New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.
Starred by 26 users

Issue metadata

Status: Fixed
Closed: Jun 2016
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug

Sign in to add a comment

JIT compiler not preserving method behavior

Reported by, Apr 15 2016 Back to list

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.75 Safari/537.36

Steps to reproduce the problem:
Consider the following object definition:

var MyObj = function () { };
MyObj.prototype = {
    constructor: MyObj,

    tooltip: function (text) {

        if (typeof text === "undefined")
            return "UNDEF_ARG_GIVEN";
            return this;

    otherFunction: function (cnt) {
        return true;

Now consider the following loop:

    for (var i = 0; i < 100000; i++) {
        (new MyObj()).tooltip(null).otherFunction(i);


The above loop crashes after a few thousand iterations, with an error saying "otherFunction is not a function".

What is the expected behavior?
I expect the loop to go through all the way to 100,000 iterations.

What went wrong?
It crashes after a certain number of iterations (appears random).

Did this work before? Yes It worked fine in chrome v49.

Chrome version: 50.0.2661.75  Channel: stable
OS Version: 6.1 (Windows 7, Windows Server 2008 R2)
Flash Version: Shockwave Flash 21.0 r0

See attached HTML file for how to reproduce.  Simply click the "Launch Test" button.

If I change `if` condition in the tooltip method to avoid keyword `typeof` then things work fine.  For instance, if I use `if (text === undefined)` or `if (arguments.length < 1)`, the code behaves as expected.

Also, if I put a breakpoint at `return "UNDEF_ARG_GIVEN"` in the tooltip using the Dev Tools, then it works fine too.

I suspect the JIT compiler is being tripped by the `typeof` keyword.
879 bytes View Download

Comment 1 by, Apr 15 2016

I can confirm same behavior on OS X 10.11.4 (15E65) Chrome 50.0.2661.75 (64-bit)
Components: -Blink Blink>JavaScript
Status: Available
Components: -Blink>JavaScript Blink>JavaScript>Compiler

Comment 5 by, Apr 21 2016

Status: Assigned

Comment 6 by, Apr 21 2016

Repro in d8:


function f() {
  return typeof null === "undefined";



$ d8 a.js --allow-natives-syntax --nocrankshaft

$ d8 a.js --allow-natives-syntax
Status: Fixed
When can we expect this fix to be released in stable Chrome channel? This bug makes our HTML5 photo product editor at totally unstable. Thanks, Peter

Comment 9 by, Jun 20 2016

hey, you can force to preserve behavior by following hack until its in stable channel: if (typeof text === "undefined" + "")

Comment 10 by, Jun 20 2016

As a workaround, you can straight check if ( text === undefined ) 
Status: Assigned
I can still reproduce it. Are you sure this one is fixed?
Still happening in Mac OS X El Capitan 10.11.5 Chrome Version 51.0.2704.103 (64-bit)
Confirmed still happening in Windows 8.1 (6.3.9600) w/ version 51.0.2704.103 (64-bit) as well
Status: Fixed
This is long fixed by, but was never backmerged to 5.1. Merging now as
Please merge  issue 621887  and  issue 622628  into this one.

Comment 16 by, Jun 23 2016

 Issue v8:5146  has been merged into this issue.
 Issue 621887  has been merged into this issue.

Comment 18 Deleted

Comment 19 Deleted

Sign in to add a comment