When appending a string to a constructor do not modify the constructor's original toString value.

Author: wyrichte

lib/Runtime/Math/JavascriptMath.cpp

@@ -425,9 +425,14 @@ using namespace Js;
 
         Var JavascriptMath::AddLeftDead(Var aLeft, Var aRight, ScriptContext* scriptContext, JavascriptNumber *result)
         {
+            // Conservatively assume src1 is not dead until proven otherwise.
+            bool leftIsDead = false;
+
             JIT_HELPER_REENTRANT_HEADER(Op_AddLeftDead);
             if (JavascriptOperators::GetTypeId(aLeft) == TypeIds_String)
             {
+                leftIsDead = true;
+
                 JavascriptString* leftString = UnsafeVarTo<JavascriptString>(aLeft);
                 JavascriptString* rightString;
                 TypeId rightType = JavascriptOperators::GetTypeId(aRight);
@@ -471,7 +476,7 @@ using namespace Js;
             {
                 return JavascriptNumber::ToVarMaybeInPlace(JavascriptNumber::GetValue(aLeft) + JavascriptNumber::GetValue(aRight), scriptContext, result);
             }
-            return Add_FullHelper_Wrapper(aLeft, aRight, scriptContext, result, true);
+            return Add_FullHelper_Wrapper(aLeft, aRight, scriptContext, result, leftIsDead);
             JIT_HELPER_END(Op_AddLeftDead);
         }
 

test/Strings/constructorConcat.js

@@ -0,0 +1,20 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+function f(arg) {
+    var i = 0;
+    while (i < 5) {
+        i++;
+        arg += "this_should_not_stay";
+    }
+}
+f("Hello");
+f(Int8Array);
+
+if (!Int8Array.toString().includes("this_should_not_stay")) {
+    WScript.Echo("Passed");
+}
+else {
+    WScript.Echo("FAILED");
+}

test/Strings/rlexe.xml

@@ -268,4 +268,10 @@
       <compile-flags>-args summary -endargs</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>constructorConcat.js</files>
+      <compile-flags>-lic:1 -mic:1 -bgjit-</compile-flags>
+    </default>
+  </test>
 </regress-exe>