Comment #3 on issue 2261 by [email protected]: Materialization of
arguments object during deopt in strict mode yields wrong values
http://code.google.com/p/v8/issues/detail?id=2261
apparently related to this bug is also an test in
object-define-property.js. The way to reproduce the failing assertion is
somewhat brittle: run the test in debug mode with stress-opt, and
artificially prolong the file names, like this:
out/ia32.debug/d8 --stress-opt --always-opt --nobreak-on-abort
--enable-slow-asserts --verify-heap --allow-natives-syntax
--test .///////////////////////////////////////////////////////////////test/mjsunit/mjsunit.js .///////////////////////////////////////////////////////////////test/mjsunit/object-define-property.js
Manually triggering GC using --gc-interval seems to solve the problem, but
so does larger arbitrary changes to the test script.
The attached files show the opt and deopt traces when the test succeeds and
when it fails. "=*=" marks the spot right before the assertEquals in line
1077.
Attachments:
fail.txt 93.7 KB
succ.txt 28.2 KB
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
