156034 2016-03-30 12:36:07 -0700 DFG JIT bug in typeof constant folding where the input to typeof is an object or function 2016-08-11 18:47:39 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 rniwa saam benjamin commit-queue fpizlo ggaren john.david.dalton keith_miller mark.lam msaboff saam webkit-bug-importer ysuzuki oldest_to_newest 1179136 0 rniwa 2016-03-30 12:36:07 -0700 Reported on https://github.com/gaearon/normalizr/pull/82#issuecomment-203589131 Repro steps: 1. Open https://jsbin.com/coquxaduhu/1/edit?html,js,output 2. Wait for a few iterations until "looks okay" turns "missing entities.tweets". There's a smaller js file reported to reproduce the same issue at: https://github.com/gaearon/normalizr/pull/82#issuecomment-203590718 I'm sorry but I don't understand what this bug is about since the comments in the Github issue is super vague :( 1179142 1 rniwa 2016-03-30 12:36:57 -0700 This is the function that's exhibiting non-deterministic behavior as far as I can tell: https://github.com/lodash/lodash/blob/55c3299d5c04ee8b035ee86f034ec222f4570167/lodash.js#L12308 1179144 2 rniwa 2016-03-30 12:39:05 -0700 This is currently affecting Safari users on Twitter until they push the workaround to the production. 1179145 3 webkit-bug-importer 2016-03-30 12:39:29 -0700 <rdar://problem/25446785> 1179189 4 rniwa 2016-03-30 14:36:46 -0700 React Proxy is claimed to be hitting the same issue: https://github.com/gaearon/react-proxy/issues/55 So it seems that problem here that we mistakenly return "object" for typeof of a function in some JITed code. 1179238 5 rniwa 2016-03-30 16:56:00 -0700 It looks like disabling DFG fixes this bug. 1179248 6 rniwa 2016-03-30 17:24:58 -0700 Saam pinpointed the bug to http://trac.webkit.org/browser/trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h?rev=198865#L1173 1179250 7 rniwa 2016-03-30 17:32:52 -0700 Minimum reproduction (credit: Saam): https://gist.github.com/anonymous/49715c82e834f8e2c184d35a821ec468 1179271 8 275249 saam 2016-03-30 18:03:20 -0700 Created attachment 275249 patch 1179495 9 275249 commit-queue 2016-03-31 11:28:45 -0700 Comment on attachment 275249 patch Clearing flags on attachment: 275249 Committed r198902: <http://trac.webkit.org/changeset/198902> 1179496 10 commit-queue 2016-03-31 11:28:51 -0700 All reviewed patches have been landed. Closing bug. 1219438 11 john.david.dalton 2016-08-11 15:58:48 -0700 Do you all know which updates this fix is in? I'm looking for an idea of when to pull the workaround in my code. 1219440 12 benjamin 2016-08-11 16:18:26 -0700 (In reply to comment #11) > Do you all know which updates this fix is in? I'm looking for an idea of > when to pull the workaround in my code. The patch should be in Safari 10 and iOS 10. 1219507 13 rniwa 2016-08-11 18:47:39 -0700 (In reply to comment #11) > Do you all know which updates this fix is in? I'm looking for an idea of > when to pull the workaround in my code. You should be able to work around the bug in old versions of Safari by wrapping the code in try {} catch {}. e.g. try { return typdeof(obj) == 'array'; } catch (e) { } typeof would never throw but this will disable DFG JIT, which had this bug, from compiling the code in iOS 9 / Safari 9. 