Comment #4 on issue 1156 by [email protected]: V8 Crash when idling at
news.google.com
http://code.google.com/p/v8/issues/detail?id=1156
I did reproduce this. We are lazily deoptimizing the function:
Q.f = function () { delete this[D]; delete this[K]; delete this[Fb]; };
It appears like the patched relocation info for lazy deoptimization does
not fit in the space of the original relocation info. This triggers the
assert (and stomps on an unrelated heap object in release builds).
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
