[Webkit-unassigned] [Bug 265978] New: Error Object has different properties in jitPolicyScale 0 and 1

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=265978

            Bug ID: 265978
           Summary: Error Object has different properties in
                    jitPolicyScale 0 and 1
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: PC
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: entryhii at gmail.com

==================test.js====
let v1 = -2;
for (let v2 = 0; v2 < 100; v2++) {
  const v3 = v2 >= v1;
  let v11 = -169593.17232040048;
  const v12 = Error >>> v1;
  Math.acosh(Error);
  const v15 = --v11;
  Error & 2692910114;
  const v19 = new Uint8ClampedArray(10);
  v19[8] = 10106;
  for (const v20 in Error) {
    v20.length = 10106;
    Error[v20] >>= v3;
  }
  function f33(a34, a35) {
    a34[v1] = v3;
    v19[Error] = v19;
  }
}
for (let v42 = 0; v42 < 100; v42++) {
  const v54 = new Error();
  print(Object.getOwnPropertyNames(v54))
} 
=============================


Run args: 
./jsc -f test.js --useConcurrentJIT=0 --jitPolicyScale=0
./jsc -f test.js --useConcurrentJIT=0 --jitPolicyScale=1

When jitPolicyScale is 0, Error Object has properties like 'line', 'column', 'sourceURL' and 'stack'. 
But when jitPolicyScale is 1, Error Object has no properties.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20231207/c1ad36d7/attachment.htm>