Bug 290838
| Summary: | [JSC]less than operator should call valueOf in JIT compiler | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | GuY <q602706150> |
| Component: | New Bugs | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Local Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
GuY
tested in the latest main branch: 678e1944c13ad5b3409988175a1f340118b35e94 (HEAD -> main)
poc:
let count = 0
class A {
valueOf() {
count++
}
}
const a = new A();
function test() {
a < a;
}
for (let i = 0; i < 100; i++) {
test();
}
print(count)
run argument:
./WebKitBuild/JSCOnly/Debug/bin/jsc --useConcurrentJIT=0 --forceWeakRandomSeed=1 --jitPolicyScale=0.001 test2.js
expected output:
200
actual output:
2
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/148813062>
Brenden Forward
Pull request: https://github.com/webkit/webkit/pull/45506
EWS
Committed 295032@main (e936f3ef6404): <https://commits.webkit.org/295032@main>
Reviewed commits have been landed. Closing PR #45506 and removing active labels.