[Webkit-unassigned] [Bug 244190] New: JSC DFG Number.prototype.toString should throw an exception when the parameter is undefined, null or true

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=244190

            Bug ID: 244190
           Summary: JSC DFG Number.prototype.toString should throw an
                    exception when the parameter is undefined, null or
                    true
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: entryhii at gmail.com

function foo(a) {
  try {
    print(Number.prototype.toString.call(a))
  } catch (e) {
    print("error")
  }
}
noInline(foo);
for (var i = 0; i < 200; i++) {
  foo(10); 
  foo(true); //throw an exception
  //foo(null); // throw an exception
  //foo(undefined); // throw an exception
}



With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=1

In interpreter, Number.prototype.toString throw an exception. However, in JIT, Number.prototype.toString does not throw an exception.

DFG JIT uses DoubleRep node to ensure that the parameter of Number.prototype.toString is a number, if not, OSRExit should occur.
However, undefined, null and true can pass the check of the DoubleRep node, no OSRExit occurs. These parameters are passed to toString, no exception is thrown.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220822/1d934dd8/attachment-0001.htm>