Bug 239757 – Wrong JIT compilation

• Status: NEW
• Component: JavaScriptCore

Created attachment 458332 [details]
the minimal poc

The following PoC outputs differently before/after JIT compilation.

function opt() {
	const a = [12345678901];
	const b = a[12345];
	const c = () => {
    		try {
        		throw "";
    		} catch(e) {
        		({});
    		}
	};
	const d = c();
	return b;
}

print(opt());//undefined
for(var i=0;i<10000;i++){
	opt();
}
print(opt());//NaN

[Radar WebKit Bug Importer]

<rdar://problem/92652058>