Wrong error message «TypeError: something is not a function»

[ChALkeR]

for (var i = 0; i < 18436; i++);
require('http').notAFunction();

results in

require('http').notAFunction();
^
TypeError: require is not a function

But

for (var i = 0; i < 18435; i++);
require('http').notAFunction();

results in

require('http').notAFunction();
                ^
TypeError: require(...).notAFunction is not a function

For anything ≤ 18435 the error message is correct, for anything ≥ 18436 the error message is wrong.
Reproduced on v4.x and v5.1.0. If you can't reproduce that, try using some high number there.

[targos]

I can reproduce it with d8 4.6:

function func() { return {}; }
for (var i = 0; i < 18436; i++);
func().notAFunction();

% out/native/d8 test.js
test.js:3: TypeError: func is not a function
func().notAFunction();
^
TypeError: func is not a function
    at test.js:3:8

Disabling crankshaft fixes it:

% node --no-crankshaft test.js
/home/mzasso/git/chromium/v8/test.js:3
func().notAFunction();
       ^

TypeError: func(...).notAFunction is not a function

The problem is fixed in the 4.7 branch of V8.

[rvagg]

/cc @nodejs/v8

If we can identify the fix in V8 and a it's not too complex this it seems like a good candidate for backporting all the way to v4.x.

[targos]

Found it !
PR incoming ;)

[targos]

Fix for v5.x: #3937

[targos]

Fix for v4.x: #3938

[a0viedo]

This surely got a nice score in the weirdometer. Does anyone know why the breakpoint at 18435? Looking at the fix it doesn't seem like anything trivial.

[targos]

The problem is that without the patch, optimized code computes the wrong message location.
I don't know why the threshold is at exactly 18436, but V8 decides to optimize the function starting from this number of iterations.