110

Executing this snippet in the Chrome console:

function foo() {
    return typeof null === 'undefined';
}
for(var i = 0; i < 1000; i++) console.log(foo());

should print 1000 times false, but on some machines will print false for a number of iterations, then true for the rest.

enter image description here

Why is this happening? Is it just a bug?

15
  • 4
    It is returning 1000 times true for me... Jun 21, 2016 at 8:43
  • 2
    i think it's bug, i have 262 false / 738 true
    – Jax Teller
    Jun 21, 2016 at 8:44
  • 1
    it's something weird with chrome's console: if you push to an array and log the array, it's all false. as-is, the number of trues fluctuates in chrome.
    – dandavis
    Jun 21, 2016 at 8:44
  • 1
    @HoàngLong as I said in the question, it happens only on some machines. It is also possible that it happens only on some versions of Chrome
    – Agos
    Jun 21, 2016 at 8:44
  • 2
    @HoàngLong make sure you're running it in Chrome
    – Aurelio
    Jun 21, 2016 at 8:45

4 Answers 4

75

There is a chromium bug open for this:

Issue 604033 - JIT compiler not preserving method behavior

So yes It's just a bug!

2
  • 5
    "Just"? Couldn't this break arbitrary web applications world-wide?
    – jpmc26
    Jun 22, 2016 at 3:01
  • 6
    "Just" only to say that is not a feature or something strange. Is a critical bug, but just a bug!
    – Slumber86
    Jun 22, 2016 at 9:11
37

It's actually a V8 JavaScript engine (Wiki) bug.

This engine is used in Chromium, Maxthron, Android OS, Node.js etc.

Relatively simple bug description you can find in this Reddit topic:

Modern JavaScript engines compile JS code into optimized machine code when it is executed (Just In Time compilation) to make it run faster. However, the optimization step has some initial performance cost in exchange for a long term speedup, so the engine dynamically decides whether a method is worth it depending on how commonly it is used.

In this case there appears to be a bug only in the optimized path, while the unoptimized path works fine. So at first the method works as intended, but if it's called in a loop often enough at some point the engine will decide to optimize it and replaces it with the buggy version.

This bug seems to have been fixed in V8 itself (commit), aswell as in Chromium (bug report) and NodeJS (commit).

3
  • I confirmed the bug is still in Node.js 6.2.2 which worries me. Jun 21, 2016 at 17:32
  • It was fixed in V8 engine today (21.06), I believe soon related software will be updated. Jun 21, 2016 at 17:51
  • Backporting the v8 fix to Node.js 6.2.x is already in progress as issue #7348 owned by TheAlphaNerd. Jun 21, 2016 at 17:58
18

To answer the direct question of why it changes, the bug is in the "JIT" optimisation routine of the V8 JS engine used by Chrome. At first, the code is run exactly as written, but the more you run it, the more potential there is for the benefits of optimisation to outweigh the costs of analysis.

In this case, after repeated execution in the loop, the JIT compiler analyses the function, and replaces it with an optimised version. Unfortunately, the analysis makes an incorrect assumption, and the optimised version doesn't actually produce the correct result.

Specifically, Reddit user RainHappens suggests that it is an error in type propagation:

It also does some type propagation (as in what types a variable etc can be). There's a special "undetectable" type for when a variable is undefined or null. In this case the optimizer goes "null is undetectable, so it can be replaced with the "undefined" string for the comparison.

This is one of the hard problems with optimising code: how to guarantee that code which has been rearranged for performance will still have the same effect as the original.

1

This was fixed two month ago and will land in Chrome soon (already in Canary).

V8 Issue 1912553002 - Fix 'typeof null' canonicalization in crankshaft

Chromium Issue 604033 - JIT compiler not preserving method behavior

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.