decodeURIComponent is implemented in v8, so Blink>JavaScript is related, I think.

Looks like free trials are available at scribd.com.

Somebody with a VEYRON device please try to reproduce and bisect.

Update:  Setting about:flag "Classic Javascript Compilation Pipeline" to "Enabled" allows the content to be shown. 

Feedback: https://hotsauce.corp.google.com/ng#/Report/71503887828

I can't access https://hotsauce.corp.google.com/ng#/Report/71503887828. Can you also reproduce this problem with 60 and upwards?

Btw, the device in question is afaik http://www.chromebookspecs.com/asus-chromebook-flip-c100pa-db01-10.1-inch-touch-chromebook, meaning ARM Cortex. Maybe this also happens on mobile devices?

re: comment #12

this issue occurs on the VEYRON platform.  we've repro'd on JERRY, MINNIE, & MICKEY on M59 and M60.

I can also reproduce this on my Pixel phone with a Chrome 60 32 bit binary. You only need to request the desktop version of the page after logging in.

Small repro below, reproduces in d8 arm.debug tip-of-tree. Does not reproduce on ia32, so it is Arm specific.

function f(x) {
  return String.fromCharCode(x >>> 24);
};

var e = 0x41000001;

f(e);
%OptimizeFunctionOnNextCall(f);
assertEquals("A", f(e));

We need to merge the upcoming fix to 6.1 and 6.2 after some Canary coverage.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/b1c12289815c0f3880355b80954b346d6a2ae48f

commit b1c12289815c0f3880355b80954b346d6a2ae48f
Author: Jaroslav Sevcik <jarin@chromium.org>
Date: Thu Aug 31 13:50:07 2017

[turbofan] Fix arm backend matching of (x >>> 24) & 0xffff.

We emitted rotation by 24 bits with bitwise and, but that is wrong
because the low 8 bits can wrap around and "leak" into the result.

Bug:  chromium:739902 
Change-Id: Id49251e89405afb1581b8c60cde808c2d8bf693d
Reviewed-on: https://chromium-review.googlesource.com/645848
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47746}
[modify] https://crrev.com/b1c12289815c0f3880355b80954b346d6a2ae48f/src/compiler/arm/instruction-selector-arm.cc
[add] https://crrev.com/b1c12289815c0f3880355b80954b346d6a2ae48f/test/mjsunit/compiler/regress-739902.js
[modify] https://crrev.com/b1c12289815c0f3880355b80954b346d6a2ae48f/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc

Approving merge to M61 and M62.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/08fe06d86c1507046c83c1d1f1b5c530bd3554ce

commit 08fe06d86c1507046c83c1d1f1b5c530bd3554ce
Author: Jaroslav Sevcik <jarin@chromium.org>
Date: Mon Sep 11 12:20:24 2017

Merged: [turbofan] Fix arm backend matching of (x >>> 24) & 0xffff.

Revision: b1c12289815c0f3880355b80954b346d6a2ae48f

BUG= chromium:739902 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bmeurer@chromium.org

Change-Id: I9b6ddf251e08667983a49005441e8931b5511418
Reviewed-on: https://chromium-review.googlesource.com/660098
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{#11}
Cr-Branched-From: efa2ac4129d30c7c72e84c16af3d20b44829f990-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb762a60bf5cc2a274faee3620abfb06311-refs/heads/master@{#47693}
[modify] https://crrev.com/08fe06d86c1507046c83c1d1f1b5c530bd3554ce/src/compiler/arm/instruction-selector-arm.cc
[add] https://crrev.com/08fe06d86c1507046c83c1d1f1b5c530bd3554ce/test/mjsunit/compiler/regress-739902.js
[modify] https://crrev.com/08fe06d86c1507046c83c1d1f1b5c530bd3554ce/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/06feffa6996f070a03f20d9da9b81116d6742544

commit 06feffa6996f070a03f20d9da9b81116d6742544
Author: Jaroslav Sevcik <jarin@chromium.org>
Date: Mon Sep 11 13:15:00 2017

Merged: [turbofan] Fix arm backend matching of (x >>> 24) & 0xffff.

Revision: b1c12289815c0f3880355b80954b346d6a2ae48f

BUG= chromium:739902 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=bmeurer@chromium.org

Change-Id: Ic0c191ee9fd4d66cee72bd6d4db72ef3ac8dfadd
Reviewed-on: https://chromium-review.googlesource.com/660002
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.1@{#74}
Cr-Branched-From: 1bf2e10ddb194d4c2871a87a4732613419de892d-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c4318eb2065ffdf9044aa6a5278635c36427-refs/heads/master@{#46746}
[modify] https://crrev.com/06feffa6996f070a03f20d9da9b81116d6742544/src/compiler/arm/instruction-selector-arm.cc
[add] https://crrev.com/06feffa6996f070a03f20d9da9b81116d6742544/test/mjsunit/compiler/regress-739902.js
[modify] https://crrev.com/06feffa6996f070a03f20d9da9b81116d6742544/test/unittests/compiler/arm/instruction-selector-arm-unittest.cc

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add the Disable-Nags label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot