Status: New
Owner: ----
New issue 3353 by [email protected]: JIT bug for number types?
http://code.google.com/p/v8/issues/detail?id=3353
The following code reproduces the problem:
<script>
function Point() {
this.x = 0;
this.y = 0;
}
function calculate() {
var point = new Point(),
i;
for (i = 0; i < 256; i++) {
point.x += 0.78125;
point.y += 0.78125;
}
return point.x + point.y;
};
for (x = 0; x < 2000; x++) {
if (calculate() !== 400) {
debugger;
}
}
</script>
Basically the `debugger` statement should never be executed, but it is.
It seems that after a few times through the loop, `point.x` is no longer
mutated correctly, but `point.y`*is*. The order of the attributes on
`Point` is important. Switching around the order of `x` and `y` (i.e.
declare `y` first) and you'll observe that now `y` is broken, and `x` is
fixed.
`calculate` being a function also seems significant.
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
