v8 0.4.0
I have some js like this
---------------------------------
... stuff omitted ...
var rslt = file.read(100);
var len = rslt.length;
print(rslt.length, "\n");
for (var i = 0; i < rslt.length; ++i)
{
//var byte = rslt[i];
//print(String.fromCharCode(byte), "\n");
print(i, "\n");
}
//0;
-------------------------------
print is a C++ function.
rslt is a C++ object. rslt.length calls a named property accessor. Its value
is 100.
If I run the above code I get
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208224048 (LWP 14885)]
0x001cb18e in v8::internal::HeapObject::map_word (this=0x458bc289) at
src/objects-inl.h:790
790 return MapWord(reinterpret_cast<uintptr_t>(READ_FIELD(this,
kMapOffset)));
(gdb) where
#0 0x001cb18e in v8::internal::HeapObject::map_word (this=0x458bc289) at
src/objects-inl.h:790
#1 0x001cb1cc in v8::internal::HeapObject::map (this=0x458bc289) at
src/objects-inl.h:780
#2 0x00298f6b in v8::internal::HeapObject::HeapObjectVerify (this=0x458bc289)
at src/objects-debug.cc:169
#3 0x002992c7 in v8::internal::Object::Verify (this=0x458bc289) at
src/objects-debug.cc:65
#4 0x00248cb1 in Invoke (construct=false, func={location_ = 0xa079e64},
receiver={location_ = 0xa079e6c},
argc=0, args=0x0, has_pending_exception=0xbfb94a67) at src/execution.cc:91
#5 0x002493e0 in v8::internal::Execution::Call (func={location_ = 0xa079e64},
receiver={location_ = 0xa079e6c},
argc=0, args=0x0, pending_exception=0xbfb94a67) at src/execution.cc:120
#6 0x001def32 in v8::Script::Run (this=0xa079e64) at src/api.cc:1060
#7 0x0804ceee in jfx::Application::loadScript (this=0xbfb94b44,
[EMAIL PROTECTED]) at Application.cc:84
#8 0x0804b3cd in main (argc=2, argv=0xbfb94c54) at jfx.cc:65
(gdb) up 4
#4 0x00248cb1 in Invoke (construct=false, func={location_ = 0xa079e64},
receiver={location_ = 0xa079e6c},
argc=0, args=0x0, has_pending_exception=0xbfb94a67) at src/execution.cc:91
91 value->Verify();
(gdb) p value
$7 = (class v8::internal::Object *) 0x458bc289
(gdb) p *value
Cannot access memory at address 0x458bc289
(gdb)
If I uncomment the final 0; then it doesn't crash.
If I leave out the final 0; and change the rslt.length to the constant 100 it
doesn't crash. If I change it to the variable len it doesn't crash.
Somehow the repeated calling of the length accessor in the for loop results in
the error. Yet if I change the for loop to the following it doesn't crash.
for (var i = 0; i < len; ++i)
{
print(rslt.length, "\n");
}
If I put a breakpoint at execution.cc:91 and examine 'value' it is correct all
the way up until the value 99 is printed. After this it contains junk. This
smells like a V8 bug to me.
By the way, V8 crashes valgrind.
--
Anthony Shipman Mamas don't let your babies
[EMAIL PROTECTED] grow up to be outsourced.
--~--~---------~--~----~------------~-------~--~----~
v8-users mailing list
[email protected]
http://groups.google.com/group/v8-users
-~----------~----~----~----~------~----~------~--~---
