15718 2007-10-26 18:48:05 -0700 ASSERTION FAILED: _hash in KJS::UString::Rep::computedHash() 2011-01-25 19:12:47 -0800 1 1 1 Unclassified WebKit JavaScriptCore 523.x (Safari 3) Mac OS X 10.5 RESOLVED FIXED NeedsReduction, Regression P1 Normal --- 1 dev+webkit mjs ggaren mitz mjs mrowe rniwa oldest_to_newest 59588 0 dev+webkit 2007-10-26 18:48:05 -0700 Hit this assert that was just added in r27127 on either <http://developer.apple.com/> or <http://apple.com/> (both were loading at the time). Couldn't reproduce when I went back and tried though, but I figured I'd file a bug due to the newness anyway. ASSERTION FAILED: _hash (/Users/matt/Code/WebKit/JavaScriptCore/kjs/ustring.h:150 unsigned int KJS::UString::Rep::computedHash() const) Thread 0 Crashed: 0 com.apple.JavaScriptCore 0x0048b4cc KJS::UString::Rep::computedHash() const + 70 (ustring.h:150) 1 com.apple.JavaScriptCore 0x00452b7c KJS::PropertyMap::insert(KJS::UString::Rep*, KJS::JSValue*, int, int) + 88 (property_map.cpp:402) 2 com.apple.JavaScriptCore 0x004539c8 KJS::PropertyMap::createTable() + 220 (property_map.cpp:464) 3 com.apple.JavaScriptCore 0x00453a08 KJS::PropertyMap::expand() + 36 (property_map.cpp:430) 4 com.apple.JavaScriptCore 0x00453b80 KJS::PropertyMap::put(KJS::Identifier const&, KJS::JSValue*, int, bool) + 346 (property_map.cpp:348) 5 com.apple.JavaScriptCore 0x004627d8 KJS::JSObject::put(KJS::ExecState*, KJS::Identifier const&, KJS::JSValue*, int) + 640 (object.cpp:280) 6 com.apple.JavaScriptCore 0x004831ae KJS::AssignBracketNode::evaluate(KJS::ExecState*) + 914 (nodes.cpp:1732) 7 com.apple.JavaScriptCore 0x0046a237 KJS::ExprStatementNode::execute(KJS::ExecState*) + 133 (nodes.cpp:1937) 8 com.apple.JavaScriptCore 0x00451f94 KJS::SourceElementsNode::execute(KJS::ExecState*) + 60 (nodes.cpp:2821) 9 com.apple.JavaScriptCore 0x00451d90 KJS::BlockNode::execute(KJS::ExecState*) + 94 (nodes.cpp:1919) 10 com.apple.JavaScriptCore 0x00466e3d KJS::FunctionBodyNode::execute(KJS::ExecState*) + 47 (nodes.cpp:2719) 11 com.apple.JavaScriptCore 0x00447452 KJS::FunctionImp::execute(KJS::ExecState*) + 38 (function.cpp:250) 12 com.apple.JavaScriptCore 0x0046ff00 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 384 (function.cpp:91) 13 com.apple.JavaScriptCore 0x004622a2 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 222 (object.cpp:95) 14 com.apple.JavaScriptCore 0x00479257 KJS::FunctionCallBracketNode::evaluate(KJS::ExecState*) + 959 (nodes.cpp:743) 15 com.apple.JavaScriptCore 0x0046a8fc KJS::ConditionalNode::evaluate(KJS::ExecState*) + 142 (nodes.cpp:1535) 16 com.apple.JavaScriptCore 0x004834b7 KJS::AssignResolveNode::evaluate(KJS::ExecState*) + 303 (nodes.cpp:1637) 17 com.apple.JavaScriptCore 0x0046a237 KJS::ExprStatementNode::execute(KJS::ExecState*) + 133 (nodes.cpp:1937) 18 com.apple.JavaScriptCore 0x00451f94 KJS::SourceElementsNode::execute(KJS::ExecState*) + 60 (nodes.cpp:2821) 19 com.apple.JavaScriptCore 0x00451d90 KJS::BlockNode::execute(KJS::ExecState*) + 94 (nodes.cpp:1919) 20 com.apple.JavaScriptCore 0x00469c26 KJS::WhileNode::execute(KJS::ExecState*) + 344 (nodes.cpp:2036) 21 com.apple.JavaScriptCore 0x00451f94 KJS::SourceElementsNode::execute(KJS::ExecState*) + 60 (nodes.cpp:2821) 22 com.apple.JavaScriptCore 