Bug 245462 – JSC DFG Number.prototype.toString does not throw an exception when the parameter is Object

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

[EntryHi]

let counta = 0, countb = 0

function foo(arg2) {
    try {
        Number.prototype.toString.call(arg2)
        counta++
    } catch (e) {
        countb++
    }
}

for (let i = 0; i < 1000; i++) {
    foo({});
    foo(i);
}
print(counta, countb)


With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0

The correct value for counta should be 500, but actually it is not. In DFGBytecodeParser, NumberProtoFuncToString is converted to ToString. Thus, it does not throw an exception for Number.prototype.toString when the parameter is Object.

[Alexey Proskuryakov]

*** This bug has been marked as a duplicate of bug 245463 ***