New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.
Starred by 26 users

Issue metadata

Status: Fixed
Closed: Jun 2016
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug

Sign in to add a comment

Issue 604033: JIT compiler not preserving method behavior

Reported by, Apr 15 2016

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.75 Safari/537.36

Steps to reproduce the problem:
Consider the following object definition:

var MyObj = function () { };
MyObj.prototype = {
    constructor: MyObj,

    tooltip: function (text) {

        if (typeof text === "undefined")
            return "UNDEF_ARG_GIVEN";
            return this;

    otherFunction: function (cnt) {
        return true;

Now consider the following loop:

    for (var i = 0; i < 100000; i++) {
        (new MyObj()).tooltip(null).otherFunction(i);


The above loop crashes after a few thousand iterations, with an error saying "otherFunction is not a function".

What is the expected behavior?
I expect the loop to go through all the way to 100,000 iterations.

What went wrong?
It crashes after a certain number of iterations (appears random).

Did this work before? Yes It worked fine in chrome v49.

Chrome version: 50.0.2661.75  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 21.0 r0

See attached HTML file for how to reproduce.  Simply click the "Launch Test" button.

If I change `if` condition in the tooltip method to avoid keyword `typeof` then things work fine.  For instance, if I use `if (text === undefined)` or `if (arguments.length < 1)`, the code behaves as expected.

Also, if I put a breakpoint at `return "UNDEF_ARG_GIVEN"` in the tooltip using the Dev Tools, then it works fine too.

I suspect the JIT compiler is being tripped by the `typeof` keyword.
879 bytes View Download

Comment 1 by, Apr 15 2016

I can confirm same behavior on OS X 10.11.4 (15E65) Chrome 50.0.2661.75 (64-bit)

Comment 2 by, Apr 17 2016

Components: -Blink Blink>JavaScript

Comment 3 by, Apr 20 2016

Status: Available (was: Unconfirmed)

Comment 4 by, Apr 20 2016

Components: -Blink>JavaScript Blink>JavaScript>Compiler

Comment 5 by, Apr 21 2016

Status: Assigned (was: Available)

Comment 6 by, Apr 21 2016

Repro in d8:


function f() {
  return typeof null === "undefined";



$ d8 a.js --allow-natives-syntax --nocrankshaft

$ d8 a.js --allow-natives-syntax

Comment 7 by, Apr 21 2016

Status: Fixed (was: Assigned)

Comment 8 by, Jun 8 2016

When can we expect this fix to be released in stable Chrome channel? This bug makes our HTML5 photo product editor at totally unstable. Thanks, Peter

Comment 9 by, Jun 20 2016

hey, you can force to preserve behavior by following hack until its in stable channel: if (typeof text === "undefined" + "")

Comment 10 by, Jun 20 2016

As a workaround, you can straight check if ( text === undefined )

Comment 11 by, Jun 21 2016

Status: Assigned (was: Fixed)
I can still reproduce it. Are you sure this one is fixed?

Comment 12 by, Jun 21 2016

Still happening in Mac OS X El Capitan 10.11.5 Chrome Version 51.0.2704.103 (64-bit)

Comment 13 by, Jun 21 2016

Confirmed still happening in Windows 8.1 (6.3.9600) w/ version 51.0.2704.103 (64-bit) as well

Comment 14 by, Jun 21 2016

Status: Fixed (was: Assigned)
This is long fixed by, but was never backmerged to 5.1. Merging now as

Comment 15 by, Jun 23 2016

Please merge  issue 621887  and  issue 622628  into this one.

Comment 16 by, Jun 23 2016

 Issue v8:5146  has been merged into this issue.

Comment 17 by, Jun 28 2016

 Issue 621887  has been merged into this issue.

Comment 18 Deleted

Comment 19 Deleted

Sign in to add a comment