Bug 288817 – String.prototype.toString make different results in JavaScriptCore again.

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

[EntryHi]

Hello, I found a bug in JSC.

================poc.js=====================
function shouldThrow(func, errorMessage) {
  try {
    func();
  } catch (e) {
    print(String.prototype.toString.call(errorMessage));
  }
}
for (var i = 0; i < 5; ++i) {
  shouldThrow(shouldThrow, i.toString());
}
=========================================

Step 1: ./jsc poc.js --useConcurrentJIT=0  --jitPolicyScale=0
Step 2: ./jsc poc.js --useConcurrentJIT=0  --jitPolicyScale=1

Result of Step 1: 
0
undefined
undefined
undefined
undefined


Result of Step 2:
0
1
2
3
4

[Radar WebKit Bug Importer]

<rdar://problem/146458437>

[Yusuke Suzuki]

Thanks! will be fixed in bug 291362

[Yusuke Suzuki]

*** This bug has been marked as a duplicate of bug 291362 ***

[EntryHi]

Hello, I noticed that my bug is reported earlier than bug 291362. Why is my bug duplicate?