Bug 156034 – DFG JIT bug in typeof constant folding where the input to typeof is an object or function

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Ryosuke Niwa]

Reported on https://github.com/gaearon/normalizr/pull/82#issuecomment-203589131

Repro steps:
1. Open https://jsbin.com/coquxaduhu/1/edit?html,js,output
2. Wait for a few iterations until "looks okay" turns "missing entities.tweets".

There's a smaller js file reported to reproduce the same issue at:
https://github.com/gaearon/normalizr/pull/82#issuecomment-203590718

I'm sorry but I don't understand what this bug is about since the comments in the Github issue is super vague :(

[Ryosuke Niwa]

This is the function that's exhibiting non-deterministic behavior as far as I can tell:
https://github.com/lodash/lodash/blob/55c3299d5c04ee8b035ee86f034ec222f4570167/lodash.js#L12308

[Ryosuke Niwa]

This is currently affecting Safari users on Twitter until they push the workaround to the production.

[Radar WebKit Bug Importer]

<rdar://problem/25446785>

[Ryosuke Niwa]

React Proxy is claimed to be hitting the same issue:
https://github.com/gaearon/react-proxy/issues/55

So it seems that problem here that we mistakenly return "object" for typeof of a function in some JITed code.

[Ryosuke Niwa]

It looks like disabling DFG fixes this bug.

[Ryosuke Niwa]

Saam pinpointed the bug to http://trac.webkit.org/browser/trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h?rev=198865#L1173

[Ryosuke Niwa]

Minimum reproduction (credit: Saam): https://gist.github.com/anonymous/49715c82e834f8e2c184d35a821ec468

[Saam Barati]

Created attachment 275249 [details]
patch

[WebKit Commit Bot]

Comment on attachment 275249 [details]
patch

Clearing flags on attachment: 275249

Committed r198902: <http://trac.webkit.org/changeset/198902>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[John-David Dalton]

Do you all know which updates this fix is in? I'm looking for an idea of when to pull the workaround in my code.

[Benjamin Poulain]

(In reply to comment #11)
> Do you all know which updates this fix is in? I'm looking for an idea of
> when to pull the workaround in my code.

The patch should be in Safari 10 and iOS 10.

[Ryosuke Niwa]

(In reply to comment #11)
> Do you all know which updates this fix is in? I'm looking for an idea of
> when to pull the workaround in my code.

You should be able to work around the bug in old versions of Safari by wrapping the code in try {} catch {}. e.g.

try {
    return typdeof(obj) == 'array';
} catch (e) { }

typeof would never throw but this will disable DFG JIT, which had this bug, from compiling the code in iOS 9 / Safari 9.