Thanks for the report. Request you to provide us with sample file which will reproduce the above issue?

I really appreciate your help.

Thank you!

I am using Ultimate drop-down menu version 4.52
http://www.udm4.com/
In this there is a file called udm-control.js.
The file contains all the seed variables initialized where there is a variable to hold whether the browser is IE or not. That variable is set as true. Line no 206 in the attached file.

udm-control.js 16.4 KB View Download

I've got about 20 applications that use this js feature. All of them are affected by this bug :(

User-Agent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/47.0.2526.73 Chrome/47.0.2526.73 Safari/537.36

Hi there,

 I'm facing the same problem. I work at a federal enterprise and we have about a dozen systems that don't work anymore because that change. In our case, the problem occurs with the browser detection in which typeof document.all = "undefined" reveal us an ie browser. Why you guys chaging that return (typeof document.all) to "object"? It's happened before in  issue #129516 

I can reproduce this on Linux 47.0.2526.73 (Official Build) (64-bit). Firefox 42.0 reports typeof document.all as "undefined".

document.all is a bit magical, it is "falsy". However I'm not sure which type is correct to report. I'm guessing that this is a bindings thing?

Here's a repro; someone should bisect this:

data:text/html,<script>alert(typeof%20document.all);</script>

We want to find out when this changed from alerting "undefined" to alerting "object", and work out the intent of that changelist.

yukishiino@: Would you mind taking a look at this?

An another sample is provided.

In Version 47

Run the attached file.

Expected:
   object
   true
   false
   false

Wrong:
   object - Correct
   false
   true
   true

document.all.html 272 bytes View Download

Able to reproduce the issue on Windows 7, Mac 10.10.5, Ubuntu 14.04 using latest stable 47.0.2526.80, dev 48.0.2564.22, beta 48.0.2564.41, canary 49.0.2586.0 with below steps:

1.Opened attached document.all.html file in chrome.
2.Observed the result as "object" not 'Undefined'.

This is regression issue broken in M-47.

Please find below bisect info:
Last good:47.0.2500.0
First bad:47.0.2501.0

CHANGELOG URL:
https://chromium.googlesource.com/chromium/src/+log/61aa8a159dcf44624c6c5a61ac62d91c1788e6af..2ea8c27b752a7b77e0496b1712355d33b967f5ef

Getting error for blink bisect in tool.Hence, providing manual CLs.
Manual change log:
https://chromium.googlesource.com/chromium/src/+log/47.0.2500.0..47.0.2501.0?pretty=fuller&n=10000

Manual blink change log:
https://chromium.googlesource.com/chromium/blink/+log/8daa566c158b5805cc92f2f2830b4fed84237a06..f27034c02e3c12802a11d0c573bd04e0f4460102?pretty=fuller&n=10000

+cc: jochen@

I found that V8 thinks it's "object" if both of v8::ObjectTemplate::MarkAsUndetectable and SetCallAsFunctionHandler are set.  If I set MarkAsUndetectable but didn't set SetCallAsFunctionHandler, then V8 returns "undefined".

At Chrome M46, it was okay to set both of MarkAsUndetectable and SetCallAsFunctionHandler, however, it's not okay at ToT.

Did something change in V8?
jochen@, could you triage this issue?


Also,  Issue 568448  seems related to this issue.  HTMLObjectElement is using SetCallAsFunctionHandler.  Maybe V8 changed how to treat "callable objects"?

Toon might know

Toon says Benedikt might know

Fixed with https://codereview.chromium.org/1527863003. Assigning to hablich@ for back merging.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/02cc310370df7e51ac4f705038820066fdfd0cdc

commit 02cc310370df7e51ac4f705038820066fdfd0cdc
Author: bmeurer <bmeurer@chromium.org>
Date: Tue Dec 15 08:06:14 2015

[stubs] Fix TypeOfStub to properly return "undefined" for undetectable.

The TypeOfStub didn't test the undetectable bit properly if the instance
was also callable, and therefore returned "object" for document.all
(which is both undetectable and callable).

R=yangguo@chromium.org
BUG= chromium:567998 
LOG=n

Review URL: https://codereview.chromium.org/1527863003

Cr-Commit-Position: refs/heads/master@{#32852}

[modify] http://crrev.com/02cc310370df7e51ac4f705038820066fdfd0cdc/src/code-stubs-hydrogen.cc
[modify] http://crrev.com/02cc310370df7e51ac4f705038820066fdfd0cdc/test/cctest/test-api.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/88e11c80ad99741c9ac852183f1e3b50370a287c

commit 88e11c80ad99741c9ac852183f1e3b50370a287c
Author: machenbach <machenbach@chromium.org>
Date: Tue Dec 15 09:31:40 2015

Revert of [stubs] Fix TypeOfStub to properly return "undefined" for undetectable. (patchset #1 id:1 of https://codereview.chromium.org/1527863003/ )

Reason for revert:
[Sheriff] Changes layout tests. Please fix upstream first:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3491

Original issue's description:
> [stubs] Fix TypeOfStub to properly return "undefined" for undetectable.
>
> The TypeOfStub didn't test the undetectable bit properly if the instance
> was also callable, and therefore returned "object" for document.all
> (which is both undetectable and callable).
>
> R=yangguo@chromium.org
> BUG= chromium:567998 
> LOG=n
>
> Committed: https://crrev.com/02cc310370df7e51ac4f705038820066fdfd0cdc
> Cr-Commit-Position: refs/heads/master@{#32852}

TBR=yangguo@chromium.org,bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= chromium:567998 

Review URL: https://codereview.chromium.org/1525703003

Cr-Commit-Position: refs/heads/master@{#32855}

[modify] http://crrev.com/88e11c80ad99741c9ac852183f1e3b50370a287c/src/code-stubs-hydrogen.cc
[modify] http://crrev.com/88e11c80ad99741c9ac852183f1e3b50370a287c/test/cctest/test-api.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/88bdb0b899548de95d202008d11a0f9247767d7e

commit 88bdb0b899548de95d202008d11a0f9247767d7e
Author: bmeurer <bmeurer@chromium.org>
Date: Wed Dec 16 07:05:15 2015

Skipping test that needs to be rebaselined after https://crrev.com/1527863003 rolls.

