233353 2021-11-18 23:13:28 -0800 [JSC] Optimize Promise Error in DFG 2021-11-25 23:14:24 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 1 vulbugs webkit-unassigned vulbugs webkit-bug-importer oldest_to_newest 1816760 0 vulbugs 2021-11-18 23:13:28 -0800 OS: ubuntu20.04 Architecture: <x64> ./jsc --useConcurrentJIT=false --thresholdForOptimizeAfterWarmUp=50 bug.js expected output undefined undefined actual output undefined NaN bug.js ################################## function opt() { const v1 = [Infinity]; const v2 = v1[4096]; new Promise(Promise); return v2; } print(opt()); for (let i = 0; i < 0x1000; i++) { opt(); } print(opt()); 1817888 1 webkit-bug-importer 2021-11-25 23:14:24 -0800 <rdar://problem/85760649>