New issue
Advanced search Search tips

Issue 777067 link

Starred by 3 users

Issue metadata

Status: Duplicate
Owner: ----
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 2
Type: Bug-Regression



Sign in to add a comment

JS crash on a production site when user upgrades to Chrome 62 stable (from 61)

Reported by steve.h...@gmail.com, Oct 21 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.9 Safari/537.36

Steps to reproduce the problem:
1. Go to this URL:   
http://qdp.magnet.co.uk:8000/qdp/apps/idealspaces/#inspiration/1U_syMnKy8w

2. See JS error
Uncaught (in promise) TypeError: Cannot use 'in' operator to search for '0' in arguments_marker

3. http://qdp.magnet.co.uk:8000/qdp/apps/AE/AppEngine.min.js   
line 204

What is the expected behavior?
No JS error

What went wrong?
Chrome stable 61.0.3163  does not have the problem
Chrome stable 62.0.3202.62 introduces the problem
Chrome dev 63.0.3239.9 does not have the problem

Did this work before? Yes Chrome 61.0.3163

Chrome version: 62.0.3202.62  Channel: stable
OS Version: 10.0
Flash Version: 

My company is 2020 Technologies (www.2020spaces.com) and we provide interior design software to many major international vendors of kitchen and bath furniture.

Several of our clients host our application on their website, and are xperiencing this breakage:  Magnet, EGGO, Leroy Merlin, Moebelix, Prota, But

This is very urgent for us!
 
See attached screenshot of the repro


2017-10-20_21-19-04.png
806 KB View Download
Unminified code for the function where the JS error occurs is attached

Seems to be a problem with the ES6 forEach statement

l_oPropNames.forEach(function(i_sPropName) { ... }, this);

However, it does not repro in the unminified version

Item.GetDimensions.js
1.4 KB View Download
Further investigation:

The compiled code looks like: 

    n.prototype.GetDimensions = function() {
        var t, e, o = {}, n = this.m_bResizable || /Resizable|Filler/i.test(this.m_sItemCode), r = /Common\.Structural\.Wall\.Panel$/.test(this.m_sType), i = ["Width", "Height", "Depth"];
        return i.forEach(function(i) {
           // ...
        }, this),
        o
    }

The problem seems to be that the variable "i" is redefined within the closure function and at runtime wipes it before evaluating the forEach operator.

So, it's appears to be a problem with Chrome since it is 2 different scopes and the function declaration shouldn't affect the parent scope prior to execution. It almost looks as if it tried to evaluate the whole function before running it (JIT issue?)


Another observation:

if you change the code from

i = ["Width", "Height", "Depth"];

to

i = new Array("Width", "Height", "Depth");

it resolves the issue

Components: -Blink Blink>JavaScript
Labels: Needs-Triage-M62
Cc: pnangunoori@chromium.org
Labels: hasbisect-per-revision M-62 OS-Linux OS-Mac
Owner: trchen@chromium.org
Status: Assigned (was: Unconfirmed)
Tested on Chrome Stable #62.0.3202.62 on Windows 10, Mac 10.12.6 and Ubuntu 14.04 and issue is reproduced. However, in Canary #64.0.3248.0 and Dev #63.0.3239.9 issue is not reproduced.

Using the reverse bisect providing the bisect results,

Good Build: 63.0.3215.0 (501821)
Bad Build: 63.0.3214.0 (501490)

You are probably looking for a change made after 501809 (known good), but no later than 501810 (first known bad).

CHANGELOG URL:
https://chromium.googlesource.com/chromium/src/+log/b423745e74dbc212cd2eade952648c166a9b57b5..e599a8176262409568cf32fd7ec2e9f7869c1539
https://chromium.googlesource.com/chromium/src/+/e599a8176262409568cf32fd7ec2e9f7869c1539

Review-URL: https://chromium-review.googlesource.com/666003

From the CL above, assigning the issue to the owner concerned.

@trchen: Could you please look into the issue, pardon me if it has nothing to do with your changes and if possible please assign it to owner concerned.

Thanks

Comment 8 by trchen@chromium.org, Oct 25 2017

Cc: -pnangunoori@chromium.org
Labels: -hasbisect-per-revision Needs-Bisect
Owner: pnangunoori@chromium.org
Said CL only updates known test results.

It is likely that repro was not 100% thus the bisect failed. Please has the bisect redone. Thanks!
Cc: pnangunoori@chromium.org
Labels: -Needs-Bisect
Owner: ----
Status: Untriaged (was: Assigned)
Unable to provide bisect details as the behavior is inconsistent on different platforms. For the Chrome #63.0.3215.0, it is working as expected on Windows 10 and issue is noticed on Ubuntu 14.04. Attaching screenshot for reference.

Marking this issue as Untriaged, So that the issue gets addressed.

Note: When tried to take bisect using script, script always generated different results.

Thanks.
777067.png
1.7 MB View Download

Comment 10 by woxxom@gmail.com, Oct 30 2017

Isn't it a duplicate of  issue 777836  ?

Comment 11 by adamk@chromium.org, Oct 31 2017

Mergedinto: 762020
Status: Duplicate (was: Untriaged)

Sign in to add a comment