IOS - Math.abs generate random numbers when we have JIT

[Adrian]

This may be already reported but I don't seem to be able to find it but basically when we have JIT and we use Math.abs in some contexts it produces random numbers. The original case was in a much larger codebase but I reduce it to this one, it may not be exactly the same issue  but it is in the same area at least.

Example code

Number.prototype.abs = function() {
        return Math['abs'].call(Math, this);
};

for (var i = 0; i < 100; i++) {
        document.write(i.abs() + ' ');
}

Expected behaviour:

Print number from 0 to 99 in the page.

Current behaviour

It prints all the numbers all right until 73, after that iOS devices start to generate large numbers like 312604592 instead of 74. They appear to follow some kind of pattern.

Other platforms

The only platform where this happens is iOS, the rest of the browsers, including Safari on desktop, doesn't have this problem at all. This problem goes away is you attach a debugger, change the prototype to a global method or use dot notation when calling abs for example.

I attached an html file with that example plus a few others I tried, some of them working some not.

[Adrian]

Created attachment 235595 [details]
Examples of failing and working code that does the same thing

[Alexey Proskuryakov]

What is the iOS version that you are seeing this with, and on which device?

I cannot reproduce with iOS 7.1.1 on iPhone 5s.

[Adrian]

I just tried again in both the emulator (iPad IOS 7.1), iPad 3 (iOS 7.1.2) and yesterday I tried In iPhone 5s (iOS 7.1.2).

The emulator fails all the time, the iPad 3 and the 5s fails sometimes for me, not always. It seems that they fail all the time if I change the code to:

var list = [];

Number.prototype.abs = function() {
     return Math['abs'].call(Math, this);
};

for (var i = 0; i < 100; i++) {
     list.push(i.abs());
}

document.write(list.join(', '));

Anyway yesterday I manage to update the iPhone to the latest iOS beta and now I cannot reproduce the issue anymore. Not this one, nor the other similar ones I found or even the original one in our big codebase.

It will be cool if we can now which bug fixed this one, but at least it seems that this is not going to be an issue anymore in the fall.