[Webkit-unassigned] [Bug 251668] New: Differential Testing: Different output during loop in eval

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=251668

            Bug ID: 251668
           Summary: Differential Testing: Different output during loop in
                    eval
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: wonyoung.jung at kaist.ac.kr

Created attachment 464819

  --> https://bugs.webkit.org/attachment.cgi?id=464819&action=review

testcase for reproduce

Attached testcase prints different result depending on whether BaselineJIT is enabled/disabled.
I'm not sure this case is a bug. Can you please check it out?

- Tested version: WebKit-7615.1.18.8 (commit hash: b0db89e8f5e9d65a74fac732b3a90dc444ed3a42)
- Steps to reproduce:
  - with JIT: `jsc --validateOptions=true --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --forceWeakRandomSeed=true --forcedWeakRandomSeed=1 poc.js`
  - without BaselineJIT: `jsc --validateOptions=true --thresholdForJITSoon=10 --thresholdForJITAfterWarmUp=10 --thresholdForOptimizeAfterWarmUp=100 --thresholdForOptimizeAfterLongWarmUp=100 --thresholdForOptimizeSoon=100 --thresholdForFTLOptimizeAfterWarmUp=1000 --thresholdForFTLOptimizeSoon=1000 --validateBCE=true --forceWeakRandomSeed=true --forcedWeakRandomSeed=1 --useBaselineJIT=false poc.js`

- Actual results:
  - with JIT: 
    - prints "-1" 15 times 
  - without JIT: 
    - prints "-1" 16 times (or )


** changing N in `while (v1 < N) { ...` to 1, produces stdout randomly like:
- with JIT: "-1\n-1\nException: ReferenceError: Can't find variable: v0\nglobal code@" or "-1"
- without BaselineJIT: "-1"

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230203/b33f497c/attachment.htm>