Bug 296316 – Abstract Interpreter incorrectly optimizes CompareLess into Constant False when two oprands are Symbol.

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[EntryHi]

Hello, I found a bug in JavaScriptCore (commit id: 101f7c7836eaa3e6c56d8a6fe1d8812efbb8959f).
This bug is similar to https://bugs.webkit.org/show_bug.cgi?id=296270 which has been fixed.

PoC.js
```
try {
  const x = Symbol();
  for (let i = 0; i < 70; i++) {
    x.__proto__;
  }
  x < x;
} catch (e) {
  print(e)
}
```

Reproduce:
./jsc --useConcurrentJIT=0 --jitPolicyScale=0  PoC.js

Expected Result:
JSC should throw an exception: TypeError: Cannot convert a symbol to a number.

Actual Result:
JSC does not throw any exception.


Abstract Interpreter incorrectly converts CompareLess into Constant False in Constant Folding Optimization.

[Sosuke Suzuki]

Pull request: https://github.com/WebKit/WebKit/pull/48571

[EWS]

Committed 297910@main (71cedad38d10): <https://commits.webkit.org/297910@main>

Reviewed commits have been landed. Closing PR #48571 and removing active labels.

[Radar WebKit Bug Importer]

<rdar://problem/156876784>