Comment #8 on issue 2095 by [email protected]: stack corruption with
latest v8 Versions
http://code.google.com/p/v8/issues/detail?id=2095
Hi, with the saved file the crash does not happen as the comments are
through Ajax request.
i was debugging this crash by injecting the script dynamically.
I have attached the script which is causing the script..
the below part is what is causing the crash
if ( nagu == 2 )
{
alert('nagu nagu nagu nagu 1');
_aStr.push("var s=[],i=0;");
_aStr.push('function isArray(o){ return
Object.prototype.toString.call(o) == "[object Array]" };');
alert('nagu nagu nagu nagu 2');
alert(tpl);
_aStr.push(tpl);
_aStr.push('return s.join("");');
tpl = eval("false||function(d){" + _aStr.join("") + "}");
tpl = tpl(data);
}
Attachments:
custom.js 149 KB
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
