[GR-45391] Ensure deleted elements are filled with hole values.

woess · woess · commit f34735d67003 · 2023-04-06T13:18:16.000Z
PullRequest: js/2775
diff --git a/graal-js/src/com.oracle.truffle.js.test/js/GR-42807.js b/graal-js/src/com.oracle.truffle.js.test/js/GR-42807.js
@@ -0,0 +1,30 @@
+/*
+ * Copyright (c) 2022, 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
+ */
+
+var s2 = "";
+var a0 = [];
+var a1 = [];
+var a2 = [];
+var a3 = [];
+var a4 = [];
+var o1 = {};
+for (let i = 0; i < 5; i++) {
+    Array.prototype.shift.apply(a1);
+    a1.splice(NaN, -2044533922.5, a0, s2);
+}
+for (let i = 0; i < 5; i++) {
+    Array.prototype.shift.apply(a2);
+    a2.splice(NaN, -2044533922.5, 3, 4);
+}
+for (let i = 0; i < 5; i++) {
+    Array.prototype.shift.apply(a3);
+    a3.splice(NaN, -2044533922.5, 3.1, 4.15);
+}
+for (let i = 0; i < 5; i++) {
+    Array.prototype.shift.apply(a4);
+    a4.splice(NaN, -2044533922.5, o1, o1);
+}
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/AbstractJSObjectArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/AbstractJSObjectArray.java
@@ -141,6 +141,7 @@ protected final void fillHoles(JSDynamicObject object, int internalIndex, int gr
         if (grown != 0) {
             incrementHolesCount(object, Math.abs(grown) - 1);
         }
+        assert checkFillHoles(object, internalIndex, grown);
     }
 
     @Override
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/AbstractObjectArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/AbstractObjectArray.java
@@ -143,6 +143,7 @@ protected final void fillHoles(JSDynamicObject object, int internalIndex, int gr
         if (grown != 0) {
             incrementHolesCount(object, Math.abs(grown) - 1);
         }
+        assert checkFillHoles(object, internalIndex, grown);
     }
 
     @Override
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/AbstractWritableArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/AbstractWritableArray.java
@@ -204,8 +204,9 @@ protected final int prepareSupportedHoles(JSDynamicObject object, int index, Nod
     }
 
     @SuppressWarnings("unused")
-    protected void incrementHolesCount(JSDynamicObject object, int offset) {
-        throw Errors.shouldNotReachHere();
+    protected final void incrementHolesCount(JSDynamicObject object, int offset) {
+        assert isHolesType();
+        arraySetHoleCount(object, arrayGetHoleCount(object) + offset);
     }
 
     protected abstract void setHoleValue(JSDynamicObject object, int index);
@@ -353,6 +354,27 @@ protected void fillHoles(JSDynamicObject object, int internalIndex, int grown, N
         }
     }
 
+    protected final boolean checkFillHoles(JSDynamicObject object, int internalIndex, int grown) {
+        int start;
+        int end;
+        if (grown > 1) {
+            start = internalIndex - grown + 1;
+            end = internalIndex;
+        } else if (grown < -1) {
+            start = internalIndex + 1;
+            end = internalIndex - grown;
+        } else {
+            return true;
+        }
+
+        for (int i = start; i < end; i++) {
+            if (!isHolePrepared(object, i)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
     public abstract AbstractWritableArray toDouble(JSDynamicObject object, long index, double value);
 
     public abstract AbstractWritableArray toObject(JSDynamicObject object, long index, Object value);
@@ -525,7 +547,7 @@ protected final void setLengthLessContiguous(JSDynamicObject object, long length
             if (profile.contiguousShrinkUsed(node, newUsedLength < oldUsed)) {
                 if (isHolesType()) {
                     incrementHolesCount(object, -countHolesPrepared(object, arrayOffset + newUsedLength, arrayOffset + oldUsed));
-                    assert arrayGetHoleCount(object) == countHoles(object);
+                    assert assertHoleCount(object);
                 }
 
