[Webkit-unassigned] [Bug 233596] New: OSR exit loop for InBounds HasIndexedProperty that exits because of holes

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=233596

            Bug ID: 233596
           Summary: OSR exit loop for InBounds HasIndexedProperty that
                    exits because of holes
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: sbarati at apple.com

Something like this is an exit loop in "func":

function test1() {
    function func(o) {
        return 0 in o;
    }
    noInline(func);

    let o = {__proto__:[0, 1]};
    o[2] = 4;

    for (let i = 0; i < 10000; ++i) {
        func(o);
    }
    assert(func(true, o));
}
test1();

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20211129/b98a6ccb/attachment.htm>