During differential testing of webkit I found a sample triggering a miscomputation related to super.__proto__ field. Depending on optimization level the value unexpectedly becomes "null". The sample is invoked as: WebKitBuild/Release/bin/jsc --validateOptions=true --useConcurrentJIT=false --useConcurrentGC=false --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --useFTLJIT=true sample.js Changing --useFTLJIT=true to false changes the output. function main() { let v41; v37 = class V37 { constructor() { v41 = super.__proto__; } }; for (let v70 = 0; v70 < 100; v70++) { // decreasing the loop count to other values, e.g. 20 changes the behavior new v37(); } print(v41); // outputs [object Object] or null, depending on --useFTLJIT=true/false } noDFG(main); noFTL(main); main();
<rdar://problem/82787527>
Our IntrinsicGetter IC is using the wrong structure
(In reply to Saam Barati from comment #2) > Our IntrinsicGetter IC is using the wrong structure This is wrong. It's using the wrong |this| for the "getter" access.
Created attachment 439938 [details] patch
Created attachment 439956 [details] patch
Comment on attachment 439956 [details] patch r=me
Committed r283512 (242480@main): <https://commits.webkit.org/242480@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 439956 [details].