NEW244183
In JSC DFGBytecodeParser, PowIntrinsic does not throw exception when the only parameter is a Symbol
https://bugs.webkit.org/show_bug.cgi?id=244183
Summary In JSC DFGBytecodeParser, PowIntrinsic does not throw exception when the onl...
EntryHi
Reported 2022-08-22 01:14:24 PDT
function shouldThrow(func) { try { func(); } catch (e) { print("error") } } function foo(value) { return Math.pow(value); } noInline(foo); for (var i = 0; i < 10; ++i) { print(foo(10)) } shouldThrow(() => {foo(Symbol("Cocoa"))}); With the above script as input to JSC, run JSC with the following parameters: ./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0 Pow(Symbol("Cocoa")) should throw an exception. In interpreter(executing the above script with --jitPolicyScale=1), JSC throws an exception, but in JIT, JSC doesn't throw an exception. The problem is in the process of compiling bytecode into DFG node. In DFGBytecodeParser, Math.pow will be inlined into ArithPow node. If pow has less than 2 parameters, constantNaN will be directly introduced as the result of pow, but introducing this NaN makes JIT ignore exceptions caused by parameters. When the parameter is Symbol, the above problem exists, and the following script will trigger the same problem. var o = { toString: function () { return {}; } }; function bar(b) { return b } noInline(bar) function foo(a) { try { print(bar(Math.pow(a))) } catch (e) { print("error") } } noInline(foo); for (var i = 0; i < 10; i++) { foo({}); foo("hello"); } foo(o);
Attachments
Radar WebKit Bug Importer
Comment 1 2022-08-29 01:15:17 PDT
Note You need to log in before you can comment on or make changes to this bug.