[Webkit-unassigned] [Bug 255512] New: Node CallStringConstructor should throw an exception when the parameter is a Symbol
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Mon Apr 17 04:56:29 PDT 2023
https://bugs.webkit.org/show_bug.cgi?id=255512
Bug ID: 255512
Summary: Node CallStringConstructor should throw an exception
when the parameter is a Symbol
Product: WebKit
Version: WebKit Local Build
Hardware: PC
OS: Linux
Status: NEW
Severity: Normal
Priority: P2
Component: JavaScriptCore
Assignee: webkit-unassigned at lists.webkit.org
Reporter: entryhii at gmail.com
*********************
function f1(a2,a3) {
const v5 = new String(a3);
print(v5)
return String;
}
const v8 = new Proxy(String, {"get": f1});
try {
v8["split"](v8);
} catch (e12) {}
*********************
With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0
In LLInt(executing the above script with --jitPolicyScale=1), JSC throws an exception (symbol cannot convert into string), but in JIT, JSC doesn't throw any exception.
The problem may be in Node CallStringConstructor. When the parameter is a Symbol, DFG invoke asSymbol(argument)->descriptiveString instead of throwing an exception.
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230417/36737c5e/attachment.htm>
More information about the webkit-unassigned
mailing list