Project: chromium Issues People Development process History Sign in
New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.
Issue 604033 JIT compiler not preserving method behavior
Starred by 26 users Reported by gilbert....@gmail.com, Apr 15 2016 Back to list
Status: Fixed
Owner:
Closed: Jun 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment
UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.75 Safari/537.36

Steps to reproduce the problem:
Consider the following object definition:

```
var MyObj = function () { };
MyObj.prototype = {
    constructor: MyObj,

    tooltip: function (text) {

        if (typeof text === "undefined")
            return "UNDEF_ARG_GIVEN";
        else
            return this;
    },

    otherFunction: function (cnt) {
        return true;
    }
};
```

Now consider the following loop:

```
    for (var i = 0; i < 100000; i++) {
        (new MyObj()).tooltip(null).otherFunction(i);
        console.log(i);
    }

```

The above loop crashes after a few thousand iterations, with an error saying "otherFunction is not a function".

What is the expected behavior?
I expect the loop to go through all the way to 100,000 iterations.

What went wrong?
It crashes after a certain number of iterations (appears random).

Did this work before? Yes It worked fine in chrome v49.

Chrome version: 50.0.2661.75  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 21.0 r0

See attached HTML file for how to reproduce.  Simply click the "Launch Test" button.

If I change `if` condition in the tooltip method to avoid keyword `typeof` then things work fine.  For instance, if I use `if (text === undefined)` or `if (arguments.length < 1)`, the code behaves as expected.

Also, if I put a breakpoint at `return "UNDEF_ARG_GIVEN"` in the tooltip using the Dev Tools, then it works fine too.

I suspect the JIT compiler is being tripped by the `typeof` keyword.
 
chrome-v50_bug.htm
879 bytes View Download
Comment 1 by cingarfi...@lim.com, Apr 15 2016
I can confirm same behavior on OS X 10.11.4 (15E65) Chrome 50.0.2661.75 (64-bit)
Components: -Blink Blink>JavaScript
Cc: bmeu...@chromium.org jarin@chromium.org verwa...@chromium.org
Status: Available
Components: -Blink>JavaScript Blink>JavaScript>Compiler
Comment 5 by jarin@chromium.org, Apr 21 2016
Owner: jarin@chromium.org
Status: Assigned
Comment 6 by jarin@chromium.org, Apr 21 2016
Owner: verwa...@chromium.org
Repro in d8:

-------

function f() {
  return typeof null === "undefined";
};

%OptimizeFunctionOnNextCall(f);
print(f());

--------

$ d8 a.js --allow-natives-syntax --nocrankshaft
false

$ d8 a.js --allow-natives-syntax
true
Status: Fixed
When can we expect this fix to be released in stable Chrome channel? This bug makes our HTML5 photo product editor at www.smartphoto.com totally unstable. Thanks, Peter
Comment 9 by vavre...@gmail.com, Jun 20 2016
hey, you can force to preserve behavior by following hack until its in stable channel: if (typeof text === "undefined" + "")
...
Comment 10 by qwel...@gmail.com, Jun 20 2016
As a workaround, you can straight check if ( text === undefined ) 
Status: Assigned
I can still reproduce it. Are you sure this one is fixed?
Still happening in Mac OS X El Capitan 10.11.5 Chrome Version 51.0.2704.103 (64-bit)
Confirmed still happening in Windows 8.1 (6.3.9600) w/ version 51.0.2704.103 (64-bit) as well
Status: Fixed
This is long fixed by https://codereview.chromium.org/1912553002, but was never backmerged to 5.1. Merging now as https://codereview.chromium.org/2088783002.
Please merge issue 621887 and issue 622628 into this one.
Comment 16 by adamk@chromium.org, Jun 23 2016
Issue v8:5146 has been merged into this issue.
Cc: rnimmagadda@chromium.org
Issue 621887 has been merged into this issue.
Comment 18 Deleted
Comment 19 Deleted
Sign in to add a comment