                 // use old arrayOffset
@@ -619,7 +641,7 @@ protected final ScriptArray deleteElementHoles(JSDynamicObject object, long inde
                 }
             }
         }
-        assert arrayGetHoleCount(object) == countHoles(object);
+        assert assertHoleCount(object);
         return this;
     }
 
@@ -814,6 +836,14 @@ private int countHolesPrepared(JSDynamicObject object, int start, int end) {
         return holeCount;
     }
 
+    protected final boolean assertHoleCount(JSDynamicObject object) {
+        assert isHolesType();
+        int holeCount = arrayGetHoleCount(object);
+        int countedHoles = countHoles(object);
+        assert holeCount == countedHoles : String.format("holeCount, %d, differs from the actual count, %d", holeCount, countedHoles);
+        return true;
+    }
+
     /**
      * Move {@code len} elements from {@code src} to {@code dst}.
      */
@@ -845,6 +875,20 @@ public ScriptArray shiftRangeImpl(JSDynamicObject object, long from) {
         return removeRangeImpl(object, 0, from);
     }
 
+    protected static boolean unusedElementsAreHoles(Object[] array, int usedStart, int usedLength) {
+        for (int i = 0; i < usedStart; i++) {
+            if (array[i] != null) {
+                return false;
+            }
+        }
+        for (int i = usedStart + usedLength; i < array.length; i++) {
+            if (array[i] != null) {
+                return false;
+            }
+        }
+        return true;
+    }
+
     public static class SetSupportedProfileAccess implements InlinedProfileBag {
 
         private final InlinedConditionProfile ensureCapacityGrow;
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/ContiguousJSObjectArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/ContiguousJSObjectArray.java
@@ -53,6 +53,7 @@ public static ContiguousJSObjectArray makeContiguousJSObjectArray(JSDynamicObjec
                     int integrityLevel) {
         ContiguousJSObjectArray arrayType = createContiguousJSObjectArray().setIntegrityLevel(integrityLevel);
         setArrayProperties(object, array, length, usedLength, indexOffset, arrayOffset);
+        assert unusedElementsAreHoles(array, arrayOffset, usedLength);
         return arrayType;
     }
 
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/ContiguousObjectArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/ContiguousObjectArray.java
@@ -52,6 +52,7 @@ public final class ContiguousObjectArray extends AbstractContiguousObjectArray {
     public static ContiguousObjectArray makeContiguousObjectArray(JSDynamicObject object, long length, Object[] array, long indexOffset, int arrayOffset, int usedLength, int integrityLevel) {
         ContiguousObjectArray arrayType = createContiguousObjectArray().setIntegrityLevel(integrityLevel);
         setArrayProperties(object, array, length, usedLength, indexOffset, arrayOffset);
+        assert unusedElementsAreHoles(array, arrayOffset, usedLength);
         return arrayType;
     }
 
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/HolesDoubleArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/HolesDoubleArray.java
@@ -66,7 +66,7 @@ public static HolesDoubleArray makeHolesDoubleArray(JSDynamicObject object, int
         HolesDoubleArray arrayType = createHolesDoubleArray().setIntegrityLevel(integrityLevel);
         setArrayProperties(object, array, length, usedLength, indexOffset, arrayOffset);
         arraySetHoleCount(object, holeCount);
-        assert holeCount == arrayType.countHoles(object);
+        assert arrayType.assertHoleCount(object);
         return arrayType;
     }
 
@@ -143,11 +143,6 @@ public AbstractDoubleArray toNonHoles(JSDynamicObject object, long index, Object
         return newArray;
     }
 
