeparatorFlag : int { MINUS_ONE = -1, MINUS_TWO = -2 };
static JSTaggedValue Push(JSHandle<JSArray> receiver, EcmaRuntimeCallInfo *argv);
static JSTaggedValue Pop(JSHandle<JSArray> receiver, EcmaRuntimeCallInfo *argv);
static JSTaggedValue Splice(JSHandle<JSArray> receiver, EcmaRuntimeCallInfo *argv,
uint32_t start, uint32_t insertCount, uint32_t actualDeleteCount);
static JSTaggedValue Splice(JSHandle<JSArray> receiver, EcmaRuntimeCallInfo *argv, uint32_t start,
uint32_t insertCount, uint32_t actualDeleteCount, JSTaggedValue newArray);
static JSTaggedValue Shift(JSHandle<JSArray> receiver, EcmaRuntimeCallInfo *argv);
static JSTaggedValue Join(JSHandle<JSArray> receiver, EcmaRuntimeCallInfo *argv);
static JSTaggedValue HandleFindIndexOfStable(JSThread *thread, JSHandle<JSObject> thisObjHandle,

View File

@ -164,9 +164,12 @@ HWTEST_F_L0(JSStableArrayTest, Splice)
ecmaRuntimeCallInfo->SetCallArg(3, handleTagValInsertElement2.GetTaggedValue());
[[maybe_unused]] auto prev = TestHelper::SetupFrame(thread, ecmaRuntimeCallInfo);
JSHandle<JSObject> thisObjHandle(handleArr);
JSTaggedValue newArray = JSArray::ArraySpeciesCreate(thread, thisObjHandle,
JSTaggedNumber(static_cast<double>(actualDeleteCount)));
JSHandle<JSTaggedValue> handleTagValArrCombinedOfDeletedElements(thread,
JSStableArray::Splice(handleArr, ecmaRuntimeCallInfo, offsetStartInsert, countInsert,
actualDeleteCount));
JSStableArray::Splice(JSHandle<JSArray>::Cast(thisObjHandle), ecmaRuntimeCallInfo, offsetStartInsert,
countInsert, actualDeleteCount, newArray));
TestHelper::TearDownFrame(thread, prev);
JSHandle<JSArray> handleArrCombinedOfDeletedElements(handleTagValArrCombinedOfDeletedElements);
EXPECT_EQ(handleArrCombinedOfDeletedElements->GetArrayLength(), actualDeleteCount);

View File

@ -363,3 +363,14 @@ var target1 = [];
var obj = new Proxy(target1, {get: getTrap, has: () => true});
print([].concat(obj));
print(Array.prototype.concat.apply(obj))
const v55 = new Float64Array();
const v98 = [-5.335880620598348e+307,1.0,1.0,2.220446049250313e-16,-1.6304390272817058e+308];
function f99(a100) {
}
function f110() {
v98[2467] = v55;
}
Object.defineProperty(f99, Symbol.species, { configurable: true, enumerable: true, value: f110 });
v98.constructor = f99;
print(JSON.stringify(v98.splice(4)));

View File

@ -116,3 +116,4 @@ Expected TypeError caught in lastIndexOf when fromIndex is symbol.
CallbackFn is not callable
,,baz
,,baz
{"0":-1.6304390272817058e+308,"length":1}