Bug 288816
| Summary: | JavaScriptCore generates incorrect results in LogicAnd and LogicOr. | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | EntryHi <entryhii> |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | kirk, mark.lam, webkit-bug-importer, ysuzuki |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | PC | ||
| OS: | Linux | ||
EntryHi
Hello, I found a bug in JSC.
==============poc.js==============
function test(a) {
return a + 0x7fffffff + 1.1 & 0x7fffffff | a;
}
print(test(1));
================================
Step 1: ./jsc poc.js --useConcurrentJIT=0 --jitPolicyScale=0
Step 2: ./jsc poc.js --useConcurrentJIT=0 --jitPolicyScale=0.1
Result of Step 1: 3
Result of Step 2: 1
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/146458144>
Kirk Elliott
Pull request: https://github.com/WebKit/WebKit/pull/48312
Kirk Elliott
Pull request: https://github.com/dmvjs/WebKit/pull/1
Kirk Elliott
Pull request: https://github.com/WebKit/WebKit/pull/49156
Kirk Elliott
Pull request: https://github.com/WebKit/WebKit/pull/49772
Kirk Elliott
sorry for all the spam, this last one is hopefully the last one.