Bug 288815 – JavaScriptCore generates wrong result in type conversion.

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: JavaScriptCore

[EntryHi]

Hello, I found a bug in JSC.

==============poc.js==============
var ab = new ArrayBuffer(8);
var array_i = new Int32Array(ab);
array_i[0] = 0
array_i[1] = -1

var array_f = new Float64Array(ab);
var array_d = new Float64Array(1);
function opt_store() {
  array_d[0] = array_f[0];
}
opt_store();
opt_store();
var i32 = new Int32Array(array_d.buffer);
print(i32[1])
================================


Step 1: ./jsc poc.js --useConcurrentJIT=0  --jitPolicyScale=0
Step 2: ./jsc poc.js --useConcurrentJIT=0  --jitPolicyScale=0.1

Result of Step 1: -1
Result of Step 2: 2146959360

[Radar WebKit Bug Importer]

<rdar://problem/146457747>

[Yusuke Suzuki]

Fixed in bug 291362, thanks!

*** This bug has been marked as a duplicate of bug 291362 ***