Bug 265978 - Error Object has different properties in jitPolicyScale 0 and 1
Summary: Error Object has different properties in jitPolicyScale 0 and 1
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: PC All
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2023-12-06 18:41 PST by EntryHi
Modified: 2023-12-13 18:42 PST (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description EntryHi 2023-12-06 18:41:44 PST
==================test.js====
let v1 = -2;
for (let v2 = 0; v2 < 100; v2++) {
  const v3 = v2 >= v1;
  let v11 = -169593.17232040048;
  const v12 = Error >>> v1;
  Math.acosh(Error);
  const v15 = --v11;
  Error & 2692910114;
  const v19 = new Uint8ClampedArray(10);
  v19[8] = 10106;
  for (const v20 in Error) {
    v20.length = 10106;
    Error[v20] >>= v3;
  }
  function f33(a34, a35) {
    a34[v1] = v3;
    v19[Error] = v19;
  }
}
for (let v42 = 0; v42 < 100; v42++) {
  const v54 = new Error();
  print(Object.getOwnPropertyNames(v54))
} 
=============================


Run args: 
./jsc -f test.js --useConcurrentJIT=0 --jitPolicyScale=0
./jsc -f test.js --useConcurrentJIT=0 --jitPolicyScale=1

When jitPolicyScale is 0, Error Object has properties like 'line', 'column', 'sourceURL' and 'stack'. 
But when jitPolicyScale is 1, Error Object has no properties.
Comment 1 Radar WebKit Bug Importer 2023-12-13 18:42:13 PST
<rdar://problem/119642028>