129271 2014-02-24 13:28:39 -0800 REGRESSION(r164493): DYEBench crash in JSCObject::put 2014-03-25 18:12:04 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED WORKSFORME https://trac.webkit.org/export/162218/trunk/PerformanceTests/DoYouEvenBench/Full.html InRadar P2 Normal --- 1 rniwa rniwa fpizlo ggaren mhahnenberg webkit-bug-importer oldest_to_newest 984037 0 rniwa 2014-02-24 13:28:39 -0800 Reproduction steps 1. Go to https://trac.webkit.org/export/162218/trunk/PerformanceTests/DoYouEvenBench/InteractiveRunner.html 2. Uncheck "VanillaJS-TodoMVC" 3. Click "Run". Crash 984038 1 webkit-bug-importer 2014-02-24 13:29:18 -0800 <rdar://problem/16151521> 984058 2 mhahnenberg 2014-02-24 13:58:32 -0800 Is there a symbolicated crash log somewhere to look at? 984070 3 mhahnenberg 2014-02-24 14:27:45 -0800 This still reproduces with JSC_alwaysDoFullCollection=1 which implies it's not caused by the premature deallocation of a live object. 984073 4 mhahnenberg 2014-02-24 14:32:32 -0800 (In reply to comment #3) > This still reproduces with JSC_alwaysDoFullCollection=1 which implies it's not caused by the premature deallocation of a live object. I should say, it's not a premature deallocation of a live object due to generational collection. We could still be blowing away a live object during a full collection. 994297 5 mhahnenberg 2014-03-25 13:09:55 -0700 Throwing back to Ryosuke to verify that this has been fixed. 994460 6 rniwa 2014-03-25 18:12:04 -0700 No longer seeing the crash.