Issue 3199: Crash in slashdot in V8 assertion
http://code.google.com/p/chromium/issues/detail?id=3199
New issue report by [EMAIL PROTECTED]:
Going to slashdot, I get a crash about 75% of the time after the merge. The
stack is:
v8::internal::OS::Abort() Line 793 C++
V8_Fatal(const char * file=0x03b4cfd0, int line=1130, const char *
format=0x03b49d64, ...) Line 59 C++
CheckHelper(const char * file=0x03b4cfd0, int line=1130, const char *
source=0x03b4d57c, bool condition=false) Line 62 + 0x16 bytes C++
v8::internal::JSObject::cast(v8::internal::Object * object=0x06e9c23d)
Line 1130 + 0x20 bytes C++
v8::internal::StoreIC_ExtendStorage(v8::internal::Arguments args={...})
Line 1123 + 0x12 bytes C++
The assertion is in the CAST_ACCESSOR in objects-inl.h. This is while
executing the condition for the assertion in StoreIC_ExtendStorage, which
looks like it would pass (Arguments == 3).
Issue attributes:
Status: Available
Owner: ----
Labels: Type-Bug Pri-1 OS-All Area-Misc
--
You received this message because you are listed in the owner
or CC fields of this issue, or because you starred this issue.
You may adjust your issue notification preferences at:
http://code.google.com/hosting/settings
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Chromium-bugs" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at
http://groups.google.com/group/chromium-bugs?hl=en
-~----------~----~----~----~------~----~------~--~---
