原因是一个js里,用createelement('script')方式加载了一段字符串,字符串里有%取模操作。
最后发现,是v8::internal::compiler::OperationTyper::NumberModulus这里执行这个取模操作的,
里面用到了std::abs。
miniblink里实现的abs有点问题,没实现double类型,所以导致计算出错。
下面是堆栈:
v8::internal::compiler::RangeType::Limits::Limits v8::internal::compiler::Type::Overlap v8::internal::compiler::Type::Maybe v8::internal::compiler::OperationTyper::NumberModulus v8::internal::compiler::Typer::Visitor::JSModulusTyper v8::internal::compiler::Typer::Visitor::TypeBinaryOp v8::internal::compiler::Typer::Visitor::Reduce v8::internal::compiler::GraphReducer::Reduce v8::internal::compiler::GraphReducer::ReduceTop v8::internal::compiler::GraphReducer::ReduceNode v8::internal::compiler::GraphReducer::ReduceGraph v8::internal::compiler::Typer::Run v8::internal::compiler::TyperPhase::Run v8::internal::compiler::PipelineImpl::Run<v8::internal::compiler v8::internal::compiler::PipelineImpl::CreateGraph v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl v8::internal::CompilationJob::PrepareJob v8::internal::`anonymous namespace'::GetOptimizedCodeLater v8::internal::`anonymous namespace'::GetOptimizedCode v8::internal::Compiler::CompileOptimized v8::internal::__RT_impl_Runtime_CompileOptimized_Concurrent