[Webkit-unassigned] [Bug 245464] New: Strength reduction analyzes RegEx.exec incorrectly and generate a hole for the result array

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=245464

            Bug ID: 245464
           Summary: Strength reduction analyzes RegEx.exec incorrectly and
                    generate a hole for the result array
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: entryhii at gmail.com

function write() {
  let m = /ab(c)?d/.exec("abd")
  return m
}
noInline(write)

let all = []
for(let i=0;i<300;i++){
  all.push(write())
}

let a = all[50]
let b = all[100]
print(Object.keys(a),a.length, describe(a))
print(Object.keys(b),b.length, describe(b))

With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0

Variable a is the result for interpreter while b is the result for JIT. a.length == b.length, but Object.keys(a) != Object.keys(b).
There is a hole in b. This may be caused by strength reduction in DFG JIT.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220921/7d0a3e14/attachment.htm>