-    @Override
-    protected void incrementHolesCount(JSDynamicObject object, int offset) {
-        arraySetHoleCount(object, arrayGetHoleCount(object) + offset);
-    }
-
     @Override
     public boolean isSupported(JSDynamicObject object, long index) {
         return isSupportedHoles(object, index);
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/HolesIntArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/HolesIntArray.java
@@ -65,7 +65,7 @@ public static HolesIntArray makeHolesIntArray(JSDynamicObject object, int length
         HolesIntArray arrayType = createHolesIntArray().setIntegrityLevel(integrityLevel);
         setArrayProperties(object, array, length, usedLength, indexOffset, arrayOffset);
         arraySetHoleCount(object, holeCount);
-        assert holeCount == arrayType.countHoles(object) : String.format("holeCount, %d, differs from the actual count, %d", holeCount, arrayType.countHoles(object));
+        assert arrayType.assertHoleCount(object);
         return arrayType;
     }
 
@@ -161,11 +161,6 @@ public Object getInBoundsFast(JSDynamicObject object, int index) {
         return value;
     }
 
-    @Override
-    protected void incrementHolesCount(JSDynamicObject object, int offset) {
-        arraySetHoleCount(object, arrayGetHoleCount(object) + offset);
-    }
-
     @Override
     public HolesIntArray toHoles(JSDynamicObject object, long index, Object value) {
         return this;
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/HolesJSObjectArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/HolesJSObjectArray.java
@@ -65,7 +65,7 @@ public static HolesJSObjectArray makeHolesJSObjectArray(JSDynamicObject object,
         HolesJSObjectArray arrayType = createHolesJSObjectArray().setIntegrityLevel(integrityLevel);
         setArrayProperties(object, array, length, usedLength, indexOffset, arrayOffset);
         arraySetHoleCount(object, holeCount);
-        assert holeCount == arrayType.countHoles(object);
+        assert arrayType.assertHoleCount(object);
         return arrayType;
     }
 
@@ -154,11 +154,6 @@ public AbstractWritableArray toObject(JSDynamicObject object, long index, Object
         return newArray;
     }
 
-    @Override
-    protected void incrementHolesCount(JSDynamicObject object, int offset) {
-        arraySetHoleCount(object, arrayGetHoleCount(object) + offset);
-    }
-
     @Override
     public int prepareInBounds(JSDynamicObject object, int index, Node node, SetSupportedProfileAccess profile) {
         return prepareInBoundsHoles(object, index, node, profile);
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/HolesObjectArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/HolesObjectArray.java
@@ -64,7 +64,7 @@ public static HolesObjectArray makeHolesObjectArray(JSDynamicObject object, int
         HolesObjectArray arrayType = createHolesObjectArray().setIntegrityLevel(integrityLevel);
         setArrayProperties(object, array, length, usedLength, indexOffset, arrayOffset);
         arraySetHoleCount(object, holeCount);
-        assert holeCount == arrayType.countHoles(object) : String.format("holeCount, %d, differs from the actual count, %d", holeCount, arrayType.countHoles(object));
+        assert arrayType.assertHoleCount(object);
         return arrayType;
     }
 
@@ -136,11 +136,6 @@ public AbstractObjectArray toNonHoles(JSDynamicObject object, long index, Object
         return newArray;
     }
 
