Status: New
Owner: ----
New issue 2326 by [email protected]: Fatal error:
CHECK(BailoutId(data->OsrAstId()->value()) == ast_id) failed
http://code.google.com/p/v8/issues/detail?id=2326
I first noticed this when testing in Chrome 22.0.1229.39 beta and
23.0.1259.1 canary.
It seems a critical bug can be reliably reproduced when using the
in-browser database Crossfilter [1] and executing the same few simple
filters in sequence.
I investigated and managed to reproduce this using a simple test case in
both V8 3.12 and latest master:
https://v8.googlecode.com/svn/branches/bleeding_edge@12470
When using ia32.release, there is no error but the printed count is
incorrect. It should be 600000, and I get something like 119638.
When using ia32.debug, there is a fatal error, the trace for which is
attached.
Lastly, this problem doesn't appear to occur in Chrome stable, 21.0.1180.89.
The attached files are:
- crossfilter.js, the stock version of Crossfilter in use.
- bug.js, the test case
- debug.js, the combined crossfilter.js and 2x bug.js (it usually needs to
be run twice to reproduce/activate the JIT).
- trace.txt, the trace when ia32.debug is used.
[1]: http://square.github.com/crossfilter/
Attachments:
crossfilter.js 36.6 KB
bug.js 528 bytes
debug.js 37.6 KB
trace.txt 4.4 KB
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
