Status: New
Owner: ----
New issue 386 by karlmicha: Assertion failed: t != INTERCEPTOR
http://code.google.com/p/v8/issues/detail?id=386
What steps will reproduce the problem?
1. Build v8_shell (my build is part of the chrome build)
2. $ chromium/src/sconsbuild/Debug/v8_shell
chrometest/IssueNavigator.jspa.reduced.js
The Javascript file is from a JIRA search page on which my Linux build of
chrome crashes, after reducing it as much as possible. I can't reduce it
any further, any more code I delete does not crash v8 anymore.
Chrome produces the same debug output as v8_shell. I tested in Firefox
3.0.11 too, no errors or warnings in the console.
System Configuration:
Fedora Core 9 kernel 2.6.27.24-78.2.53.fc9.i686 #1 SMP
v8 revision 2226
Console Output:
#
# Fatal error in /home/schneide/chromium/src/v8/src/objects.h, line 145
# CHECK(t != INTERCEPTOR) failed
#
==== Stack trace ============================================
Security context: 0xb8011de1 <JS Object>#0#
1: z(this=0xb7022979 <JS Object>#1#)
2: new constructor(this=0xb7022979 <JS Object>#1#)
4: /* anonymous */(this=0xb8011e15 <JS Global Object>#2#)
==== Details ================================================
[1]: z(this=0xb7022979 <JS Object>#1#) {
// expression stack (top to bottom)
[03] : 0xb80146b5 <JS Function>#3#
[02] : 0xb8026e5d <String[1]: i>
[01] : 0xb7022979 <JS Object>#1#
[00] : 0xb7022979 <JS Object>#1#
--------- s o u r c e c o d e ---------
function (){? this.a=false;? this.b=false;? this.c=false;?
this.d=false;? this.e=false;? this.f=false;? this.g=false;?
this.h=false;? //alert('1');? this.i=function(){};? //alert('2');?}
-----------------------------------------
}
[2]: new constructor(this=0xb7022979 <JS Object>#1#) {
// stack-allocated locals
var k = 0xb802996d <String[2]: c5>
// expression stack (top to bottom)
[01] : 0xb8029991 <String[1]: z>
--------- s o u r c e c o d e ---------
function (){? for (var k in c){??this[k]=c[k];? }? this.m=false;?
this.n=false;? this.o=false;? this.p=false;? this.q=false;?
this.r=false;? this.r=false;? this.z();?}
-----------------------------------------
}
[4]: /* anonymous */(this=0xb8011e15 <JS Global Object>#2#) {
// stack-allocated locals
var .result = 0xb8022135 <undefined>
// expression stack (top to bottom)
[02] : 0xb8011de1 <JS Object>#0#
[01] : 0xb8014645 <JS Function>#4#
--------- s o u r c e c o d e ---------
c={ c1 : false, c2 : false, c3 : false, c4 : false, c5 : false
};??A=function(){? for (var k in c){??this[k]=c[k];? }?
this.m=false;? this.n=false;? this.o=false;? this.p=false;?
this.q=false;? this.r=false;? this.r=false;?
this.z();?};??A.prototype.z=function(){? th...
-----------------------------------------
}
==== Key ============================================
#0# 0xb8011de1: 0xb8011de1 <JS Object>
c: 0xb7020951 <an Object>>#5#
NaN: 0xb8026505 <Number: nan>
JSON: 0xb8011f05 <JS Object>#6#
Math: 0xb700f3a5 <a MathConstructor>>#7#
Infinity: 0xb80272fd <Number: inf>
undefined: 0xb8022135 <undefined>
#1# 0xb7022979: 0xb7022979 <JS Object>
#2# 0xb8011e15: 0xb8011e15 <JS Global Object>
#3# 0xb80146b5: 0xb80146b5 <JS Function>
#4# 0xb8014645: 0xb8014645 <JS Function>
#5# 0xb7020951: 0xb7020951 <an Object>>
c5: 0xb8022179 <false>
c4: 0xb8022179 <false>
c3: 0xb8022179 <false>
c2: 0xb8022179 <false>
c1: 0xb8022179 <false>
#6# 0xb8011f05: 0xb8011f05 <JS Object>
#7# 0xb700f3a5: 0xb700f3a5 <a MathConstructor>>
E: 0xb8026b89 <Number: 2.718281828459045>
PI: 0xb8026c09 <Number: 3.141592653589793>
LN2: 0xb8026bb9 <Number: 0.6931471805599453>
LN10: 0xb8026ba1 <Number: 2.302585092994046>
SQRT2: 0xb8026c41 <Number: 1.414213562373095>
LOG2E: 0xb8026bd5 <Number: 1.442695040888963>
LOG10E: 0xb8026bf1 <Number: 0.4342944819032518>
SQRT1_2: 0xb8026c25 <Number: 0.7071067811865476>
=====================
Aborted
Attachments:
IssueNavigator.jspa.reduced.js 521 bytes
--
You received this message because you are listed in the owner
or CC fields of this issue, or because you starred this issue.
You may adjust your issue notification preferences at:
http://code.google.com/hosting/settings
--~--~---------~--~----~------------~-------~--~----~
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
-~----------~----~----~----~------~----~------~--~---
