Status: Accepted
Owner: [email protected]
CC: [email protected], [email protected], [email protected]
Labels: Type-Bug Priority-Medium
New issue 1070 by [email protected]: Crash in
HCheckPrototypeMaps::Hashcode
http://code.google.com/p/v8/issues/detail?id=1070
In release mode the crash occurs at:
Stack trace:
chrome_2590000!v8::internal::HCheckPrototypeMaps::Hashcode+0xf
[c:\b\build\slave\win\build\src\v8\src\hydrogen-instructions.h @ 1660]
chrome_2590000!v8::internal::HValueMap::Lookup+0x15
[c:\b\build\slave\win\build\src\v8\src\hydrogen.cc @ 1166]
chrome_2590000!v8::internal::HGlobalValueNumberer::AnalyzeBlock+0x88
[c:\b\build\slave\win\build\src\v8\src\hydrogen.cc @ 1501]
In debug mode I could reproduce the following assert below:
#
# Fatal error in v8/src/hydrogen.cc, line 4157
# CHECK(!expr->holder().is_null()) failed
#
==== Stack trace ============================================
Security context: 0xf2d9e201 <String[23]: http://www.metacafe.com>
2: encodeURIComponent [native uri.js:324] (this=0xf24ed8b1 <JS Global
Object>#0#,a=0xf2d911f5 <String[1]: 0>)
3: /* anonymous */ [http://s4.mcstatic.com/JS12/Global/?v=7879:356]
(this=0xf24ed8b1 <JS Global Object>#0#,z=0xf2d911f5 <String[1]: 0>)
4: /* anonymous */ [http://s4.mcstatic.com/JS12/Global/?v=7879:356]
(this=0xf24ed8b1 <JS Global Object>#0#,e=0xf2d911f5 <String[1]:
0>,z=0xf2d8e04d <undefined>)
5: /* anonymous */ [http://s4.mcstatic.com/JS12/Global/?v=7879:356]
(this=0xf24ed8b1 <JS Global Object>#0#,e=0xf1b4f9dd <String[3]:
c15>,z=0xf2d911f5 <String[1]: 0>,B=0xf2d8e04d <undefined>,A=0xf2d8e04d
<undefined>)
6: arguments adaptor frame: 2->4
7: beacon [http://s4.mcstatic.com/JS12/Global/?v=7879:356]
(this=0xf38aef65 <an Object>>#1#,j=0xf38e286d <an Object>>#2#)
8: /* anonymous */
[http://www.metacafe.com/watch/yt-DGY-VOwqTeA/diana_and_latifa_awesome_lesbian_kiss_final/:2]
(this=0xf24ed8b1 <JS Global Object>#0#)
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
