Reported on https://github.com/gaearon/normalizr/pull/82#issuecomment-203589131 Repro steps: 1. Open https://jsbin.com/coquxaduhu/1/edit?html,js,output 2. Wait for a few iterations until "looks okay" turns "missing entities.tweets". There's a smaller js file reported to reproduce the same issue at: https://github.com/gaearon/normalizr/pull/82#issuecomment-203590718 I'm sorry but I don't understand what this bug is about since the comments in the Github issue is super vague :(
This is the function that's exhibiting non-deterministic behavior as far as I can tell: https://github.com/lodash/lodash/blob/55c3299d5c04ee8b035ee86f034ec222f4570167/lodash.js#L12308
This is currently affecting Safari users on Twitter until they push the workaround to the production.
<rdar://problem/25446785>
React Proxy is claimed to be hitting the same issue: https://github.com/gaearon/react-proxy/issues/55 So it seems that problem here that we mistakenly return "object" for typeof of a function in some JITed code.
It looks like disabling DFG fixes this bug.
Saam pinpointed the bug to http://trac.webkit.org/browser/trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h?rev=198865#L1173
Minimum reproduction (credit: Saam): https://gist.github.com/anonymous/49715c82e834f8e2c184d35a821ec468
Created attachment 275249 [details] patch
Comment on attachment 275249 [details] patch Clearing flags on attachment: 275249 Committed r198902: <http://trac.webkit.org/changeset/198902>
All reviewed patches have been landed. Closing bug.
Do you all know which updates this fix is in? I'm looking for an idea of when to pull the workaround in my code.
(In reply to comment #11) > Do you all know which updates this fix is in? I'm looking for an idea of > when to pull the workaround in my code. The patch should be in Safari 10 and iOS 10.
(In reply to comment #11) > Do you all know which updates this fix is in? I'm looking for an idea of > when to pull the workaround in my code. You should be able to work around the bug in old versions of Safari by wrapping the code in try {} catch {}. e.g. try { return typdeof(obj) == 'array'; } catch (e) { } typeof would never throw but this will disable DFG JIT, which had this bug, from compiling the code in iOS 9 / Safari 9.