During differential testing of webkit I found a sample triggering a miscomputation in FTL related to using Date in a negative integer context. The sample is invoked as: WebKitBuild/Release/bin/jsc --validateOptions=true --useConcurrentJIT=false --useConcurrentGC=false --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --useFTLJIT=true sample.js function main() { let v1 = 0; while (v1++ < 9) { } let v19 = 0; let v45; do { function v22() { "a".charCodeAt(undefined); const v44 = new Date(123); v45 = -v44; for (let v49 = -4096; v49 < 100; v49++) { } } v22(); } while (v19++ < 7); print(v45); // -123 without FTL, NaN with FTL (also -123 in spidermonkey) } main();
Created attachment 443329 [details] Patch
Comment on attachment 443329 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=443329&action=review > JSTests/ChangeLog:8 > + * stress/negate-prfer-number-to-primitive.js: Added. (nit) filename typo: "prefer"
Created attachment 443330 [details] patch for landing
Committed r285406 (243963@main): <https://commits.webkit.org/243963@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 443330 [details].
<rdar://problem/85157764>