[Webkit-unassigned] [Bug 244193] New: JSC DFG Int8Array constructor should throw an exception when the parameter is illegal.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=244193

            Bug ID: 244193
           Summary: JSC DFG Int8Array constructor should throw an
                    exception when the parameter is illegal.
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: entryhii at gmail.com

let counta = 0
let countb = 0

function ftlFunction(callee) {
  callee("hello"); 
  counta++
}

ftlFunction(Math.abs);

for (var i = 0; i < 1000; ++i) {
  try {
    ftlFunction(Int8Array);
  } catch (e) {
    countb++
  }
}
print(counta, countb)

With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=1

Int8Array("hello") should throw an exception. But in JIT, it does not throw an exception.
The problem is in DFGBytecodeParser, the bytecode call is directly inlined as NewTypedArray node. In this way, Int8Array("hello") generate a typedArray instead of throwing an exception.

The execution trace is handleCall -> handleInlining -> handleCallVariant -> handleConstantInternalFunction -> handleTypedArrayConstructor in DFGByteCodeParser.cpp.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220822/8c46e33a/attachment.htm>