Bug 265978 – Error Object has different properties in jitPolicyScale 0 and 1

• Status: NEW
• Component: JavaScriptCore

[EntryHi]

==================test.js====
let v1 = -2;
for (let v2 = 0; v2 < 100; v2++) {
  const v3 = v2 >= v1;
  let v11 = -169593.17232040048;
  const v12 = Error >>> v1;
  Math.acosh(Error);
  const v15 = --v11;
  Error & 2692910114;
  const v19 = new Uint8ClampedArray(10);
  v19[8] = 10106;
  for (const v20 in Error) {
    v20.length = 10106;
    Error[v20] >>= v3;
  }
  function f33(a34, a35) {
    a34[v1] = v3;
    v19[Error] = v19;
  }
}
for (let v42 = 0; v42 < 100; v42++) {
  const v54 = new Error();
  print(Object.getOwnPropertyNames(v54))
} 
=============================


Run args: 
./jsc -f test.js --useConcurrentJIT=0 --jitPolicyScale=0
./jsc -f test.js --useConcurrentJIT=0 --jitPolicyScale=1

When jitPolicyScale is 0, Error Object has properties like 'line', 'column', 'sourceURL' and 'stack'. 
But when jitPolicyScale is 1, Error Object has no properties.

[Radar WebKit Bug Importer]

<rdar://problem/119642028>