1891701 - Incorrect optimization inserts additional value to Object["getOwnPropertyNames"]

Status: RESOLVED INVALID

(Core :: JavaScript Engine: JIT, defect)

Description

[m.foley20]

Attachment: minimal_bug.js

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0) Gecko/20100101 Firefox/124.0

Steps to reproduce:

./dist/bin/js minimal_bug.js

Actual results:

valueOf65535,assign,getPrototypeOf,setPrototypeOf,getOwnPropertyDescriptor,getOwnPropertyDescriptors,keys,values,entries,is,defineProperty,defineProperties,create,undefined,getOwnPropertySymbols,isExtensible,preventExtensions,freeze,isFrozen,seal,isSealed,fromEntries,hasOwn,groupBy,prototype,length,namesymbolgetOwnPropertyNamesnumber65535,assign,getPrototypeOf,setPrototypeOf,getOwnPropertyDescriptor,getOwnPropertyDescriptors,keys,values,entries,is,defineProperty,defineProperties,create,getOwnPropertyNames,getOwnPropertySymbols,isExtensible,preventExtensions,freeze,isFrozen,seal,isSealed,fromEntries,hasOwn,groupBy,prototype,length,name,-∞2

Expected results:

valueOfassign,getPrototypeOf,setPrototypeOf,getOwnPropertyDescriptor,getOwnPropertyDescriptors,keys,values,entries,is,defineProperty,defineProperties,create,undefined,getOwnPropertySymbols,isExtensible,preventExtensions,freeze,isFrozen,seal,isSealed,fromEntries,hasOwn,groupBy,prototype,length,namesymbolgetOwnPropertyNamesnumberassign,getPrototypeOf,setPrototypeOf,getOwnPropertyDescriptor,getOwnPropertyDescriptors,keys,values,entries,is,defineProperty,defineProperties,create,getOwnPropertyNames,getOwnPropertySymbols,isExtensible,preventExtensions,freeze,isFrozen,seal,isSealed,fromEntries,hasOwn,groupBy,prototype,length,name,-∞2

Comment 1

[Tooru Fujisawa [:arai]]

Thank you for reporting.

Unfortunately, this is not valid bug report.
The difference simply comes from the fact that opt function modifies the Math object and Object object, that becomes visible from the 3rd call.