WebKit Bugzilla
New
Browse
Search+
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
NEW
244183
In JSC DFGBytecodeParser, PowIntrinsic does not throw exception when the only parameter is a Symbol
https://bugs.webkit.org/show_bug.cgi?id=244183
Summary
In JSC DFGBytecodeParser, PowIntrinsic does not throw exception when the onl...
EntryHi
Reported
2022-08-22 01:14:24 PDT
function shouldThrow(func) { try { func(); } catch (e) { print("error") } } function foo(value) { return Math.pow(value); } noInline(foo); for (var i = 0; i < 10; ++i) { print(foo(10)) } shouldThrow(() => {foo(Symbol("Cocoa"))}); With the above script as input to JSC, run JSC with the following parameters: ./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0 Pow(Symbol("Cocoa")) should throw an exception. In interpreter(executing the above script with --jitPolicyScale=1), JSC throws an exception, but in JIT, JSC doesn't throw an exception. The problem is in the process of compiling bytecode into DFG node. In DFGBytecodeParser, Math.pow will be inlined into ArithPow node. If pow has less than 2 parameters, constantNaN will be directly introduced as the result of pow, but introducing this NaN makes JIT ignore exceptions caused by parameters. When the parameter is Symbol, the above problem exists, and the following script will trigger the same problem. var o = { toString: function () { return {}; } }; function bar(b) { return b } noInline(bar) function foo(a) { try { print(bar(Math.pow(a))) } catch (e) { print("error") } } noInline(foo); for (var i = 0; i < 10; i++) { foo({}); foo("hello"); } foo(o);
Attachments
Add attachment
proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1
2022-08-29 01:15:17 PDT
<
rdar://problem/99266554
>
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug