35 Star 168 Fork 689

OpenHarmony / arkcompiler_ets_runtime

 / 详情

[Bug]: ElementsKind Deopt问题

待办的
创建于  
2024-05-16 16:09

发生了什么问题?

ElementsKind 应该只针对StableArray。

BuiltinInstance判断的时候,不能只判断JSType,万一重载了JSArray的方法,就会挂了。
JSObject = 【NotStableArray | StableArray】

期望行为是什么?


diff --git a/ecmascript/compiler/typed_hcr_lowering.cpp b/ecmascript/compiler/typed_hcr_lowering.cpp
index ec9193bc7..3c3b511ea 100644
--- a/ecmascript/compiler/typed_hcr_lowering.cpp
+++ b/ecmascript/compiler/typed_hcr_lowering.cpp
@@ -584,25 +584,15 @@ void TypedHCRLowering::BuiltinInstanceHClassCheck(Environment *env, GateRef gate
 {
     BuiltinPrototypeHClassAccessor accessor = acc_.GetBuiltinHClassAccessor(gate);
     BuiltinTypeId type = accessor.GetBuiltinTypeId();
-    ElementsKind kind = accessor.GetElementsKind();
     GateRef frameState = GetFrameState(gate);
     GateRef glue = acc_.GetGlueFromArgList();
     GateRef receiver = acc_.GetValueIn(gate, 0);
     GateRef ihcMatches = Circuit::NullGate();
     if (type == BuiltinTypeId::ARRAY) {
-        if (Elements::IsGeneric(kind)) {
-            auto arrayHClassIndexMap = compilationEnv_->GetArrayHClassIndexMap();
-            auto iter = arrayHClassIndexMap.find(kind);
-            ASSERT(iter != arrayHClassIndexMap.end());
-            GateRef initialIhcAddress = builder_.GetGlobalConstantValue(iter->second);
-            GateRef receiverHClass = builder_.LoadHClassByConstOffset(receiver);
-            ihcMatches = builder_.Equal(receiverHClass, initialIhcAddress);
-        } else {
-            GateRef receiverHClass = builder_.LoadHClassByConstOffset(receiver);
-            GateRef elementsKind = builder_.GetElementsKindByHClass(receiverHClass);
-            ihcMatches =
-                builder_.NotEqual(elementsKind, builder_.Int32(static_cast<size_t>(ElementsKind::GENERIC)));
-        }
+        GateRef receiverHClass = builder_.LoadHClassByConstOffset(receiver);
+        GateRef elementsKind = builder_.GetElementsKindByHClass(receiverHClass);
+        ihcMatches =
+            builder_.NotEqual(elementsKind, builder_.Int32(static_cast<size_t>(ElementsKind::NOT_ARRAY)));
     } else {
         size_t ihcOffset = JSThread::GlueData::GetBuiltinInstanceHClassOffset(type, env->IsArch32Bit());
         GateRef initialIhcAddress = builder_.LoadConstOffset(VariableType::JS_POINTER(), glue, ihcOffset);
diff --git a/ecmascript/elements.cpp b/ecmascript/elements.cpp
index 13b6765fe..38f33d403 100644
--- a/ecmascript/elements.cpp
+++ b/ecmascript/elements.cpp
@@ -98,6 +98,7 @@ ConstantIndex Elements::GetGlobalContantIndexByKind(ElementsKind kind)
             return ConstantIndex::ELEMENT_HOLE_TAGGED_HCLASS_INDEX;
         default:
             LOG_ECMA(FATAL) << "Unknown elementsKind when getting constantIndx: " << static_cast<int32_t>(kind);
+            return ConstantIndex::ELEMENT_NONE_HCLASS_INDEX;
     }
 }

