Hello, I found a bug in JavaScriptCore (commit id: 04d2f39a0b7924afd3de78310c80fbc8b6109fd8). PoC.js: ``` function opt(start, end) { for (let j = start; j <= end; j++) { function f() { f = start; } print(j) } } for (let i = 0; i < 10; i++) { opt(opt, i); opt(); // print accidently print(i) // for debug } ``` Reproduce: 1. ./jsc --useConcurrentJIT=0 --jitPolicyScale=0 PoC.js 2. ./jsc --useConcurrentJIT=0 --jitPolicyScale=0.001 PoC.js Result of Step1: 0 1 2 undefined 3 undefined 4 undefined 5 undefined 6 undefined 7 undefined 8 9 Result of Step 2: 0 1 2 3 4 5 6 7 8 9 Function opt is inlined into global function in FTL. In the second opt call, CompareLessEq has two oprands, both of them are Constant undefined. Abstract Interpreter incorrectly converts CompareLessEq into Constant True in Constant Folding Optimization. Actually, ```undefined <= undefined``` should return false in JavaScript.