!9304 IC 字典模式下异常

Merge pull request !9304 from 贺存茂/IC0913

ecmascript/object_operator.cpp

@@ -552,7 +552,7 @@ void ObjectOperator::LookupPropertyInlinedProps(const JSHandle<JSObject> &obj)
 
         JSTaggedValue value(dict->GetBox(entry));
         auto attr = dict->GetAttributes(entry).GetValue();
-        SetFound(entry, value, attr, true);
+        SetFound(entry, value, attr, !IsFoundDict());
         return;
     }
 
@@ -581,10 +581,10 @@ void ObjectOperator::LookupPropertyInlinedProps(const JSHandle<JSObject> &obj)
             value = array->Get(entry);
         }
 
-        SetFound(entry, value, attr.GetValue(), true);
+        SetFound(entry, value, attr.GetValue(), !IsFoundDict());
         return;
     }
-
+    SetFoundDict(true);
     NameDictionary *dict = NameDictionary::Cast(array);
     int entry = dict->FindEntry(key_.GetTaggedValue());
     if (entry == -1) {
@@ -985,7 +985,7 @@ void ObjectOperator::LookupElementInlinedProps(const JSHandle<JSObject> &obj)
         bool status = JSPrimitiveRef::StringGetIndexProperty(thread_, obj, elementIndex_, &desc);
         if (status) {
             PropertyAttributes attr(desc);
-            SetFound(elementIndex_, desc.GetValue().GetTaggedValue(), attr.GetValue(), true);
+            SetFound(elementIndex_, desc.GetValue().GetTaggedValue(), attr.GetValue(), !IsFoundDict());
             return;
         }
     }
@@ -996,7 +996,7 @@ void ObjectOperator::LookupElementInlinedProps(const JSHandle<JSObject> &obj)
                 JSHandle<JSTaggedValue>::Cast(obj), elementIndex_).GetValue().GetTaggedValue();
             RETURN_IF_ABRUPT_COMPLETION(thread_);
             if (!val.IsHole()) {
-                SetFound(elementIndex_, val, PropertyAttributes::GetDefaultAttributes(), true);
+                SetFound(elementIndex_, val, PropertyAttributes::GetDefaultAttributes(), !IsFoundDict());
             }
             return;
         }
@@ -1014,8 +1014,9 @@ void ObjectOperator::LookupElementInlinedProps(const JSHandle<JSObject> &obj)
             if (value.IsHole()) {
                 return;
             }
-            SetFound(elementIndex_, value, PropertyAttributes::GetDefaultAttributes(), true);
+            SetFound(elementIndex_, value, PropertyAttributes::GetDefaultAttributes(), !IsFoundDict());
         } else {
+            SetFoundDict(true);
             NumberDictionary *dictionary = NumberDictionary::Cast(obj->GetElements().GetTaggedObject());
             JSTaggedValue key(static_cast<int>(elementIndex_));
             int entry = dictionary->FindEntry(key);

ecmascript/object_operator.h

@@ -94,6 +94,16 @@ public:
         IsFastModeField::Set(flag, &metaData_);
     }
 
+    inline void SetFoundDict(bool flag)
+    {
+        IsFoundDictField::Set(flag, &metaData_);
+    }
+
+    inline bool IsFoundDict()
+    {
+        return IsFoundDictField::Get(metaData_);
+    }
+
     inline bool IsElement() const
     {
         return key_.IsEmpty();
@@ -330,6 +340,8 @@ private:
     using HasReceiverField = IsOnPrototypeField::NextFlag;
     using IsTransitionField = HasReceiverField::NextFlag;
     using IsTSHClassField = IsTransitionField::NextFlag;
+    // found dictionary obj between receriver and holder
+    using IsFoundDictField = IsTSHClassField::NextFlag;
 
     void UpdateHolder();
     void UpdateIsTSHClass();

test/moduletest/loadicbyname/expect_output.txt

@@ -29,3 +29,13 @@ SendableUint8ClampedArray set proto with sendable object failed. err: TypeError:
 1
 1
 load global ic with accessor success!
+1
+change
+2
+1
+change
+function Number() { [native code] }
+function Number() { [native code] }
+change
+2
+2

test/moduletest/loadicbyname/loadicbyname.js

@@ -139,3 +139,77 @@ for(let i=0;i<2;i++){
     print(g)
 }
 print("load global ic with accessor success!");
+
+function func1(o, v) {
+  let  res;
+  for (let i = 0; i < 100; i++) {
+      res=o.x;
+      if (res != v) {
+          print("Error");
+      }
+  }
+  return res;
+}
+{
+  let pro = {
+      get x() {
+          return 1;
+      }
+  }
+  let o = {
+      __proto__: pro
+  };
+  o[102500] = 1;
+  o["test"] = "test";
+  print(func1(o, 1));
+  Object.defineProperty(o, "x", { value: 2 });
+  print("change")
+  print(func1(o, 2));
+}
+
+{
+  let pro = {
+      get x() {
+          return 1;
+      }
+  }
+  let pro2 = {
+      __proto__: pro
+  };
+  let o = {
+      __proto__: pro2
+  };
+  pro2[102500] = 1;
+  pro2["test"] = "test";
+  print(func1(o, 1));
+  Object.defineProperty(pro2, "x", { value: 2 });
+  print("change")
+  func1(o, 2);
+}
+
+{
+  function getNumber(o) {
+      let res;
+      for (let i = 0; i < 100; i++) {
+        res=o.Number;
+      }
+      return res;
+  }
+  let pro = globalThis
+  let pro2 = {
+      __proto__: pro
+  };
+  let o = {
+      __proto__: pro2
+  };
+  pro2[102500] = 1;
+  pro2["test"] = "test";
+  for (let i = 0; i < 2; i++) {
+      print(getNumber(o))
+  }
+  Object.defineProperty(o, "Number", { value: 2 });
+  print("change")
+  for (let i = 0; i < 2; i++) {
+      print(getNumber(o))
+  }
+}

test/moduletest/loadicbyvalue/expect_output.txt

@@ -19,4 +19,10 @@ test successful !!!
 4294967295 3
 4294967296 4
 load ic by COWArray Success
+1
+change
+2
+1
+change
+2
 ic load success

test/moduletest/loadicbyvalue/loadicbyvalue.js

@@ -85,4 +85,37 @@ for (let i = 0; i < 100; i++) {
 }
 print("load ic by COWArray Success")
 
+function g(o, v) {
+    let res;
+    for (let i = 0; i < 100; i++) {
+        res = o[1];
+        if (res != v) {
+            print("Error ",res);
+        }
+    }
+    return res;
+}
+{
+    let pro = [1,1,1,1];
+    let o = { 
+        __proto__: pro };
+    o[102500] = 1;
+    o["test"] = "test";
+    print(g(o, 1));
+    Object.defineProperty(o, "1", { value: 2 });
+    print("change")
+    print(g(o, 2));
+}
+{
+    let pro = new Uint8Array(10);
+    pro[1]=1;
+    let o = { 
+        __proto__: pro };
+    o[102500] = 1;
+    o["test"] = "test";
+    print(g(o, 1));
+    Object.defineProperty(o, "1", { value: 2 });
+    print("change")
+    print(g(o, 2));
+}
 print("ic load success");