[Webkit-unassigned] [Bug 256663] DFG: toString() returns a function instead of a string

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=256663

--- Comment #8 from emile at caido.io ---
Yeah I was reading https://webkit.org/blog/6411/javascriptcore-csi-a-crash-site-investigation-story/ and https://webkit.org/blog/3362/introducing-the-webkit-ftl-jit/

I will try to create a smaller reproduction, because even with bisect it will be annoying to test. I will need to check how DFG considers a path hot, since we adding some logging around the toString call and it fails on the first runtime call.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20230515/f406d0da/attachment.htm>