From ff8a29f2248f1d3febe9e5016330888eda3946ab Mon Sep 17 00:00:00 2001
From: mingyix <13926077+mingyix@user.noreply.gitee.com>
Date: Tue, 2 Apr 2024 10:30:49 +0800
Subject: [PATCH] [fixbug][unbox-double-arrays.js]Error copying Array using the
 Function.Apply

---
 .../builtins_function_stub_builder.cpp        | 72 ++++++++++++++++++-
 1 file changed, 69 insertions(+), 3 deletions(-)

diff --git a/ecmascript/compiler/builtins/builtins_function_stub_builder.cpp b/ecmascript/compiler/builtins/builtins_function_stub_builder.cpp
index 98dabbcad..c9c1706a5 100644
--- a/ecmascript/compiler/builtins/builtins_function_stub_builder.cpp
+++ b/ecmascript/compiler/builtins/builtins_function_stub_builder.cpp
@@ -16,6 +16,7 @@
 #include "ecmascript/compiler/builtins/builtins_function_stub_builder.h"
 
 #include "ecmascript/compiler/builtins/builtins_object_stub_builder.h"
+#include "ecmascript/compiler/new_object_stub_builder.h"
 #include "ecmascript/compiler/stub_builder-inl.h"
 #include "ecmascript/js_arguments.h"
 
@@ -144,7 +145,38 @@ GateRef BuiltinsFunctionStubBuilder::BuildArgumentsListFastElements(GateRef glue
                 Bind(&targetIsInt);
                 {
                     res = GetElementsArray(arrayObj);
-                    Jump(&exit);
+                    Label isMutantTaggedArray(env);
+                    Branch(IsMutantTaggedArray(*res), &isMutantTaggedArray, &exit);
+                    Bind(&isMutantTaggedArray);
+                    {
+                        NewObjectStubBuilder newBuilder(this);
+                        GateRef elementsLength = GetLengthOfTaggedArray(*res);
+                        GateRef newTaggedArgList = newBuilder.NewTaggedArray(glue, elementsLength);
+                        DEFVARIABLE(index, VariableType::INT32(), Int32(0));
+                        Label loopHead(env);
+                        Label loopEnd(env);
+                        Label afterLoop(env);
+                        Label storeValue(env);
+                        Jump(&loopHead);
+                        LoopBegin(&loopHead);
+                        {
+                            Branch(Int32UnsignedLessThan(*index, elementsLength), &storeValue, &afterLoop);
+                            Bind(&storeValue);
+                            {
+                                GateRef value = GetTaggedValueWithElementsKind(arrayObj, *index);
+                                SetValueToTaggedArray(VariableType::JS_ANY(), glue, newTaggedArgList, *index, value);
+                                index = Int32Add(*index, Int32(1));
+                                Jump(&loopEnd);
+                            }
+                        }
+                        Bind(&loopEnd);
+                        LoopEnd(&loopHead);
+                        Bind(&afterLoop);
+                        {
+                            res = newTaggedArgList;
+                            Jump(&exit);
+                        }
+                    }
                 }
             }
         }
@@ -153,8 +185,42 @@ GateRef BuiltinsFunctionStubBuilder::BuildArgumentsListFastElements(GateRef glue
             Branch(IsStableJSArray(glue, arrayObj), &targetIsStableJSArray, &targetNotStableJSArray);
             Bind(&targetIsStableJSArray);
             {
-                res = GetElementsArray(arrayObj);
-                Jump(&exit);
+                arrayObj = GetElementsArray(arrayObj);
+                DEFVARIABLE(length, VariableType::INT32(), GetLengthOfTaggedArray(arrayObj));
+                res = CallRuntime(glue, RTSTUB_ID(CopyArray),
+                        { arrayObj, IntToTaggedInt(*length), IntToTaggedInt(*length) });
+                Label isMutantTaggedArray(env);
+                Branch(IsMutantTaggedArray(*res), &isMutantTaggedArray, &exit);
+                Bind(&isMutantTaggedArray);
+                {
+                    NewObjectStubBuilder newBuilder(this);
+                    GateRef elementsLength = GetLengthOfTaggedArray(*res);
+                    GateRef newTaggedArgList = newBuilder.NewTaggedArray(glue, elementsLength);
+                    DEFVARIABLE(index, VariableType::INT32(), Int32(0));
+                    Label loopHead(env);
+                    Label loopEnd(env);
+                    Label afterLoop(env);
+                    Label storeValue(env);
+                    Jump(&loopHead);
+                    LoopBegin(&loopHead);
+                    {
+                        Branch(Int32UnsignedLessThan(*index, elementsLength), &storeValue, &afterLoop);
+                        Bind(&storeValue);
+                        {
+                            GateRef value = GetTaggedValueWithElementsKind(arrayObj, *index);
+                            SetValueToTaggedArray(VariableType::JS_ANY(), glue, newTaggedArgList, *index, value);
+                            index = Int32Add(*index, Int32(1));
+                            Jump(&loopEnd);
+                        }
+                    }
+                    Bind(&loopEnd);
+                    LoopEnd(&loopHead);
+                    Bind(&afterLoop);
+                    {
+                        res = newTaggedArgList;
+                        Jump(&exit);
+                    }
+                }
             }
             Bind(&targetNotStableJSArray);
             {
-- 
Gitee