[Webkit-unassigned] [Bug 280576] New: Object.assign doesn't handle modified self-assignment properly

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=280576

            Bug ID: 280576
           Summary: Object.assign doesn't handle modified self-assignment
                    properly
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: q602706150 at gmail.com

```
for (let i = 0; i < 5; i++) {
  function CLS(value) {
    this.prop = value;
  }
  const a = new CLS(5);
  const b = new CLS(6);
  Object.assign(a, b, a);
  print(a.prop)
}
```
run args:
./WebKitBuild/JSCOnly/Debug/bin/jsc test.js --useConcurrentJIT=0

actual output:
6
6
5
5
5

tested in the latest webkit main branch 81b0097021b1003a3942a1b470bf750a846e3b45

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240929/b762f535/attachment.htm>