[Webkit-unassigned] [Bug 244191] New: [DFG] Usekind of input is lifted before print function

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=244191

            Bug ID: 244191
           Summary: [DFG] Usekind of input is lifted before print function
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: sunyue20z at ict.ac.cn

path/to/jsc test.js --useConcurrentJIT=0 --forceWeakRandomSeed=1 --useFTLJIT=0 --jitPolicyScale=0
path/to/jsc test.js --useConcurrentJIT=0 --forceWeakRandomSeed=1 --jitPolicyScale=0.01

function bar(a, b) {
    try {
      return a;
    } finally {
      print(b)
      b--;
    }

    a /= b;
  }

  function test_context() {
    function foo(x) {
      return 42;
    }

    var s, t;

    for (var i = 0; i < 10; i++) {
      bar(t = foo(i) ? bar(42 + i - i) : bar(0), s = i + t);
    }

    return s;
  }

  test_context();

We ran the script with command line options above. In function bar(), variable b have a arithsub after print function. It would have problem if b is undefined, since Low Level Interpreter would first print "undefined" then sub 1 to get NaN, while DFG would transfer undefined to number and print "NaN".

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220822/f7af3698/attachment.htm>