TBR=machenbach@chromium.org
BUG= chromium:567998 
NOTRY=true

Review URL: https://codereview.chromium.org/1523693007

Cr-Commit-Position: refs/heads/master@{#365493}

[modify] http://crrev.com/88bdb0b899548de95d202008d11a0f9247767d7e/third_party/WebKit/LayoutTests/TestExpectations

Whether this fix is released in version 47.0.2526.106 ?

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/fa13da2e2b78086c1b643a7d76182e2ae8809294

commit fa13da2e2b78086c1b643a7d76182e2ae8809294
Author: bmeurer <bmeurer@chromium.org>
Date: Wed Dec 16 08:29:39 2015

[stubs] Fix TypeOfStub to properly return "undefined" for undetectable.

The TypeOfStub didn't test the undetectable bit properly if the instance
was also callable, and therefore returned "object" for document.all
(which is both undetectable and callable).

CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
R=yangguo@chromium.org
BUG= chromium:567998 
LOG=n

Committed: https://crrev.com/02cc310370df7e51ac4f705038820066fdfd0cdc
Cr-Commit-Position: refs/heads/master@{#32852}

Review URL: https://codereview.chromium.org/1527863003

Cr-Commit-Position: refs/heads/master@{#32883}

[modify] http://crrev.com/fa13da2e2b78086c1b643a7d76182e2ae8809294/src/code-stubs-hydrogen.cc
[modify] http://crrev.com/fa13da2e2b78086c1b643a7d76182e2ae8809294/test/cctest/test-api.cc

[Automated comment] There appears to be on-going work (i.e. bugroid changes), needs manual review.

[Automated comment] There appears to be on-going work (i.e. bugroid changes), needs manual review.

Merge approved for M48 (branch 2564). Pls go ahead merge.

Merge approved for M47 (branch 2526)

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/8e57c726a6ef8a343d3d2ac7372db6f32153a745

commit 8e57c726a6ef8a343d3d2ac7372db6f32153a745
Author: Michael Hablich <hablich@chromium.org>
Date: Wed Dec 23 10:15:46 2015

Version 4.7.80.27 (cherry-pick)

Merged fa13da2e2b78086c1b643a7d76182e2ae8809294

[stubs] Fix TypeOfStub to properly return "undefined" for undetectable.

BUG= chromium:567998 
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1549453004 .

Cr-Commit-Position: refs/branch-heads/4.7@{#38}
Cr-Branched-From: f3c89267db0fc6120d95046c3ff35a35ca34614f-refs/heads/master@{#31014}

[modify] http://crrev.com/8e57c726a6ef8a343d3d2ac7372db6f32153a745/include/v8-version.h
[modify] http://crrev.com/8e57c726a6ef8a343d3d2ac7372db6f32153a745/src/code-stubs-hydrogen.cc
[modify] http://crrev.com/8e57c726a6ef8a343d3d2ac7372db6f32153a745/test/cctest/test-api.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/efc5cbb03fdb62dd4f00341cd6c5ae6bdaa4649f

commit efc5cbb03fdb62dd4f00341cd6c5ae6bdaa4649f
Author: Michael Hablich <hablich@chromium.org>
Date: Wed Dec 23 10:18:35 2015

Version 4.8.271.11 (cherry-pick)

Merged fa13da2e2b78086c1b643a7d76182e2ae8809294

[stubs] Fix TypeOfStub to properly return "undefined" for undetectable.

BUG= chromium:567998 
LOG=N
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1546903002 .

Cr-Commit-Position: refs/branch-heads/4.8@{#14}
Cr-Branched-From: 10449d46aa20f10f39598627bf07f70def597029-refs/heads/4.8.271@{#1}
Cr-Branched-From: 2ebd5fc7c934ec0a07c3ef0958b7fee35fa2e974-refs/heads/master@{#31941}

[modify] http://crrev.com/efc5cbb03fdb62dd4f00341cd6c5ae6bdaa4649f/include/v8-version.h
[modify] http://crrev.com/efc5cbb03fdb62dd4f00341cd6c5ae6bdaa4649f/src/code-stubs-hydrogen.cc
[modify] http://crrev.com/efc5cbb03fdb62dd4f00341cd6c5ae6bdaa4649f/test/cctest/test-api.cc

It seems I still encounter this bug in Chrome 47 on OSX. Has this been merged/released for Chrome 47 on OSX too?

There was no new 47 release yet.

`document.all` still returns `object` on Chrome 47 on OSX 10.10.

Ah, I see. Thanks!

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8ae69736414de22562db98323bf60f1b7339cccb

commit 8ae69736414de22562db98323bf60f1b7339cccb
Author: tkent <tkent@chromium.org>
Date: Tue Mar 08 03:03:10 2016

Rebaseline of documentall.html.

It's passing now.

BUG= 567998 
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1768163004

Cr-Commit-Position: refs/heads/master@{#379710}

[modify] https://crrev.com/8ae69736414de22562db98323bf60f1b7339cccb/third_party/WebKit/LayoutTests/TestExpectations
[delete] https://crrev.com/0bd9473b9553929068a7a2dcf4e50ccee084043b/third_party/WebKit/LayoutTests/imported/web-platform-tests/html/obsolete/requirements-for-implementations/other-elements-attributes-and-apis/document-all-expected.txt