Updates:
Status: Assigned
Owner: [email protected]
Comment #1 on issue 3010 by [email protected]: Large object literal
definitions get mangled.
http://code.google.com/p/v8/issues/detail?id=3010
Good catch, thanks for reporting this!
Let's find out at what object size this starts happening:
--------------------
#!/usr/bin/env python
import sys
if __name__ != '__main__': print "standalone only!"; sys.exit(255)
if len(sys.argv) < 2: print "need 'limit' argument"; sys.exit(255)
limit = int(sys.argv[1])
template = """var limit = %(limit)s;
var obj = { %(contents)s };
for (var i = 0; i < %(limit)s; i++) {
if (obj['k' + i] != i) {
print("FAIL: obj[", 'k' + i, "] should be", i, "but was", obj['k' + i]);
quit(1);
}
}
print("PASS");
"""
contents = []
for i in range(limit):
contents.append("k%s:%s" % (i, i))
contents = ",\n ".join(contents)
print template % {'contents': contents, 'limit': limit}
--------------------
$ ./generator.py 3 > gen.js && out/ia32.release/d8 gen.js
PASS
$ ./generator.py 1200 > gen.js && out/ia32.release/d8 gen.js
FAIL: obj[ k10 ] should be 10 but was 591
$ for i in {3..1200}; do ./generator.py $i > gen.js && out/ia32.release/d8
gen.js > /dev/null || echo "FAIL for $i"; done
FAIL for 1025
FAIL for 1026
FAIL for 1027
FAIL for 1028
[...]
Aha! Someone's using 10 bits for something. Debug mode makes further
analysis easier than expected:
$ ./generator.py 1025 > gen.js && gdb -ex run -args out/ia32.debug/d8 gen.js
#
# Fatal error in ../src/utils.h, line 300
# CHECK(is_valid(value)) failed
#
(gdb) bt
#0 v8::internal::OS::DebugBreak () at ../src/platform-posix.cc:285
#1 0x08888094 in v8::internal::OS::Abort () at ../src/platform-posix.cc:263
#2 0x0847b0fb in V8_Fatal (file=0x8a1cfa2 "../src/utils.h", line=300,
format=0x8a18390 "CHECK(%s) failed") at ../src/checks.cc:85
#3 0x08444c1f in v8::internal::BitFieldBase<unsigned int, 21, 10, unsigned
int>::encode (value=1024) at ../src/utils.h:300
#4 0x0841ba66 in v8::internal::PropertyDetails::PropertyDetails
(this=0xffffc224, attributes=NONE, type=v8::internal::FIELD,
representation=..., field_index=1024) at ../src/property-details.h:219
#5 0x0845bfdd in v8::internal::Descriptor::Descriptor (this=0xffffc21c,
key=0x27324305, value=0x0, attributes=NONE, type=v8::internal::FIELD,
representation=..., field_index=1024) at ../src/property.h:93
#6 0x0845c026 in v8::internal::FieldDescriptor::FieldDescriptor
(this=0xffffc21c, key=0x27324305, field_index=1024, attributes=NONE,
representation=...) at ../src/property.h:106
#7 0x0868bab1 in
v8::internal::NameDictionary::TransformPropertiesToFastFor
(this=0x31016d05, obj=0x31016909, unused_property_fields=0)
at ../src/objects.cc:15877
#8 0x08662a37 in v8::internal::JSObject::TransformToFastProperties
(object=..., unused_property_fields=0) at ../src/objects.cc:4636
#9 0x086d5ffb in v8::internal::CreateObjectLiteralBoilerplate
(isolate=0x973a018, literals=..., constant_properties=...,
should_have_fast_elements=true, has_function_literal=false)
at ../src/runtime.cc:337
#10 0x086d6b2e in v8::internal::__RT_impl_Runtime_CreateObjectLiteral
(args=..., isolate=0x973a018) at ../src/runtime.cc:499
#11 0x086d68d8 in v8::internal::Runtime_CreateObjectLiteral (args_length=4,
args_object=0xffffc508, isolate=0x973a018) at ../src/runtime.cc:479
#12 0x3410b256 in ?? ()
[...]
Looks like the object property system has an implicit limit on the number
of fast properties, but when we create an object literal, we never check
for that limit when deciding that the literal should have fast properties.
Toon, please take a look.
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
