[Webkit-unassigned] [Bug 135338] New: IOS - Math.abs generate random numbers when we have JIT

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=135338

           Summary: IOS - Math.abs generate random numbers when we have
                    JIT
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: iOS
        OS/Version: iOS 7.0
            Status: NEW
          Severity: Major
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: kileras at gmail.com


This may be already reported but I don't seem to be able to find it but basically when we have JIT and we use Math.abs in some contexts it produces random numbers. The original case was in a much larger codebase but I reduce it to this one, it may not be exactly the same issue  but it is in the same area at least.

Example code

Number.prototype.abs = function() {
        return Math['abs'].call(Math, this);
};

for (var i = 0; i < 100; i++) {
        document.write(i.abs() + ' ');
}

Expected behaviour:

Print number from 0 to 99 in the page.

Current behaviour

It prints all the numbers all right until 73, after that iOS devices start to generate large numbers like 312604592 instead of 74. They appear to follow some kind of pattern.

Other platforms

The only platform where this happens is iOS, the rest of the browsers, including Safari on desktop, doesn't have this problem at all. This problem goes away is you attach a debugger, change the prototype to a global method or use dot notation when calling abs for example.

I attached an html file with that example plus a few others I tried, some of them working some not.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.