112263 2013-03-13 09:12:20 -0700 Crash in JSC::CodeCacheMap::pruneSlowCase() running svg/css/scientific-numbers.html 2013-08-13 14:53:26 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED DUPLICATE 113453 InRadar, MakingBotsRed P2 Normal --- 1 simon.fraser webkit-unassigned fpizlo ggaren rniwa simon.fraser webkit-bug-importer oldest_to_newest 854343 0 simon.fraser 2013-03-13 09:12:20 -0700 http://build.webkit.org/results/Apple%20Lion%20Release%20WK2%20(Tests)/r145717%20(8825)/svg/css/scientific-numbers-crash-log.txt Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x000000000000000c VM Regions Near 0xc: --> __TEXT 000000010091a000-000000010091d000 [ 12K] r-x/rwx SM=COW /Volumes/VOLUME/*/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Application Specific Information: objc[63762]: garbage collection is OFF CRASHING TEST: svg/css/scientific-numbers.html Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010115c5dc JSC::CodeCacheMap::pruneSlowCase() + 140 (SourceCode.h:89) 1 com.apple.JavaScriptCore 0x000000010115daf1 JSC::CodeCacheMap::add(JSC::SourceCodeKey const&, JSC::SourceCodeValue const&) + 81 (HashMap.h:336) 2 com.apple.JavaScriptCore 0x000000010115cc97 JSC::UnlinkedProgramCodeBlock* JSC::CodeCache::getCodeBlock<JSC::UnlinkedProgramCodeBlock, JSC::ProgramExecutable>(JSC::JSGlobalData&, JSC::JSScope*, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictness, JSC::DebuggerMode, JSC::ProfilerMode, JSC::ParserError&) + 151 (Handle.h:59) 3 com.apple.JavaScriptCore 0x000000010115c6f4 JSC::CodeCache::getProgramCodeBlock(JSC::JSGlobalData&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictness, JSC::DebuggerMode, JSC::ProfilerMode, JSC::ParserError&) + 52 (CodeCache.cpp:119) 4 com.apple.JavaScriptCore 0x00000001012bc4aa JSC::JSGlobalObject::createProgramCodeBlock(JSC::ExecState*, JSC::ProgramExecutable*, JSC::JSObject**) + 154 (JSGlobalObject.cpp:607) 5 com.apple.JavaScriptCore 0x000000010122cda3 JSC::ProgramExecutable::initializeGlobalProperties(JSC::JSGlobalData&, JSC::ExecState*, JSC::JSScope*) + 131 (Executable.cpp:384) 6 com.apple.JavaScriptCore 0x000000010123f89e JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 3758 (Interpreter.cpp:959) 7 com.apple.JavaScriptCore 0x0000000101162fcb JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 619 (Completion.cpp:75) 8 com.apple.WebCore 0x00000001021ee9ba WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*) + 442 (JSMainThreadExecState.h:77) 9 com.apple.WebCore 0x00000001021eeb49 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 41 (ScriptController.cpp:158) 10 com.apple.WebCore 0x00000001021f7e04 WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 500 (ScriptValue.h:52) 11 com.apple.WebCore 0x00000001021f8126 WebCore::ScriptElement::execute(WebCore::CachedScript*) + 86 (ScriptSourceCode.h:44) 12 com.apple.WebCore 0x00000001021feba6 WebCore::ScriptRunner::timerFired(WebCore::Timer<WebCore::ScriptRunner>*) + 454 (ScriptRunner.cpp:122) 13 com.apple.WebCore 0x00000001023b224f WebCore::ThreadTimers::sharedTimerFiredInternal() + 175 (ThreadTimers.cpp:132) 14 com.apple.WebCore 0x0000000102244143 _ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv + 51 (SharedTimerMac.mm:166) 15 com.apple.CoreFoundation 0x00007fff98a02934 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 857128 1 webkit-bug-importer 2013-03-18 08:17:23 -0700 <rdar://problem/13441562> 857129 2 simon.fraser 2013-03-18 08:17:44 -0700 Another one in tables/table-section-overflow-clip-crash.html: