Bug 233353 - [JSC] Optimize Promise Error in DFG
Summary: [JSC] Optimize Promise Error in DFG
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-11-18 23:13 PST by zhiyi
Modified: 2021-11-25 23:14 PST (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description zhiyi 2021-11-18 23:13:28 PST
OS: ubuntu20.04
Architecture: <x64>

./jsc --useConcurrentJIT=false --thresholdForOptimizeAfterWarmUp=50 bug.js

expected output
undefined
undefined

actual output
undefined
NaN


bug.js
##################################
function opt() {
    const v1 = [Infinity];
    const v2 = v1[4096];
    new Promise(Promise);
    return v2;

}
print(opt());
for (let i = 0; i < 0x1000; i++) { opt(); }
print(opt());
Comment 1 Radar WebKit Bug Importer 2021-11-25 23:14:24 PST
<rdar://problem/85760649>