Steps to reproduce: 1) Open Safari with TOT WebKit 2) Go to javascript: 0; 3) Quit Safari Result: Safari crashed. Backtrace: 0 com.apple.JavaScriptCore 0x005d8568 KJS::UString::Rep::deref() + 74 (ustring.h:159) 1 com.apple.JavaScriptCore 0x005d85bd WTF::RefPtr<KJS::UString::Rep>::~RefPtr() + 31 (RefPtr.h:45) 2 com.apple.JavaScriptCore 0x005d85d1 WTF::RefPtr<KJS::UString::Rep>::~RefPtr() + 17 (RefPtr.h:45) 3 com.apple.JavaScriptCore 0x005d85e5 KJS::UString::~UString() + 17 (ustring.h:229) 4 com.apple.JavaScriptCore 0x005d85f9 KJS::UString::~UString() + 17 (ustring.h:229) 5 com.apple.JavaScriptCore 0x005dbb63 KJS::Parser::~Parser() + 31 (Parser.h:41) 6 com.apple.JavaScriptCore 0x005dbb81 KJS::Parser::~Parser() + 17 (Parser.h:41) 7 com.apple.JavaScriptCore 0x00585125 __tcf_6 + 27 (Parser.cpp:111) 8 libSystem.B.dylib 0x901c195c __cxa_finalize + 241 9 libSystem.B.dylib 0x901c1850 exit + 33 10 com.apple.AppKit 0x91231060 -[NSApplication terminate:] + 772 11 com.apple.AppKit 0x91151f94 -[NSApplication sendAction:to:from:] + 112
What a coincidence! I have a patch for this already.
Created attachment 17814 [details] patch
Created attachment 17815 [details] patch (this time with the correct ChangeLog)
I landed this in r28580 as it was causing havoc on the buildbots.