Bug 180006 – not a function, is 4.538223e-316 instead: function is optimized to a... number?

• Component: JavaScriptCore
• Status: NEW

# Overview:

We're getting an exception where a function is expected but it's a number instead.

The function is a class method part of Angular@4.3.6. Written in TypeScript and compiled to ES5 as (shortened to relevant bits):

    "use strict";
    var Router = /** @class */ (function () {
        function Router() {
        }
        Router.prototype.serializeUrl = function (url) { return this.urlSerializer.serialize(url); };
        return Router;
    }());

Couldn't it be a user-level code changing the function to become a number? I think not. I added the following code to initialization:

    // FIXME: attempt to troubleshoot this.router.serializeUrl is not a function on Safari
    const serializeUrl = router.serializeUrl;
    Object.defineProperty(router, 'serializeUrl', {
        configurable: false,
        get: () => serializeUrl,
        set: (value) => { throw new Error('this.router.serializeUrl = ' + value) },
    });
    Object.defineProperty(Router.prototype, 'serializeUrl', {
        configurable: false,
        get: () => serializeUrl,
        set: (value) => { throw new Error('Router.prototype.serializeUrl = ' + value) },
    });

It failed again and this trap didn't run. How the function could be replaced without going through these paths?

Because it happens after a few successful invocations of ditto function, I believe the culprit lies in the optimizer (of course, it's not a valid replacement for a function, so that makes me wonder why it happens)

# Steps to Reproduce:

Unfortunately, it's unpredictable when it's going to happen. The function in question runs a few times until the error occurs. It may not happen at all for a given user, but keeps happening. When it fails, it fails for the same function / call site every time.

# Actual Results: 

An exception is thrown:
    TypeError: this.router.serializeUrl is not a function. (In 'this.router.serializeUrl(this.urlTree)', 'this.router.serializeUrl' is 4.538223e-316)

The floating point number reported is different every time.

# Expected Results: 

Function should be invoked w/o problems.

# Build Date & Hardware: 

Sample user agent: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.0 Mobile/14G60 Safari/602.1

# Additional Builds and Platforms: 

Wasn't reported on iOS Safari !== 10.x so far. Nor other browsers & platforms (okay on Mac OS X, Windows, Chrome, Firefox, Edge)

# Additional Information:

Reported as well at https://github.com/angular/angular/issues/16717. The Angular team dismissed the issue because policies.

[Alexey Proskuryakov]

Could you please provide a reproducible case? I don’t think that this kind of an issue can be fixed based on a description alone.

I published at https://awerlang.github.io/webkit180006/

I'm afraid is not easy to reproduce it though, as it just happens.

[Alexey Proskuryakov]

Thank you! What specifically should I try on this webpage to see the problem? It's OK if it takes a reasonable number of tries to reproduce, but hopefully we won't need to be manually interacting with the page for hours until this happens.