<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>142639</bug_id>
          
          <creation_ts>2015-03-12 13:33:43 -0700</creation_ts>
          <short_desc>editing/selection/select-bidi-run.html crashed in bmalloc</short_desc>
          <delta_ts>2015-03-13 12:46:31 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Tools / Tests</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>DUPLICATE</resolution>
          <dup_id>142642</dup_id>
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Simon Fraser (smfr)">simon.fraser</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>ap</cc>
    
    <cc>cdumez</cc>
    
    <cc>enrica</cc>
    
    <cc>ggaren</cc>
    
    <cc>simon.fraser</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1076729</commentid>
    <comment_count>0</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2015-03-12 13:33:43 -0700</bug_when>
    <thetext>https://build.webkit.org/results/Apple%20Yosemite%20Debug%20WK2%20(Tests)/r181448%20(2723)/editing/selection/select-bidi-run-crash-log.txt</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1076730</commentid>
    <comment_count>1</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2015-03-12 13:34:14 -0700</bug_when>
    <thetext>Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x000000010d7aeff0 bmalloc::LargeObject::validateSelf() const + 128
1   com.apple.JavaScriptCore      	0x000000010d7aee81 bmalloc::LargeObject::validate() const + 225
2   com.apple.JavaScriptCore      	0x000000010d7b107f bmalloc::LargeObject::LargeObject(void*) + 95
3   com.apple.JavaScriptCore      	0x000000010d7b0d9d bmalloc::LargeObject::LargeObject(void*) + 29
4   com.apple.JavaScriptCore      	0x000000010d7b0199 bmalloc::Allocator::reallocate(void*, unsigned long) + 361
5   com.apple.JavaScriptCore      	0x000000010d76fb06 bmalloc::Cache::reallocate(void*, unsigned long) + 86
6   com.apple.JavaScriptCore      	0x000000010d76eecd bmalloc::api::realloc(void*, unsigned long) + 29
7   com.apple.JavaScriptCore      	0x000000010d76ebbd WTF::fastRealloc(void*, unsigned long) + 29
8   com.apple.JavaScriptCore      	0x000000010d79492b WTF::Ref&lt;WTF::StringImpl&gt; WTF::StringImpl::reallocateInternal&lt;unsigned char&gt;(WTF::PassRefPtr&lt;WTF::StringImpl&gt;, unsigned int, unsigned char*&amp;) + 299
9   com.apple.JavaScriptCore      	0x000000010d78b330 WTF::StringImpl::reallocate(WTF::PassRefPtr&lt;WTF::StringImpl&gt;, unsigned int, unsigned char*&amp;) + 128
10  com.apple.JavaScriptCore      	0x000000010d789346 void WTF::StringBuilder::reallocateBuffer&lt;unsigned char&gt;(unsigned int) + 310
11  com.apple.JavaScriptCore      	0x000000010d789f42 WTF::StringBuilder::shrinkToFit() + 66
12  com.apple.WebCore             	0x000000010edbf3a7 WTF::StringBuilder::toString() + 39 (StringBuilder.h:178)
13  com.apple.WebCore             	0x0000000110d00c1e WebCore::plainText(WebCore::Range const*, unsigned short, bool) + 334 (TextIterator.cpp:2536)
14  com.apple.WebCore             	0x000000010f4186d8 WebCore::DOMSelection::toString() + 120 (DOMSelection.cpp:492)
15  com.apple.WebCore             	0x000000010fc8a0a4 WebCore::jsDOMSelectionPrototypeFunctionToString(JSC::ExecState*) + 404 (JSDOMSelection.cpp:573)
16  ???                           	0x00003d2699801028 0 + 67235993358376
17  ???                           	0x00003d269989462d 0 + 67235993962029
18  com.apple.JavaScriptCore      	0x000000010d4f8ec6 llint_entry + 25658
19  com.apple.JavaScriptCore      	0x000000010d4f2849 vmEntryToJavaScript + 361
20  com.apple.JavaScriptCore      	0x000000010d3740ea JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 266
21  com.apple.JavaScriptCore      	0x000000010d3576a5 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 4853
22  com.apple.JavaScriptCore      	0x000000010ceb4d10 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&amp;, JSC::JSValue, JSC::JSValue*) + 480
23  com.apple.WebCore             	0x000000010fe4c545 WebCore::JSMainThreadExecState::evaluate(JSC::ExecState*, JSC::SourceCode const&amp;, JSC::JSValue, JSC::JSValue*) + 69 (JSMainThreadExecState.h:62)
24  com.apple.WebCore             	0x0000000110890abd WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&amp;, WebCore::DOMWrapperWorld&amp;) + 317 (ScriptController.cpp:164)
...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1076858</commentid>
    <comment_count>2</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2015-03-12 23:14:33 -0700</bug_when>
    <thetext>Is this the same as bug 142642?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1076991</commentid>
    <comment_count>3</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2015-03-13 12:46:31 -0700</bug_when>
    <thetext>

*** This bug has been marked as a duplicate of bug 142642 ***</thetext>
  </long_desc>
      
      

    </bug>

</bugzilla>