119170 2013-07-26 16:04:11 -0700 ASSERT failure in wtf/CheckedBoolean.h line 43 on Windows 2013-07-26 16:51:43 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All Windows 7 RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff oldest_to_newest 912151 0 msaboff 2013-07-26 16:04:11 -0700 On Windows debug build, we get an ASSERT failure in CheckedBoolean.h. Example traceback: WTF.dll!WTFCrash() Line 339C++ JavaScriptCore.dll!CheckedBoolean::~CheckedBoolean() Line 43 + 0x36 bytesC++ JavaScriptCore.dll!JSC::Heap::tryAllocateStorage(JSC::JSCell * intendedOwner, unsigned int bytes, void * * outPtr) Line 423 + 0x12 bytesC++ JavaScriptCore.dll!JSC::Butterfly::createUninitialized(JSC::VM & vm, JSC::JSCell * intendedOwner, unsigned int preCapacity, unsigned int propertyCapacity, bool hasIndexingHeader, unsigned int indexingPayloadSizeInBytes) Line 42 + 0x1b bytesC++ JavaScriptCore.dll!JSC::Butterfly::growPropertyStorage(JSC::VM & vm, JSC::JSCell * intendedOwner, unsigned int preCapacity, unsigned int oldPropertyCapacity, bool hasIndexingHeader, unsigned int indexingPayloadSizeInBytes, unsigned int newPropertyCapacity) Line 85 + 0x1e bytesC++ >JavaScriptCore.dll!JSC::Butterfly::growPropertyStorage(JSC::VM & vm, JSC::JSCell * intendedOwner, JSC::Structure * structure, unsigned int oldPropertyCapacity, unsigned int newPropertyCapacity) Line 101C++ JavaScriptCore.dll!JSC::JSObject::growOutOfLineStorage(JSC::VM & vm, unsigned int oldSize, unsigned int newSize) Line 2379C++ JavaScriptCore.dll!JSC::JSObject::setStructureAndReallocateStorageIfNecessary(JSC::VM & vm, unsigned int oldCapacity, JSC::Structure * newStructure) Line 1356 + 0x19 bytesC++ JavaScriptCore.dll!JSC::JSObject::setStructureAndReallocateStorageIfNecessary(JSC::VM & vm, JSC::Structure * newStructure) Line 1364C++ JavaScriptCore.dll!JSC::JSObject::putDirectInternal<1>(JSC::VM & vm, JSC::PropertyName propertyName, JSC::JSValue value, unsigned int attributes, JSC::PutPropertySlot & slot, JSC::JSCell * specificFunction) Line 1336C++ JavaScriptCore.dll!JSC::JSObject::putDirect(JSC::VM & vm, JSC::PropertyName propertyName, JSC::JSValue value, unsigned int attributes) Line 1380C++ JavaScriptCore.dll!JSC::InternalFunction::finishCreation(JSC::VM & vm, const WTF::String & name) Line 48C++ JavaScriptCore.dll!JSC::FunctionPrototype::finishCreation(JSC::ExecState * exec, const WTF::String & name) Line 53C++ JavaScriptCore.dll!JSC::FunctionPrototype::create(JSC::ExecState * exec, JSC::JSGlobalObject * globalObject, JSC::Structure * structure) Line 35 + 0x15 bytesC++ JavaScriptCore.dll!JSC::JSGlobalObject::reset(JSC::JSValue prototype) Line 201 + 0x39 bytesC++ JavaScriptCore.dll!JSC::JSGlobalObject::init(JSC::JSObject * thisValue) Line 148C++ WebKit.dll!JSC::JSGlobalObject::finishCreation(JSC::VM & vm, JSC::JSObject * thisValue) Line 229C++ WebKit.dll!WebCore::JSDOMGlobalObject::finishCreation(JSC::VM & vm, JSC::JSObject * thisValue) Line 66C++ WebKit.dll!WebCore::JSDOMWindowBase::finishCreation(JSC::VM & vm, WebCore::JSDOMWindowShell * shell) Line 65C++ WebKit.dll!WebCore::JSDOMWindow::create(JSC::VM & vm, JSC::Structure * structure, WTF::PassRefPtr<WebCore::DOMWindow> impl, WebCore::JSDOMWindowShell * windowShell) Line 42C++ WebKit.dll!WebCore::JSDOMWindowShell::setWindow(WTF::PassRefPtr<WebCore::DOMWindow> domWindow) Line 84 + 0x1f bytesC++ WebKit.dll!WebCore::JSDOMWindowShell::finishCreation(JSC::VM & vm, WTF::PassRefPtr<WebCore::DOMWindow> window) Line 57C++ WebKit.dll!WebCore::JSDOMWindowShell::create(WTF::PassRefPtr<WebCore::DOMWindow> window, JSC::Structure * structure, WebCore::DOMWrapperWorld * world) Line 59C++ WebKit.dll!WebCore::ScriptController::createWindowShell(WebCore::DOMWrapperWorld * world) Line 110 + 0x28 bytesC++ WebKit.dll!WebCore::ScriptController::initScript(WebCore::DOMWrapperWorld * world) Line 213 + 0xc bytesC++ WebKit.dll!WebCore::ScriptController::windowShell(WebCore::DOMWrapperWorld * world) Line 79 + 0x43 bytesC++ WebKit.dll!WebCore::ScriptController::globalObject(WebCore::DOMWrapperWorld * world) Line 88 + 0xc bytesC++ WebKit.dll!WebFrame::globalContext() Line 534 + 0x15 bytesC++ DumpRenderTree.dll!resetWebViewToConsistentStateBeforeTesting() Line 916 + 0x13 bytesC++ DumpRenderTree.dll!runTest(const std::basic_string<char,std::char_traits<char>,std::allocator<char> > & inputLine) Line 1091C++ DumpRenderTree.dll!dllLauncherEntryPoint(int argc, const char * * argv) Line 1424 + 0x23 bytesC++ DumpRenderTree.exe!main(int argc, const char * * argv) Line 209 + 0xe bytesC++ DumpRenderTree.exe!__tmainCRTStartup() Line 555 + 0x17 bytesC mi 912157 1 207561 msaboff 2013-07-26 16:12:32 -0700 Created attachment 207561 Patch This patch has already been reviewed. Written by Oliver, to be landed by me. 912159 2 msaboff 2013-07-26 16:15:25 -0700 <rdar://problem/14563179> 912167 3 msaboff 2013-07-26 16:51:43 -0700 Fix landed in change set https://trac.webkit.org/changeset/153387. 207561 2013-07-26 16:12:32 -0700 2013-07-26 16:12:32 -0700 Patch 119170.patch text/plain 1405 msaboff SW5kZXg6IFNvdXJjZS9XVEYvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvQ2hh bmdlTG9nCShyZXZpc2lvbiAxNTMzODYpCisrKyBTb3VyY2UvV1RGL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBACisyMDEzLTA3LTI2ICBPbGl2ZXIgSHVudCA8b2xpdmVy QGFwcGxlLmNvbT4KKworICAgICAgICBBU1NFUlQgZmFpbHVyZSBpbiB3dGYvQ2hlY2tlZEJvb2xl YW4uaCBsaW5lIDQzIG9uIFdpbmRvd3MKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTExOTE3MAorCisgICAgICAgIFJldmlld2VkIGJ5IE1pY2hhZWwgU2Fi b2ZmLgorCisgICAgICAgIEFkZGVkIGEgY29weSBjb25zdHJ1Y3RvciB0byBDaGVja2VkQm9vbGVh bi4KKworICAgICAgICAqIHd0Zi9DaGVja2VkQm9vbGVhbi5oOgorICAgICAgICAoQ2hlY2tlZEJv b2xlYW46OkNoZWNrZWRCb29sZWFuKToKKwogMjAxMy0wNy0yNSAgQnJlbnQgRnVsZ2hhbSAgPGJm dWxnaGFtQGFwcGxlLmNvbT4KIAogICAgICAgICBbV2luZG93c10gVW5yZXZpZXdlZCBidWlsZCBm aXguCkluZGV4OiBTb3VyY2UvV1RGL3d0Zi9DaGVja2VkQm9vbGVhbi5oCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IFNvdXJjZS9XVEYvd3RmL0NoZWNrZWRCb29sZWFuLmgJKHJldmlzaW9uIDE1MzM4NikKKysrIFNv dXJjZS9XVEYvd3RmL0NoZWNrZWRCb29sZWFuLmgJKHdvcmtpbmcgY29weSkKQEAgLTMwLDEwICsz MCwxOSBAQAogCiBjbGFzcyBDaGVja2VkQm9vbGVhbiB7CiBwdWJsaWM6CisjaWYgIUFTU0VSVF9E SVNBQkxFRAorICAgIENoZWNrZWRCb29sZWFuKGNvbnN0IENoZWNrZWRCb29sZWFuJiBvdGhlcikK KyAgICAgICAgOiBtX3ZhbHVlKG90aGVyLm1fdmFsdWUpCisgICAgICAgICwgbV9jaGVja2VkKGZh bHNlKQorICAgIHsKKyAgICAgICAgb3RoZXIubV9jaGVja2VkID0gdHJ1ZTsKKyAgICB9CisjZW5k aWYKKwogICAgIENoZWNrZWRCb29sZWFuKGJvb2wgdmFsdWUpCi0gICAgOiBtX3ZhbHVlKHZhbHVl KQorICAgICAgICA6IG1fdmFsdWUodmFsdWUpCiAjaWYgIUFTU0VSVF9ESVNBQkxFRAotICAgICwg bV9jaGVja2VkKGZhbHNlKQorICAgICAgICAsIG1fY2hlY2tlZChmYWxzZSkKICNlbmRpZgogICAg IHsKICAgICB9CkBAIC01NCw3ICs2Myw3IEBAIHB1YmxpYzoKIHByaXZhdGU6CiAgICAgYm9vbCBt X3ZhbHVlOwogI2lmICFBU1NFUlRfRElTQUJMRUQKLSAgICBib29sIG1fY2hlY2tlZDsKKyAgICBt dXRhYmxlIGJvb2wgbV9jaGVja2VkOwogI2VuZGlmCiB9OwogCg==