原因是一个js里,用createelement('script')方式加载了一段字符串,字符串里有%取模操作。
最后发现,是v8::internal::compiler::OperationTyper::NumberModulus这里执行这个取模操作的,
里面用到了std::abs。
miniblink里实现的abs有点问题,没实现double类型,所以导致计算出错。
下面是堆栈:
v8::internal::compiler::RangeType::Limits::Limits
v8::internal::compiler::Type::Overlap
v8::internal::compiler::Type::Maybe
v8::internal::compiler::OperationTyper::NumberModulus
v8::internal::compiler::Typer::Visitor::JSModulusTyper
v8::internal::compiler::Typer::Visitor::TypeBinaryOp
v8::internal::compiler::Typer::Visitor::Reduce
v8::internal::compiler::GraphReducer::Reduce
v8::internal::compiler::GraphReducer::ReduceTop
v8::internal::compiler::GraphReducer::ReduceNode
v8::internal::compiler::GraphReducer::ReduceGraph
v8::internal::compiler::Typer::Run
v8::internal::compiler::TyperPhase::Run
v8::internal::compiler::PipelineImpl::Run<v8::internal::compiler
v8::internal::compiler::PipelineImpl::CreateGraph
v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl
v8::internal::CompilationJob::PrepareJob
v8::internal::`anonymous namespace'::GetOptimizedCodeLater
v8::internal::`anonymous namespace'::GetOptimizedCode
v8::internal::Compiler::CompileOptimized
v8::internal::__RT_impl_Runtime_CompileOptimized_Concurrent