Bug 17057 – REGRESSION: Frequent random crashes in WebCore::JSNodeList::indexGetter

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore JavaScript

[Steven Hollingsworth]

WebKit crashes on quit.

[Steven Hollingsworth]

Created attachment 18755 [details]
WebKit Crash

Log from WebKit Crash.

[Steven Hollingsworth]

WebKit crashed on quit (Cmd + Q).

[Alexey Proskuryakov]

Do you remember what Web pages were open at the time? The crash is seemingly caused by something that a page's JavaScript performed.

[Steven Hollingsworth]

I cannot remember exactly but it was probably iGoogle, Gmail, Google Calendar, Google Docs, or Google Reader.

[Steven Hollingsworth]

Created attachment 18977 [details]
Problem Report for Webkit

Just had this issue appear again while scrolling through Google Reader.

[Steven Hollingsworth]

Created attachment 18991 [details]
Problem Report for Webkit

Just had this issue occur again on Google Reader.

[Alexey Proskuryakov]

Thanks! The stack traces are different, and the do not really match the "crash on quit" description, but such frequent crashing is worrisome.

[Cameron Zwarich (cpst)]

I agree, this is probably not a crash on quit. Google Reader is known for doing some funky things with JS, so it is likely a problem with the ActivationImp tear-off. I will try to find a reliable method of reproduction so that I can figure out exactly what is going wrong.

[Cameron Zwarich (cpst)]

I played around with Google Reader for a bit, trying to reproduce the crash, but I couldn't.

[Steven Hollingsworth]

*** Bug 17389 has been marked as a duplicate of this bug. ***

[Steven Hollingsworth]

Bug continues to occur.

[Cameron Zwarich (cpst)]

The third stack trace is probably the same issue as bug 17329, which is now fixed, whereas the first two are likely the same distinct bug.

[Steven Hollingsworth]

Comment on attachment 18991 [details]
Problem Report for Webkit

Same as bug 17329, which has been fixed.

[Cameron Zwarich (cpst)]

All of the stack traces look the same (I didn't check all the way back) so it is probably the same JS causing the crash each time. It's also sort of strange that the crash is on dereferencing a null pointer rather than something offset from zero. Where would that be happening in JSNodeList::indexGetter()?

[Steven Hollingsworth]

Created attachment 19165 [details]
Problem Report for WebKit

Just had this issue again while loading AmpCoder.com in one tab and an already loaded GoDaddy.com in the other.

[Alexey Proskuryakov]

(In reply to comment #14)
> It's also sort of strange that the crash is on dereferencing a null pointer
> rather than something offset from zero.

AFAICT, the crash may be happening in a virtual node->nodeType() call in toJS(ExecState*, PassRefPtr<Node> n) in JSNodeCustom.cpp.

[Steven Hollingsworth]

Created attachment 19183 [details]
Problem Report for Webkit

Just had another crash while browsing through Gmail.

[Alexey Proskuryakov]

*** Bug 17399 has been marked as a duplicate of this bug. ***

[Alexey Proskuryakov]

Marking confirmed since this keeps happening, and we have a duplicate - although I never saw this myself.

[Alexey Proskuryakov]

<rdar://problem/5749117>

[Steven Hollingsworth]

Created attachment 19194 [details]
Problem Report for WebKit

Just had this issue occur while iGoogle loading iGoogle in a single window.

[Steven Hollingsworth]

Created attachment 19195 [details]
Problem Report for WebKit

Just had this issue after composing a message in Gmail and clicking "Send".

[David Kilzer (:ddkilzer)]

The call stack in the crashing thread is awfully deep (180+ frames).  Could this be related to removing the KJS_MEM_LIMIT in r30492?

http://trac.webkit.org/projects/webkit/changeset/30492

Steven, if you use a WebKit nightly build before r30492, do you still see crashes?

[David Kilzer (:ddkilzer)]

I think it's fair to say that this is a regression as well.

[David Kilzer (:ddkilzer)]

(In reply to comment #23)
> The call stack in the crashing thread is awfully deep (180+ frames).  Could
> this be related to removing the KJS_MEM_LIMIT in r30492?
> 
> http://trac.webkit.org/projects/webkit/changeset/30492

Hmm...that didn't make much sense.  KJS_MAX_STACK was raised from 100 to 500 in r25161, but that was a while time ago.

Please ignore Comment #23. :)

[Ismail Donmez]

I frequently see this at GMail using latest SVN.

[Steven Hollingsworth]

I just had this issue while working on a Spreadsheet in Google Docs.

[Maciej Stachowiak]

We're actively investigating this bug. If anyone can reproduce it running under gdb, please find a WebKit developer (especially weinig, bdash, darin or maciej) on IRC.

[Sam Weinig]

Fix landed in r31144.