140579 2015-01-16 17:09:17 -0800 Crash in JSScope::resolve() on tools.ups.com 2015-01-17 16:20:44 -0800 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED https://tools.usps.com/go/POLocatorAction.action P2 Normal --- 1 msaboff msaboff oldest_to_newest 1062050 0 msaboff 2015-01-16 17:09:17 -0800 Go to https://tools.usps.com/go/POLocatorAction.action and wait a few seconds and WebKit will crash similar to: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x00007fff986419c0 JSC::JSScope::resolve(JSC::ExecState*, JSC::JSScope*, JSC::Identifier const&) + 32 1 ??? 0x00002b82e56548d6 0 + 47841194363094 2 ??? 0x00002b82e565a9b2 0 + 47841194387890 3 com.apple.JavaScriptCore 0x00007fff986783fe llint_entry + 22198 4 com.apple.JavaScriptCore 0x00007fff986783fe llint_entry + 22198 5 com.apple.JavaScriptCore 0x00007fff986783fe llint_entry + 22198 6 ??? 0x00002b82e56596d6 0 + 47841194383062 7 ??? 0x00002b82e5601a20 0 + 47841194023456 8 com.apple.JavaScriptCore 0x00007fff986783fe llint_entry + 22198 9 ??? 0x00002b82e56596d6 0 + 47841194383062 10 ??? 0x00002b82e5601a20 0 + 47841194023456 11 ??? 0x00002b82e5656d68 0 + 47841194372456 12 ??? 0x00002b82e5601a20 0 + 47841194023456 13 com.apple.JavaScriptCore 0x00007fff986783fe llint_entry + 22198 14 com.apple.JavaScriptCore 0x00007fff98678633 llint_entry + 22763 15 com.apple.JavaScriptCore 0x00007fff98678506 llint_entry + 22462 16 com.apple.JavaScriptCore 0x00007fff986783fe llint_entry + 22198 17 ??? 0x00002b82e56019fa 0 + 47841194023418 18 com.apple.JavaScriptCore 0x00007fff98678633 llint_entry + 22763 19 com.apple.JavaScriptCore 0x00007fff98678571 llint_entry + 22569 20 com.apple.JavaScriptCore 0x00007fff98672b38 vmEntryToJavaScript + 326 21 com.apple.JavaScriptCore 0x00007fff985e4e29 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 22 com.apple.JavaScriptCore 0x00007fff9821cd71 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 9105 23 com.apple.JavaScriptCore 0x00007fff9821a8e4 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 484 24 com.apple.WebCore 0x00007fff994186f9 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 313 25 com.apple.WebCore 0x00007fff98871719 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 41 26 com.apple.WebCore 0x00007fff9887162a WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 298 27 com.apple.WebCore 0x00007fff98870b52 WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) + 946 28 com.apple.WebCore 0x00007fff9886fc15 WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&) + 357 29 com.apple.WebCore 0x00007fff9886fa40 WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr<WebCore::Element>, WTF::TextPosition const&) + 48 30 com.apple.WebCore 