Bug 256941

Summary: Function.prototype.caller gives different values
Product: WebKit Reporter: YuHao Hu <q602706150>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal CC: mark.lam, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
poc none

Description YuHao Hu 2023-05-17 19:24:26 PDT
Created attachment 466392 [details]
poc

run with:
./WebKitBuild/Debug/bin/jsc --useConcurrentJIT=0 --jitPolicyScale=0.001 poc.js

output:
```
true false false // for loop i = 0
false true false // for loop i = 1
false false true // main
```

the opt function was called 3 times. It was called from `a.valueOf` two times, and the 1st time JSC says caller is null, while the 2nd time JSC says caller is `opt`.
Comment 1 Radar WebKit Bug Importer 2023-05-24 19:25:16 PDT
<rdar://problem/109808960>