[Webkit-unassigned] [Bug 68141] New: [n]stricteq code is bogus in JSValue32_64 JIT

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=68141

           Summary: [n]stricteq code is bogus in JSValue32_64 JIT
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: barraclough at apple.com


The code tries to check for both ints or cells, but this check also catches cases where values that are undefined, null, etc (probably was incorrectly assuming cell was the 2nd highest tag?).
Also, there is no need not to handle int on the fast path.
stricteq is just a case of comparing the payloads, if we:

* handle cases of differing tags on a slow path
* handle doubles a slow path
* handle both-are-string on a slow path

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.