Status: New
Owner: ----
New issue 2646 by [email protected]: Float64Array: Fatal error when
profiling heap with --heap_stats in spaces.cc
http://code.google.com/p/v8/issues/detail?id=2646
Execute the following code in d8 console, compiled in debug mode, with
--heap_stats flag:
// ./d8 --heap_stats ./float64_heap_type_crash.js
var expectedItemsCount = 10000,
itemSize = 5,
heap = new ArrayBuffer(expectedItemsCount * itemSize * 8),
storage = [];
for (var i = 0; i < expectedItemsCount; i++) {
storage.push(new Float64Array(heap, 0, itemSize));
}
The program will crash with fatal error:
#
# Fatal error in ../src/spaces.cc, line 1844
# CHECK(isolate->heap_histograms()[type].name() != __null) failed
#
See crash.txt for entire log.
Looks like when Float64Array support was added [1] the corresponding symbol
EXTERNAL_DOUBLE_ARRAY_TYPE was not updated in the INSTANCE_TYPE_LIST_ALL
macro [2] of object.h. Adding the type into the macros fixes the crash.
[1] https://codereview.chromium.org/6879009
[2] https://github.com/v8/v8/blob/master/src/objects.h#L368
Attachments:
float64_heap_type_crash.js 235 bytes
crash.txt 16.1 KB
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
