true !== true in IE11 javascript

Question

we are facing a pretty strange problem in our web aplication on IE11 (other IE versions work fine). The application is based on SmartGWT ( http://www.smartclient.com/product/smartgwt.jsp ) - GWT wrapper on SmartClient javascript framework.

IE11 goes into never ending cycles. It happens very randomly and we have no steps to reproduce it. The complexity of our application makes it impossible to post a sample of the code. Most often it happens when users work with the application, then they minimize the browser window and after some time they restore it and try to continue working.

The never ending cycles are caused by strange comparison results, when expression 'true === true' results in false.

The comparison code is:

$wnd.isc.isA.Canvas(obj) === true

The code is executed in scope of iframe containing javascript compiled by GWT.

$wnd is the main(top) window of the web application where the SmartClient javascripts are loaded.

The isc.isACanvas(..) is a method returning true or false, depending on whether the object passed as parameter is of Canvas type - Canvas is a special class from SmartClient framework not the HTML Canvas element.

isc.isA.Canvas = function (object) {
  return (object != null && object._isA_Canvas);
}

_isA_Canvas is set on object to true (boolean true not 'true' as a string) when the object is being created.

I have added some testing code to the part where the problematic comparison is used - here's a simplified version:

var trueCheckCount = 0;
function isCreated(id){
  var obj = $wnd.window[id];    // objects are stored in window by id

  var comparisonResult = $wnd.isc.isA.Canvas(obj) === true;

  if (!comparisonResult ) {
    if ($wnd.isc.isA.Canvas(obj) == true) {
      alert("TRUE != TRUE  (was OK: " + trueCheckCount + "x before)");
    } else {
      trueCheckCount++;
    }
  }

  return comparisonResult;
}

In different test runs, the alert was shown after different number of passes. E.g. on the first run it passed 358 698 times, on the second run it passed 330 125 times …

Does anybody have any idea what could be the problem? How can 'true !== true' ever happen?

Environment:

IE11 (Windows7/8)
SmartGWT: v9.0p_2014-03-02/LGPL Development Only (built 2014-03-02)
GWT: 2.4

Some additional debugging information can be seen on screenshot: https://drive.google.com/file/d/0B8h18b-AMFzXa3NZZ2dOX2txb1k/edit?usp=sharing

Answer 1

The problem was caused by a bug in IE11.

MS released the fix. It's included in December Internet Explorer Cumulative Update KB3008923.

Installing this update solved our problem.

The technical details we got were:

The bug in question is related to reclaiming of JIT functions and cross-site thunks. A function with a cross-site thunk is getting reclaimed. We then change the entryPoint to the InterpreterThunk, losing the cross-site thunk in the process. Marshalling isn't done when calling this function. In the repro in question, we end up with a Boolean True object from a different scriptContext, which doesn't match the one in the current scriptContext when comparing with ===.