Bug 233596 - OSR exit loop for InBounds HasIndexedProperty that exits because of holes
Summary: OSR exit loop for InBounds HasIndexedProperty that exits because of holes
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-11-29 14:11 PST by Saam Barati
Modified: 2021-12-08 01:27 PST (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2021-11-29 14:11:39 PST
Something like this is an exit loop in "func":

function test1() {
    function func(o) {
        return 0 in o;
    }
    noInline(func);

    let o = {__proto__:[0, 1]};
    o[2] = 4;

    for (let i = 0; i < 10000; ++i) {
        func(o);
    }
    assert(func(true, o));
}
test1();
Comment 1 Radar WebKit Bug Importer 2021-12-06 14:12:21 PST
<rdar://problem/86122947>