-    @Override
-    protected void incrementHolesCount(JSDynamicObject object, int offset) {
-        arraySetHoleCount(object, arrayGetHoleCount(object) + offset);
-    }
-
     @Override
     public int prepareInBounds(JSDynamicObject object, int index, Node node, SetSupportedProfileAccess profile) {
         return prepareInBoundsHoles(object, index, node, profile);
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/ZeroBasedJSObjectArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/ZeroBasedJSObjectArray.java
@@ -178,7 +178,9 @@ public ScriptArray removeRangeImpl(JSDynamicObject object, long start, long end)
     public ScriptArray shiftRangeImpl(JSDynamicObject object, long from) {
         int usedLength = getUsedLength(object);
         if (from < usedLength) {
-            return ContiguousJSObjectArray.makeContiguousJSObjectArray(object, lengthInt(object) - from, getArray(object), -from, (int) from, (int) (usedLength - from), integrityLevel);
+            JSDynamicObject[] array = getArray(object);
+            Arrays.fill(array, 0, (int) from, null);
+            return ContiguousJSObjectArray.makeContiguousJSObjectArray(object, lengthInt(object) - from, array, -from, (int) from, (int) (usedLength - from), integrityLevel);
         } else {
             return removeRangeImpl(object, 0, from);
         }
diff --git a/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/ZeroBasedObjectArray.java b/graal-js/src/com.oracle.truffle.js/src/com/oracle/truffle/js/runtime/array/dyn/ZeroBasedObjectArray.java
@@ -167,7 +167,9 @@ public ScriptArray removeRangeImpl(JSDynamicObject object, long start, long end)
     public ScriptArray shiftRangeImpl(JSDynamicObject object, long from) {
         int usedLength = getUsedLength(object);
         if (from < usedLength) {
-            return ContiguousObjectArray.makeContiguousObjectArray(object, lengthInt(object) - from, getArray(object), -from, (int) from, (int) (usedLength - from), integrityLevel);
+            Object[] array = getArray(object);
+            Arrays.fill(array, 0, (int) from, null);
+            return ContiguousObjectArray.makeContiguousObjectArray(object, lengthInt(object) - from, array, -from, (int) from, (int) (usedLength - from), integrityLevel);
         } else {
             return removeRangeImpl(object, 0, from);
         }

Original file line number	Diff line number	Diff line change
`@@ -141,6 +141,7 @@ protected final void fillHoles(JSDynamicObject object, int internalIndex, int gr`
`141`	`141`	`if (grown != 0) {`
`142`	`142`	`incrementHolesCount(object, Math.abs(grown) - 1);`
`143`	`143`	`}`
	`144`	`+ assert checkFillHoles(object, internalIndex, grown);`
`144`	`145`	`}`
`145`	`146`
`146`	`147`	`@Override`
Original file line number	Diff line number	Diff line change
`@@ -143,6 +143,7 @@ protected final void fillHoles(JSDynamicObject object, int internalIndex, int gr`
`143`	`143`	`if (grown != 0) {`
`144`	`144`	`incrementHolesCount(object, Math.abs(grown) - 1);`
`145`	`145`	`}`
	`146`	`+ assert checkFillHoles(object, internalIndex, grown);`
`146`	`147`	`}`
`147`	`148`
`148`	`149`	`@Override`
Original file line number	Diff line number	Diff line change
`@@ -53,6 +53,7 @@ public static ContiguousJSObjectArray makeContiguousJSObjectArray(JSDynamicObjec`
`53`	`53`	`int integrityLevel) {`
`54`	`54`	`ContiguousJSObjectArray arrayType = createContiguousJSObjectArray().setIntegrityLevel(integrityLevel);`
`55`	`55`	`setArrayProperties(object, array, length, usedLength, indexOffset, arrayOffset);`
	`56`	`+ assert unusedElementsAreHoles(array, arrayOffset, usedLength);`
`56`	`57`	`return arrayType;`
`57`	`58`	`}`
`58`	`59`
Original file line number	Diff line number	Diff line change
`@@ -52,6 +52,7 @@ public final class ContiguousObjectArray extends AbstractContiguousObjectArray {`
`52`	`52`	`public static ContiguousObjectArray makeContiguousObjectArray(JSDynamicObject object, long length, Object[] array, long indexOffset, int arrayOffset, int usedLength, int integrityLevel) {`
`53`	`53`	`ContiguousObjectArray arrayType = createContiguousObjectArray().setIntegrityLevel(integrityLevel);`
`54`	`54`	`setArrayProperties(object, array, length, usedLength, indexOffset, arrayOffset);`
	`55`	`+ assert unusedElementsAreHoles(array, arrayOffset, usedLength);`
`55`	`56`	`return arrayType;`
`56`	`57`	`}`
`57`	`58`