Bug 291362 – [JSC] Type checking error after JIT optimization

• Component: JavaScriptCore
• Status: RESOLVED FIXED

JSC version: db9a79327d8d35b77cb07ee2afbe11c4761bcc56

Test case:
function opt() {
    const v1 = Object.getPrototypeOf('').toString;      
    try {
        v1.call()                  
        return 0
    } catch (e) {
        return e
    }
}
print(opt())
for (let i = 0; i < 10; i++) { 
    print(opt()); 
}

Run args: ./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0 

Expected: 
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error

Result:
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
TypeError: Type error
0
0
0
0

[Radar WebKit Bug Importer]

<rdar://problem/149470479>

[Yusuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/44309

[Yusuke Suzuki]

*** Bug 288817 has been marked as a duplicate of this bug. ***

[EntryHi]

Hello, I noticed that Bug 288817 is reported earlier than bug 291362. Why is bug 288817 duplicate?

[Yusuke Suzuki]

@EntryHi Hi! This is just because this bug is handled first and I found that old bug was dupe of this.

[EWS]

Committed 293973@main (472bc719b29b): <https://commits.webkit.org/293973@main>

Reviewed commits have been landed. Closing PR #44309 and removing active labels.

[Yusuke Suzuki]

*** Bug 288815 has been marked as a duplicate of this bug. ***

[Yusuke Suzuki]

*** Bug 284615 has been marked as a duplicate of this bug. ***