0x00007fff9886f994 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 84 31 com.apple.WebCore 0x00007fff987da6cd WebCore::HTMLDocumentParser::canTakeNextToken(WebCore::HTMLDocumentParser::SynchronousMode, WebCore::PumpSession&) + 93 32 com.apple.WebCore 0x00007fff987d97ee WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 478 33 com.apple.WebCore 0x00007fff988f87b3 WebCore::HTMLDocumentParser::resumeParsingAfterYield() + 19 34 com.apple.WebCore 0x00007fff987b7dbd WebCore::ThreadTimers::sharedTimerFiredInternal() + 157 35 com.apple.WebCore 0x00007fff987b7ce4 WebCore::timerFired(__CFRunLoopTimer*, void*) + 20 36 com.apple.CoreFoundation 0x00007fff92ea8a34 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 37 com.apple.CoreFoundation 0x00007fff92ea86c3 __CFRunLoopDoTimer + 1059 38 com.apple.CoreFoundation 0x00007fff92f1bc8d __CFRunLoopDoTimers + 301 39 com.apple.CoreFoundation 0x00007fff92e65158 __CFRunLoopRun + 2024 40 com.apple.CoreFoundation 0x00007fff92e64728 CFRunLoopRunSpecific + 296 41 com.apple.HIToolbox 0x00007fff9b46cddf RunCurrentEventLoopInMode + 235 42 com.apple.HIToolbox 0x00007fff9b46cb5a ReceiveNextEventCommon + 431 43 com.apple.HIToolbox 0x00007fff9b46c99b _BlockUntilNextEventMatchingListInModeWithFilter + 71 44 com.apple.AppKit 0x00007fff8d4826bd _DPSNextEvent + 964 45 com.apple.AppKit 0x00007fff8d481cc0 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 194 46 com.apple.AppKit 0x00007fff8d4779c3 -[NSApplication run] + 594 47 com.apple.AppKit 0x00007fff8d3f24c4 NSApplicationMain + 1832 48 libxpc.dylib 0x00007fff9bd7e958 _xpc_objc_main + 793 49 libxpc.dylib 0x00007fff9bd80060 xpc_main + 490 50 com.apple.WebKit.WebContent 0x10d423b30 main + 16 (/SourceCache/WebKit2/WebKit2-7601.1.12/Shared/EntryPointUtilities/mac/XPCService/XPCServiceMain.mm:80) 51 libdyld.dylib 0x00007fff8f2065c9 start + 1 1062089 1 244837 msaboff 2015-01-16 22:29:40 -0800 Created attachment 244837 Patch 1062125 2 244837 ggaren 2015-01-17 13:50:33 -0800 Comment on attachment 244837 Patch r=me 1062139 3 msaboff 2015-01-17 16:20:44 -0800 Committed r178629: <http://trac.webkit.org/changeset/178629> 244837 2015-01-16 22:29:40 -0800 2015-01-17 13:50:33 -0800 Patch 140579.patch text/plain 4653 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTc4NjIxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDE1LTAxLTE2ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyYXNoIGluIEpTU2NvcGU6OnJlc29sdmUoKSBvbiB0b29scy51cHMuY29tCisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDA1NzkKKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBGb3Igb3BfcmVzb2x2ZV9z Y29wZSBvZiBhIGdsb2JhbCBwcm9wZXJ0eSBvciB2YXJpYWJsZSB0aGF0IG5lZWQgdG8gY2hlY2sg