diff --git a/ecmascript/elements.h b/ecmascript/elements.h
index a71eee947..667fb5846 100644
--- a/ecmascript/elements.h
+++ b/ecmascript/elements.h
@@ -34,8 +34,9 @@ enum class ElementsKind : uint8_t {
     HOLE_STRING = HOLE | STRING,
     HOLE_OBJECT = HOLE | OBJECT,
     HOLE_TAGGED = HOLE | TAGGED,
+    NOT_STABLEARRAY = 20,
     GENERIC = HOLE_TAGGED,
-    DICTIONARY = HOLE_TAGGED,
+    DICTIONARY = 22,
 };

 class PUBLIC_API Elements {
diff --git a/ecmascript/js_hclass.cpp b/ecmascript/js_hclass.cpp
index 1a1f8dbb7..30e46fe86 100644
--- a/ecmascript/js_hclass.cpp
+++ b/ecmascript/js_hclass.cpp
@@ -152,7 +152,7 @@ void JSHClass::InitializeWithDefaultValue(const JSThread *thread, uint32_t size,
     SetIsPrototype(false);
     SetHasDeleteProperty(false);
     SetIsAllTaggedProp(true);
-    SetElementsKind(ElementsKind::GENERIC);
+    SetElementsKind(ElementsKind::NOT_ARRAY);
     SetTransitions(thread, JSTaggedValue::Undefined());
     SetParent(thread, JSTaggedValue::Undefined());
     SetProtoChangeMarker(thread, JSTaggedValue::Null());

如何复现该缺陷


let start: number = ArkTools.timeInUs();

function initBIRC(): void {
  let rr: number;
  rr = '0'.charCodeAt(0);
  let bIRC = [];
  for (let vv = 0; vv <= 2; ++vv) {
    ArkTools.dumpHClass(bIRC);
    bIRC = insertValue(bIRC, vv, rr);
    ArkTools.dumpHClass(bIRC);
    rr += 1;
  }
}
function test(){
    initBIRC();
    //let a = new A();
    //a.foo();
}

for (let i = 0; i < 1; i++){
    test();
}

function insertValue(array, value , i) {
  let arr = array;
  if (i < arr.length) {
    arr[i] = value;
  } else {
    const surplus = i - arr.length;
    const surplusArr = new Array(surplus + 1).fill(null);
    arr = arr.concat(surplusArr);   --- none
    arr[i] = value;
  }
  return arr;
}

let end = ArkTools.timeInUs();
let time = (end - start) / 1000
print("Cocos - RunCocos:\t"+String(time)+"\tms");




let a = []
a.concat
a[0] = 1.5

其他补充信息

版本或分支信息

  • master
  • Release 4.1
  • Release 4.0
  • Release 3.2

评论 (1)

yaoyuan 创建了任务
yaoyuan 添加了
 
bug
标签
展开全部操作日志

感谢提交Issue!关于Issue的交互操作,请访问OpenHarmony社区支持命令清单。如果有问题,请联系 @weng-changcheng @gonggong @孙哲 @Gargoyle.h @chuning1988 。如果需要调整订阅PR、Issue的变更状态,请访问链接

Thanks for submitting the issue. For more commands, please visit OpenHarmony Command List. If you have any questions, please refer to committer @weng-changcheng @gonggong @孙哲 @Gargoyle.h @chuning1988 for help. If you need to change the subscription of a Pull Request or Issue, please visit the link.

openharmony_ci 添加了
 
waiting_for_assign
标签

登录 后才可以发表评论

状态
负责人
项目
里程碑
Pull Requests
关联的 Pull Requests 被合并后可能会关闭此 issue
分支
开始日期   -   截止日期
-
置顶选项
优先级
预计工期 (小时)
参与者(2)
7387629 openharmony ci 1656582662
1
https://gitee.com/openharmony/arkcompiler_ets_runtime.git
git@gitee.com:openharmony/arkcompiler_ets_runtime.git
openharmony
arkcompiler_ets_runtime
arkcompiler_ets_runtime

搜索帮助

344bd9b3 5694891 D2dac590 5694891