Differential Testing: Different output during v.test(...) with custom valueOf func

[Wonyoung Jung]

Created attachment 461069 [details]
testcase for reproduce

Attached testcase prints different result depending on whether JIT is enabled/disabled.
I'm not sure this case is a bug. Can you please check it out?



- Tested version: WebKit-7614.1.16.11.3
- Steps to reproduce:
  - with JIT: `jsc --validateOptions=true --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true test.js`
  - without JIT: `jsc --validateOptions=true --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --useJIT=false --useBaselineJIT=false ~/test.js`



- Actual results:
  - with JIT: 
    - v8 increased, but not 10000 (in many cases v8 < 1000)
  - without JIT: 
    - v8 increased, prints 10000

[Radar WebKit Bug Importer]

<rdar://problem/97354388>

[David Degazio]

Created attachment 461847 [details]
Patch

[Saam Barati]

Comment on attachment 461847 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=461847&action=review

> Source/JavaScriptCore/runtime/RegExpObjectInlines.h:107
> +    unsigned lastIndex = getRegExpObjectLastIndexAsUnsigned(globalObject, this, input);

We need to check the exception here like before

[Yusuke Suzuki]

Comment on attachment 461847 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=461847&action=review

> Source/JavaScriptCore/runtime/RegExpObjectInlines.h:113
>      RETURN_IF_EXCEPTION(scope, { });

Need to move this exception check.

[David Degazio]

Created attachment 461849 [details]
Patch

[Mark Lam]

This is not a security bug.  Also, David, please submit your patch via a PR on GitHub.

[David Degazio]

Pull request: https://github.com/WebKit/WebKit/pull/3639

[EWS]

Committed 253766@main (6427225efff7): <https://commits.webkit.org/253766@main>

Reviewed commits have been landed. Closing PR #3639 and removing active labels.