Updates:
Status: Assigned
Owner: [email protected]
Comment #2 on issue 3520 by [email protected]: Chrome JS on MacOSX
array push bug, pushing NaN sometimes results in INT MIN being pushed
leading to erratic client code behavior.
http://code.google.com/p/v8/issues/detail?id=3520
I can repro with the 3.26 branch, but not with 3.27. So it seems we've
either fixed it already, or changed something so that this specific example
doesn't trigger the bug any more. Also, it seems to be related to OSR,
deopt, or both. Here's a slightly modified repro case for d8:
var x = [];
for(var i = 0; i < 1000; i++) {
x.push([]);
}
function burn() {
for(var j = 0; j < 20; j++) {
print("Running iteration " + j);
for(var k = 0; k < 1000; k++) {
x[k].push(NaN);
if(!isNaN(x[k][j])) {
print("array outer index " + k +
", array inner index " + j +
" value (expected NaN, but got) " + x[k][j]);
}
}
}
print("done");
}
burn();
Assigning to Yang for bisection.
--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
