From dce1b38f8a867178d9b41523ffa582fd0da71ea4 Mon Sep 17 00:00:00 2001
From: mingyix <13926077+mingyix@user.noreply.gitee.com>
Date: Tue, 2 Apr 2024 14:54:11 +0800
Subject: [PATCH] [fixbug][unbox-double-arrays.js]Error copying Array using the
 Function.Apply

---
 .../compiler/builtins/builtins_function_stub_builder.cpp     | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ecmascript/compiler/builtins/builtins_function_stub_builder.cpp b/ecmascript/compiler/builtins/builtins_function_stub_builder.cpp
index e3d782e2f..c9c1706a5 100644
--- a/ecmascript/compiler/builtins/builtins_function_stub_builder.cpp
+++ b/ecmascript/compiler/builtins/builtins_function_stub_builder.cpp
@@ -185,7 +185,10 @@ GateRef BuiltinsFunctionStubBuilder::BuildArgumentsListFastElements(GateRef glue
             Branch(IsStableJSArray(glue, arrayObj), &targetIsStableJSArray, &targetNotStableJSArray);
             Bind(&targetIsStableJSArray);
             {
-                res = GetElementsArray(arrayObj);
+                arrayObj = GetElementsArray(arrayObj);
+                DEFVARIABLE(length, VariableType::INT32(), GetLengthOfTaggedArray(arrayObj));
+                res = CallRuntime(glue, RTSTUB_ID(CopyArray),
+                        { arrayObj, IntToTaggedInt(*length), IntToTaggedInt(*length) });
                 Label isMutantTaggedArray(env);
                 Branch(IsMutantTaggedArray(*res), &isMutantTaggedArray, &exit);
                 Bind(&isMutantTaggedArray);
-- 
Gitee