Status: Accepted
Owner: [email protected]
CC: [email protected]
Labels: Type-Bug Priority-Medium
New issue 962 by [email protected]: Assert failure in debug linux 32-bit
Chrome with V8 3.0.0. In register allocator.
http://code.google.com/p/v8/issues/detail?id=962
What steps will reproduce the problem?
1.navigate to
http://thenextweb.com/google/2010/12/07/2-youtube-videos-confirm-launch-of-chrome-web-store-and-chrome-os-today/?utm_source=twitterfeed&utm_medium=twitter&utm_campaign=nettechnews
2. Navigate to another page on the site through link on the bottom.
3. We get a sad tab, and an assert failure in V8. The assert is in new
code added by version 3.0, in a new compiler.
Not reproduced yet.
What is the expected output? What do you see instead?
" source: (1)
[24624:24624:538104750815:INFO:CONSOLE(0)] " *****set user auth from
cookie, result: [email protected]," source:
http://fyre.co/javascripts/compressed/livefyre_55.js (45)
[24624:24624:538106307938:INFO:CONSOLE(0)] "**********CONNECT," source:
http://fyre.co/javascripts/compressed/livefyre_55.js (49)
#
# Fatal error in v8/src/lithium-allocator.cc, line 1498
# CHECK(!current->HasRegisterAssigned() && !current->IsSpilled()) failed
#
==== Stack trace ============================================
2: arguments adaptor frame: 5->0
Security context: 0xf2af5a01 <String[21]: http://thenextweb.com>
3: nodeChanged [http://fyre.co/javascripts/tiny_mce/tiny_mce.js:1]
(this=0xf21ba921 <JS Object>#0#,r=0xf403262d <an Object>>#1#)
4: /* anonymous */ [http://fyre.co/javascripts/tiny_mce/tiny_mce.js:1]
(this=0xf35e1461 <JS Global Object>#2#)
==== Details ================================================
[2]: arguments adaptor frame: 5->0 {
// actual arguments
[00] : 0xf21ba921 <JS Object>#0# // not passed to callee
[01] : 0xf15bd919 <JS Object>#3# // not passed to callee
[02] : 0xf15d19d5 <an HTMLDocument>>#4# // not passed to callee
[03] : 0xf35ac099 <true> // not passed to callee
[04] : 0xf403262d <an Object>>#1# // not passed to callee
}
[3]: nodeChanged [http://fyre.co/javascripts/tiny_mce/tiny_mce.js:1]
(this=0xf21ba921 <JS Object>#0#,r=0xf403262d <an Object>>#1#) {
// stack-allocated locals
var p = 0xf21ba921 <JS Object>#0#
var q = 0xf15d4021 <JS Object>#5#
var u = 0xf15d19d5 <an HTMLDocument>>#4#
// heap-allocated locals
var r = 0xf403262d <an Object>>#1#
--------- s o u r c e c o d e ---------
function (r){var p=this,q=p.selection,u=(b?q.getNode():q.getStart())||
p.getBody();if(p.initialized){r=r||
{};u=b&&u.ownerDocument!=p.getDoc()?p.getBody():u;r.parents=[];p.dom.getParent(u,function(s){if(s.nodeName=="BODY"){return
true}r.parents.push(s)});p.onNodeChange.dispatch(p,r?r.controlManager||
p.controlM...
-----------------------------------------
}
[4]: /* anonymous */ [http://fyre.co/javascripts/tiny_mce/tiny_mce.js:1]
(this=0xf35e1461 <JS Global Object>#2#) {
--------- s o u r c e c o d e ---------
function
(){if(z.removed){return}z.load({initial:true,format:(A.cleanup_on_startup?"html":"raw")});z.startContent=z.getContent({format:"raw"});z.initialized=true;z.onInit.dispatch(z);z.execCallback("setupcontent_callback",z.id,z.getBody(),z.getDoc());z.execCallback("init_instance_callback",z);z.focus(true);z...
-----------------------------------------
}
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
