| Summary: | Iterator does not throw an exception when it is non-object in baselineJIT | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | vettalyray |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW --- | ||
| Severity: | Normal | CC: | mark.lam, webkit-bug-importer, ysuzuki |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Local Build | ||
| Hardware: | All | ||
| OS: | All | ||
I can reproduce on macOS (13.4 beta). Pull request: https://github.com/WebKit/WebKit/pull/29634 |
===========test.js=========== for (let i = 0; i < 50; i++) { try { const arr = [100, 101]; arr[Symbol.iterator] = Symbol; [] = arr; print("hello") } catch (e) {} } =========end of test.js====== Run args: ./jsc test.js --useConcurrentJIT=0 --jitPolicyScale=0 JSC wrongly print "hello" in baselineJIT instead of throwing an exception.