Zm9yIHRoZSB2YXIKKyAgICAgICAgaW5qZWN0aW9uIGNoZWNrIHdhdGNocG9pbnQsIHdlIG5lZWQg dG8ga2VlcCB0aGUgc2NvcGUgYXJvdW5kIHdpdGggYSBQaGFudG9tLiAgVGhlCisgICAgICAgIGJh c2VsaW5lIEpJVCBzbG93cGF0aCBmb3Igb3BfcmVzb2x2ZV9zY29wZSBuZWVkcyB0aGUgc2NvcGUg dmFsdWUuIGlmIHRoZSB3YXRjaHBvaW50CisgICAgICAgIGZpcmVkLgorCisgICAgICAgICogZGZn L0RGR0J5dGVDb2RlUGFyc2VyLmNwcDoKKyAgICAgICAgKEpTQzo6REZHOjpCeXRlQ29kZVBhcnNl cjo6cGFyc2VCbG9jayk6CisKIDIwMTUtMDEtMTYgIEJyaWFuIEouIEJ1cmcgIDxidXJnQGNzLndh c2hpbmd0b24uZWR1PgogCiAgICAgICAgIFdlYiBJbnNwZWN0b3I6IGNvZGUgZ2VuZXJhdG9yIHNo b3VsZCBpbnRyb2R1Y2UgdHlwZWRlZnMgZm9yIHByb3RvY29sIHR5cGVzIHRoYXQgYXJlIGFycmF5 cwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdCeXRlQ29kZVBhcnNlci5jcHAK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdCeXRlQ29kZVBhcnNl ci5jcHAJKHJldmlzaW9uIDE3ODYyMCkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZH Qnl0ZUNvZGVQYXJzZXIuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0zMTg3LDYgKzMxODcsOCBAQCBi b29sIEJ5dGVDb2RlUGFyc2VyOjpwYXJzZUJsb2NrKHVuc2lnbmVkCiAgICAgICAgICAgICBjYXNl IEdsb2JhbFByb3BlcnR5V2l0aFZhckluamVjdGlvbkNoZWNrczoKICAgICAgICAgICAgIGNhc2Ug R2xvYmFsVmFyV2l0aFZhckluamVjdGlvbkNoZWNrczoKICAgICAgICAgICAgICAgICBzZXQoVmly dHVhbFJlZ2lzdGVyKGRzdCksIHdlYWtKU0NvbnN0YW50KG1faW5saW5lU3RhY2tUb3AtPm1fY29k ZUJsb2NrLT5nbG9iYWxPYmplY3QoKSkpOworICAgICAgICAgICAgICAgIGlmIChyZXNvbHZlVHlw ZSA9PSBHbG9iYWxQcm9wZXJ0eVdpdGhWYXJJbmplY3Rpb25DaGVja3MgfHwgcmVzb2x2ZVR5cGUg PT0gR2xvYmFsVmFyV2l0aFZhckluamVjdGlvbkNoZWNrcykKKyAgICAgICAgICAgICAgICAgICAg YWRkVG9HcmFwaChQaGFudG9tLCBnZXREaXJlY3QobV9pbmxpbmVTdGFja1RvcC0+cmVtYXBPcGVy YW5kKFZpcnR1YWxSZWdpc3RlcihjdXJyZW50SW5zdHJ1Y3Rpb25bMl0udS5vcGVyYW5kKSkpKTsK ICAgICAgICAgICAgICAgICBicmVhazsKICAgICAgICAgICAgIGNhc2UgTG9jYWxDbG9zdXJlVmFy OgogICAgICAgICAgICAgY2FzZSBDbG9zdXJlVmFyOgpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdl TG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMTc4NjIx KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTkg QEAKKzIwMTUtMDEtMTYgIE1pY2hhZWwgU2Fib2ZmICA8bXNhYm9mZkBhcHBsZS5jb20+CisKKyAg ICAgICAgQ3Jhc2ggaW4gSlNTY29wZTo6cmVzb2x2ZSgpIG9uIHRvb2xzLnVwcy5jb20KKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0MDU3OQorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE5ldyByZWdyZXNzaW9u IHRlc3QuCisKKyAgICAgICAgKiBqcy9yZWdyZXNzLTE0MDU3OS1leHBlY3RlZC50eHQ6IEFkZGVk LgorICAgICAgICAqIGpzL3JlZ3Jlc3MtMTQwNTc5Lmh0bWw6IEFkZGVkLgorICAgICAgICAqIGpz L3NjcmlwdC10ZXN0cy9yZWdyZXNzLTE0MDU3OS5qczogQWRkZWQuCisgICAgICAgIChUZXN0LnRo aXMuaXNTdHJpbmcpOgorICAgICAgICAoVGVzdC50aGlzLnRlc3QpOgorICAgICAgICAoVGVzdCk6 CisKIDIwMTUtMDEtMTYgIERhbmllbCBCYXRlcyAgPGRhYmF0ZXNAYXBwbGUuY29tPgogCiAgICAg ICAgIFVwZGF0ZSBzb21lIGV4cGVjdGVkIHJlc3VsdHMgZm9yIGlPUwpJbmRleDogTGF5b3V0VGVz