275249 2016-03-30 18:03:20 -0700 2016-03-31 11:28:45 -0700 patch a-backup.diff text/plain 2887 saam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTk4ODY4KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI1IEBA CisyMDE2LTAzLTMwICBTYWFtIGJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAg IERGRyBKSVQgYnVnIGluIHR5cGVvZiBjb25zdGFudCBmb2xkaW5nIHdoZXJlIHRoZSBpbnB1dCB0 byB0eXBlb2YgaXMgYW4gb2JqZWN0IG9yIGZ1bmN0aW9uCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTYwMzQKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVt LzI1NDQ2Nzg1PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgIEFJIHdvdWxkIGNvbnN0YW50IGZvbGQgVHlwZU9mIHRvIHRoZSBzdHJpbmcgIm9iamVjdCIg aWYgaXQgc2F3IHRoYXQKKyAgICAgICAgaXRzIGlucHV0IHR5cGUgZGlkbid0IGV4cGFuZCBwYXN0 IHRoZSB0eXBlcyBjb250YWluZWQgaW4gdGhlIHNldCAKKyAgICAgICAgIlNwZWNPYmplY3QgLSBT cGVjT2JqZWN0T3RoZXIiLiBCdXQsIFNwZWNPYmplY3QgY29udGFpbnMgU3BlY0Z1bmN0aW9uLgor ICAgICAgICBBbmQgdHlwZW9mIG9mIGEgZnVuY3Rpb24gc2hvdWxkIHJldHVybiAiZnVuY3Rpb24i LiBUaGlzIHBhdGNoIGZpeGVzCisgICAgICAgIHRoaXMgYnVnIGJ5IG1ha2luZyBzdXJlIHdlIGNv bnN0YW50IGZvbGQgdG8gb2JqZWN0IGlmZiB0aGUgdHlwZQorICAgICAgICBkb2Vzbid0IGV4cGFu ZCBwYXN0IHRoZSBzZXQgIlNwZWNPYmplY3QgLSBTcGVjT2JqZWN0T3RoZXIgLSBTcGVjRnVuY3Rp b24iLgorCisgICAgICAgICogZGZnL0RGR0Fic3RyYWN0SW50ZXJwcmV0ZXJJbmxpbmVzLmg6Cisg ICAgICAgIChKU0M6OkRGRzo6QWJzdHJhY3RJbnRlcnByZXRlcjxBYnN0cmFjdFN0YXRlVHlwZT46 OmV4ZWN1dGVFZmZlY3RzKToKKyAgICAgICAgKiB0ZXN0cy9zdHJlc3MvdHlwZW9mLWRmZy1mdW5j dGlvbi1vci1vYmplY3QuanM6IEFkZGVkLgorICAgICAgICAoYXNzZXJ0KToKKyAgICAgICAgKGZv by5lbHNlLm8pOgorICAgICAgICAoZm9vKToKKwogMjAxNi0wMy0zMCAgU2FhbSBCYXJhdGkgIDxz YmFyYXRpQGFwcGxlLmNvbT4KIAogICAgICAgICBDaGFuZ2Ugc29tZSByZWxlYXNlIGFzc2VydHMg aW4gQ29kZUJsb2NrIGxpbmtpbmcgaW50byBkZWJ1ZyBhc3NlcnRzCkluZGV4OiBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvZGZnL0RGR0Fic3RyYWN0SW50ZXJwcmV0ZXJJbmxpbmVzLmgKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdBYnN0cmFjdEludGVycHJldGVySW5s aW5lcy5oCShyZXZpc2lvbiAxOTg4NjcpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RG R0Fic3RyYWN0SW50ZXJwcmV0ZXJJbmxpbmVzLmgJKHdvcmtpbmcgY29weSkKQEAgLTExNzAsNyAr MTE3MCw3IEBAIGJvb2wgQWJzdHJhY3RJbnRlcnByZXRlcjxBYnN0cmFjdFN0YXRlVHkKIAogICAg ICAgICAvLyBGSVhNRTogV2UgY291bGQgdXNlIHRoZSBtYXNxdWVyYWRlcy1hcy11bmRlZmluZWQg d2F0Y2hwb2ludCBoZXJlLgogICAgICAgICAvLyBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MTQ0NDU2Ci0gICAgICAgIGlmICghKGFic3RyYWN0Q2hpbGQubV90eXBlICYg fihTcGVjT2JqZWN0IC0gU3BlY09iamVjdE90aGVyKSkpIHsKKyAgICAgICAgaWYgKCEoYWJzdHJh Y3RDaGlsZC5tX3R5cGUgJiB+KFNwZWNPYmplY3QgLSBTcGVjT2JqZWN0T3RoZXIgLSBTcGVjRnVu Y3Rpb24pKSkgewogICAgICAgICAgICAgc2V0Q29uc3RhbnQobm9kZSwgKm1fZ3JhcGguZnJlZXpl KHZtLT5zbWFsbFN0cmluZ3Mub2JqZWN0U3RyaW5nKCkpKTsKICAgICAgICAgICAgIGJyZWFrOwog ICAgICAgICB9CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvdGVzdHMvc3RyZXNzL3R5cGVv Zi1kZmctZnVuY3Rpb24tb3Itb2JqZWN0LmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2Ny aXB0Q29yZS90ZXN0cy9zdHJlc3MvdHlwZW9mLWRmZy1mdW5jdGlvbi1vci1vYmplY3QuanMJKHJl dmlzaW9uIDApCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvdGVzdHMvc3RyZXNzL3R5cGVvZi1k ZmctZnVuY3Rpb24tb3Itb2JqZWN0LmpzCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMjUgQEAK K2Z1bmN0aW9uIGFzc2VydChiKSB7CisgICAgaWYgKCFiKSB7CisgICAgICAgIHRocm93IG5ldyBF cnJvcigiQmFkIikKKyAgICB9Cit9CisKK2Z1bmN0aW9uIGZvbyhhcmcpIHsKKyAgICBsZXQgbzsK KyAgICBpZiAoYXJnKSB7CisgICAgICAgIG8gPSB7fTsKKyAgICB9IGVsc2UgeworICAgICAgICBv ID0gZnVuY3Rpb24oKSB7IH0KKyAgICB9CisgICAgcmV0dXJuIHR5cGVvZiBvOworfQorbm9Jbmxp bmUoZm9vKTsKKworZm9yIChsZXQgaSA9IDA7IGkgPCAxMDAwMDsgaSsrKSB7CisgICAgbGV0IGJv b2wgPSAhIShpICUgMik7CisgICAgbGV0IHJlc3VsdCA9IGZvbyhib29sKTsKKyAgICBpZiAoYm9v bCkKKyAgICAgICAgYXNzZXJ0KHJlc3VsdCA9PT0gIm9iamVjdCIpOworICAgIGVsc2UKKyAgICAg ICAgYXNzZXJ0KHJlc3VsdCA9PT0gImZ1bmN0aW9uIik7Cit9Cg==