4 ms·
Anyone know why it causes a crash? I cleaned up the javascript a bit by adding whitespace and more meaningful variable names: https://gist.github.com/mdesson/
by vaughnegut 5y ago
Anyone know why it causes a crash?
I cleaned up the javascript a bit by adding whitespace and more meaningful variable names:
https://gist.github.com/mdesson/b87c51ff4caf7bd4d2f74b52e8d643cc https://gist.github.com/mdesson/b87c51ff4caf7bd4d2f74b52e8d6...
- simlevesque 5y agoThis is really weird. I'm puzzled about two things: 1. Why is there a ternary on the condition that Infinify is truthy ? My instinct is to say that it will always return [], which brings my second point 2. Why is it always using false as an argument ? What is the effect of this on the execution versus just hardcoding it ?
- wruza 5y agoMy blind guess is, 0x10000 is there for jit to kick in. It likely exploits edge cases in code generation (flow control optimization specifically).
- ronsor 5y ago> 0x10000 is there for jit to kick in Correct. Only functions that are called often will get optimized.
- saikishore 5y agoI have tried moving the boolean into the function, as a hard-coded variable. That stops the "crashing"; weird, indeed.
- adamredwoods 5y agoJust a guess: sneak a divide-by-zero error into TurboFan? If the function runs once correctly in the Ignition interpreter (the first z(false), then when it's in a loop, run it through TurboFan thinking it's safe.
- adamredwoods 5y agoI tried looking at the bytecode, quite large: node --print-bytecode --eval "z=(a)=>{let y = Math.min(Infinity ? [] : Infinity, -0) / 0; if (a) y = -0; return y ? 1 : 0}; z(false); for (let i = 0; i < 0x10000; ++i) z(false);"