dHMvanMvcmVncmVzcy0xNDA1NzktZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRl c3RzL2pzL3JlZ3Jlc3MtMTQwNTc5LWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91 dFRlc3RzL2pzL3JlZ3Jlc3MtMTQwNTc5LWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAt MCwwICsxLDEwIEBACitSZWdyZXNzaW9uIHRlc3QgZm9yIGh0dHBzOi8vd2Via2l0Lm9yZy9iLzE0 MDU3OS4gVGhpcyB0ZXN0IHNob3VsZCBydW4gd2l0aG91dCBjcmFzaGluZy4KKworT24gc3VjY2Vz cywgeW91IHdpbGwgc2VlIGEgc2VyaWVzIG9mICJQQVNTIiBtZXNzYWdlcywgZm9sbG93ZWQgYnkg IlRFU1QgQ09NUExFVEUiLgorCisKK1BBU1Mgby50ZXN0KCkgPT0gNTAwMCBpcyB0cnVlCitQQVNT IHN1Y2Nlc3NmdWxseVBhcnNlZCBpcyB0cnVlCisKK1RFU1QgQ09NUExFVEUKKwpJbmRleDogTGF5 b3V0VGVzdHMvanMvcmVncmVzcy0xNDA1NzkuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0 cy9qcy9yZWdyZXNzLTE0MDU3OS5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvanMv cmVncmVzcy0xNDA1NzkuaHRtbAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDEwIEBACis8IURP Q1RZUEUgSFRNTCBQVUJMSUMgIi0vL0lFVEYvL0RURCBIVE1MLy9FTiI+Cis8aHRtbD4KKzxoZWFk PgorPHNjcmlwdCBzcmM9Ii4uL3Jlc291cmNlcy9qcy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+Cis8 L2hlYWQ+Cis8Ym9keT4KKzxzY3JpcHQgc3JjPSJzY3JpcHQtdGVzdHMvcmVncmVzcy0xNDA1Nzku anMiPjwvc2NyaXB0PgorPHNjcmlwdCBzcmM9Ii4uL3Jlc291cmNlcy9qcy10ZXN0LXBvc3QuanMi Pjwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgpJbmRleDogTGF5b3V0VGVzdHMvanMvc2NyaXB0 LXRlc3RzL3JlZ3Jlc3MtMTQwNTc5LmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2pzL3Nj cmlwdC10ZXN0cy9yZWdyZXNzLTE0MDU3OS5qcwkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3Rz L2pzL3NjcmlwdC10ZXN0cy9yZWdyZXNzLTE0MDU3OS5qcwkod29ya2luZyBjb3B5KQpAQCAtMCww ICsxLDM1IEBACitkZXNjcmlwdGlvbigKKyJSZWdyZXNzaW9uIHRlc3QgZm9yIGh0dHBzOi8vd2Vi a2l0Lm9yZy9iLzE0MDU3OS4gVGhpcyB0ZXN0IHNob3VsZCBydW4gd2l0aG91dCBjcmFzaGluZy4i CispOworCitmdW5jdGlvbiBUZXN0KG1heENvdW50KQoreworICAgIHRoaXMuZHVtbXkgPSBldmFs KCIwIik7CisKKyAgICB0aGlzLmlzU3RyaW5nID0gZnVuY3Rpb24odikgeworICAgICAgICByZXR1 cm4gKHR5cGVvZiB2ID09ICJzdHJpbmciIHx8IHYgaW5zdGFuY2VvZiBTdHJpbmcpOworICAgIH07 CisKKyAgICB0aGlzLnRlc3QgPSBmdW5jdGlvbigpCisgICAgeworICAgICAgICB2YXIgY291bnQg PSBldmFsKCIwIik7CisgICAgICAgIHZhciBzID0gImFiYyI7CisKKyAgICAgICAgZm9yICh2YXIg aSA9IDA7IGkgPCBtYXhDb3VudDsgaSsrKSB7CisgICAgICAgICAgICBpZiAoaSA9PSA0NTAwKSB7 CisgICAgICAgICAgICAgICAgcyA9IG5ldyBTdHJpbmcoInh5eiIpOyAvLyBDYXVzZSBhIEJhZFR5 cGUgT1NSIGV4aXQgaW4gaXNTdHJpbmcoKQorCQlldmFsKCJ2YXIgeCA9IDM7Iik7ICAvLyBGaXJl IHZhciBpbmplY3Rpb24gd2F0Y2hwb2ludAorCSAgICB9CisKKyAgICAgICAgICAgIGlmICh0aGlz LmlzU3RyaW5nKHMpKQorICAgICAgICAgICAgICAgIGNvdW50Kys7CisgICAgICAgIH0KKworICAg ICAgICByZXR1cm4gY291bnQ7CisgICAgfTsKK30KKworbyA9IG5ldyBUZXN0KDUwMDApOworCitz aG91bGRCZVRydWUoIm8udGVzdCgpID09IDUwMDAiKTsKKyAK