296316 2025-07-22 00:26:03 -0700 Abstract Interpreter incorrectly optimizes CompareLess into Constant False when two oprands are Symbol. 2025-07-27 19:39:13 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build PC Linux RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=296270 InRadar P2 Normal --- 1 entryhii sosuke syg webkit-bug-importer ysuzuki oldest_to_newest 2131791 0 entryhii 2025-07-22 00:26:03 -0700 Hello, I found a bug in JavaScriptCore (commit id: 101f7c7836eaa3e6c56d8a6fe1d8812efbb8959f). This bug is similar to https://bugs.webkit.org/show_bug.cgi?id=296270 which has been fixed. PoC.js ``` try { const x = Symbol(); for (let i = 0; i < 70; i++) { x.__proto__; } x < x; } catch (e) { print(e) } ``` Reproduce: ./jsc --useConcurrentJIT=0 --jitPolicyScale=0 PoC.js Expected Result: JSC should throw an exception: TypeError: Cannot convert a symbol to a number. Actual Result: JSC does not throw any exception. Abstract Interpreter incorrectly converts CompareLess into Constant False in Constant Folding Optimization. 2132732 1 sosuke 2025-07-27 09:46:09 -0700 Pull request: https://github.com/WebKit/WebKit/pull/48571 2132775 2 ews-feeder 2025-07-27 19:38:50 -0700 Committed 297910@main (71cedad38d10): <https://commits.webkit.org/297910@main> Reviewed commits have been landed. Closing PR #48571 and removing active labels. 2132776 3 webkit-bug-importer 2025-07-27 19:39:13 -0700 <rdar://problem/156876784>