http://build.webkit.org/results/Apple%20Lion%20Release%20WK1%20(Tests)/r146065%20(10518)/tables/table-section-overflow-clip-crash-crash-log.txt Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x000000000000000c VM Regions Near 0xc: --> __TEXT 000000010be07000-000000010be66000 [ 380K] r-x/rwx SM=COW /Volumes/VOLUME/* Application Specific Information: CRASHING TEST: tables/table-section-overflow-clip-crash.html objc[3174]: garbage collection is OFF Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010bf6e85c JSC::CodeCacheMap::pruneSlowCase() + 140 (SourceCode.h:89) 1 com.apple.JavaScriptCore 0x000000010bf6fd71 JSC::CodeCacheMap::add(JSC::SourceCodeKey const&, JSC::SourceCodeValue const&) + 81 (HashMap.h:336) 2 com.apple.JavaScriptCore 0x000000010bf6ef17 JSC::UnlinkedProgramCodeBlock* JSC::CodeCache::getCodeBlock<JSC::UnlinkedProgramCodeBlock, JSC::ProgramExecutable>(JSC::JSGlobalData&, JSC::JSScope*, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictness, JSC::DebuggerMode, JSC::ProfilerMode, JSC::ParserError&) + 151 (Handle.h:59) 3 com.apple.JavaScriptCore 0x000000010bf6e974 JSC::CodeCache::getProgramCodeBlock(JSC::JSGlobalData&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictness, JSC::DebuggerMode, JSC::ProfilerMode, JSC::ParserError&) + 52 (CodeCache.cpp:119) 4 com.apple.JavaScriptCore 0x000000010c0ce62a JSC::JSGlobalObject::createProgramCodeBlock(JSC::ExecState*, JSC::ProgramExecutable*, JSC::JSObject**) + 154 (JSGlobalObject.cpp:614) 5 com.apple.JavaScriptCore 0x000000010c03efb3 JSC::ProgramExecutable::initializeGlobalProperties(JSC::JSGlobalData&, JSC::ExecState*, JSC::JSScope*) + 131 (Executable.cpp:384) 6 com.apple.JavaScriptCore 0x000000010c051aae JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 3758 (Interpreter.cpp:959) 7 com.apple.JavaScriptCore 0x000000010bf7524b JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 619 (Completion.cpp:75) 8 com.apple.WebCore 0x000000010d3add6a WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*) + 442 (JSMainThreadExecState.h:77) 9 com.apple.WebCore 0x000000010d3adef9 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 41 (ScriptController.cpp:158) 10 com.apple.WebCore 0x000000010d3b71b4 WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 500 (ScriptValue.h:52) 11 com.apple.WebCore 0x000000010d3b5e04 WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) + 1076 (ScriptSourceCode.h:44) 12 com.apple.WebCore 0x000000010ccb8818 WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&) + 344 (ScriptElement.h:59) 13 com.apple.WebCore 0x000000010ccb8670 WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr<WebCore::Element>, WTF::TextPosition const&) + 48 (RefPtr.h:58) 14 com.apple.WebCore 0x000000010cc633c4 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 84 (PassRefPtr.h:68) 15 com.apple.WebCore 0x000000010cc63448 WebCore::HTMLDocumentParser::canTakeNextToken(WebCore::HTMLDocumentParser::SynchronousMode, WebCore::PumpSession&) + 88 (HTMLDocumentParser.cpp:288) 16 com.apple.WebCore 0x000000010cc6311e WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 366 (HTMLDocumentParser.cpp:532) 17 com.apple.WebCore 0x000000010cc639c2 WebCore::HTMLDocumentParser::append(WTF::PassRefPtr<WTF::StringImpl>) + 498 (HTMLDocumentParser.cpp:739) 18 com.apple.WebCore 0x000000010ca07135 WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter*, char const*, unsigned long) + 117 (PassRefPtr.h:68) 857130 3 webkit-bug-importer 2013-03-18 08:17:51 -0700 <rdar://problem/13441565> 916897 4 ap 2013-08-13 14:53:26 -0700 *** This bug has been marked as a duplicate of bug 113453 ***