Status: Accepted
Owner: [email protected]
Labels: Type-Bug Priority-Medium HW-All OS-All
New issue 808 by [email protected]: ASSERT failure with
NormalizedMapCache, tricky underlying problem
http://code.google.com/p/v8/issues/detail?id=808
There is a sporadic failure interactive_ui_tests
--gtest_filter=DevToolsSanityTest.TestExpandScope where the ASSERT
inv8/src/objects-debug.cc, line 652
# CHECK(code_cache() == Heap::empty_fixed_array()) failed
fails.
This is because the map of a slow case object can contain entries in its
code cache, due to store ICs with an API defined callback on a field. In
this case, the object contains store ICs for textContent and InnerHTML (so
it is a DOM object). So the issue of these store ICs must be reconciled
with the normalized map cache. These should be cleared if there the
fast-case object being converted does not have the same callbacks. Also,
should these be cleared if the callback is changed with delete or
GetterSetter?
Removing the change from V8 until this is resolved.
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