0x00451d90 KJS::BlockNode::execute(KJS::ExecState*) + 94 (nodes.cpp:1919) 23 com.apple.JavaScriptCore 0x00466e3d KJS::FunctionBodyNode::execute(KJS::ExecState*) + 47 (nodes.cpp:2719) 24 com.apple.JavaScriptCore 0x00447452 KJS::FunctionImp::execute(KJS::ExecState*) + 38 (function.cpp:250) 25 com.apple.JavaScriptCore 0x0046ff00 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 384 (function.cpp:91) 26 com.apple.JavaScriptCore 0x004622a2 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 222 (object.cpp:95) 27 com.apple.JavaScriptCore 0x00478d90 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 772 (nodes.cpp:785) 28 com.apple.JavaScriptCore 0x0046a237 KJS::ExprStatementNode::execute(KJS::ExecState*) + 133 (nodes.cpp:1937) 29 com.apple.JavaScriptCore 0x00451f94 KJS::SourceElementsNode::execute(KJS::ExecState*) + 60 (nodes.cpp:2821) 30 com.apple.JavaScriptCore 0x00451d90 KJS::BlockNode::execute(KJS::ExecState*) + 94 (nodes.cpp:1919) 31 com.apple.JavaScriptCore 0x00466e3d KJS::FunctionBodyNode::execute(KJS::ExecState*) + 47 (nodes.cpp:2719) 32 com.apple.JavaScriptCore 0x00447452 KJS::FunctionImp::execute(KJS::ExecState*) + 38 (function.cpp:250) 33 com.apple.JavaScriptCore 0x0046ff00 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 384 (function.cpp:91) 34 com.apple.JavaScriptCore 0x004622a2 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 222 (object.cpp:95) 35 com.apple.JavaScriptCore 0x00478d90 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 772 (nodes.cpp:785) 36 com.apple.JavaScriptCore 0x0046a237 KJS::ExprStatementNode::execute(KJS::ExecState*) + 133 (nodes.cpp:1937) 37 com.apple.JavaScriptCore 0x00451f94 KJS::SourceElementsNode::execute(KJS::ExecState*) + 60 (nodes.cpp:2821) 38 com.apple.JavaScriptCore 0x00451d90 KJS::BlockNode::execute(KJS::ExecState*) + 94 (nodes.cpp:1919) 39 com.apple.JavaScriptCore 0x00466e3d KJS::FunctionBodyNode::execute(KJS::ExecState*) + 47 (nodes.cpp:2719) 40 com.apple.JavaScriptCore 0x00447452 KJS::FunctionImp::execute(KJS::ExecState*) + 38 (function.cpp:250) 41 com.apple.JavaScriptCore 0x0046ff00 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 384 (function.cpp:91) 42 com.apple.JavaScriptCore 0x004622a2 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 222 (object.cpp:95) 43 com.apple.JavaScriptCore 0x00478d90 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 772 (nodes.cpp:785) 44 com.apple.JavaScriptCore 0x00451d2b KJS::AssignExprNode::evaluate(KJS::ExecState*) + 43 (nodes.cpp:1754) 45 com.apple.JavaScriptCore 0x0046a5af KJS::VarDeclNode::evaluate(KJS::ExecState*) + 299 (nodes.cpp:1815) 46 com.apple.JavaScriptCore 0x0046a437 KJS::VarDeclListNode::evaluate(KJS::ExecState*) + 51 (nodes.cpp:1855) 47 com.apple.JavaScriptCore 0x0046a31d KJS::VarStatementNode::execute(KJS::ExecState*) + 133 (nodes.cpp:1882) 48 com.apple.JavaScriptCore 0x00451f94 KJS::SourceElementsNode::execute(KJS::ExecState*) + 60 (nodes.cpp:2821) 49 com.apple.JavaScriptCore 0x00451d90 KJS::BlockNode::execute(KJS::ExecState*) + 94 (nodes.cpp:1919) 50 com.apple.JavaScriptCore 0x00466e3d KJS::FunctionBodyNode::execute(KJS::ExecState*) + 47 (nodes.cpp:2719) 51 com.apple.JavaScriptCore 0x004885ad KJS::Interpreter::evaluate(KJS::UString const&, int, KJS::UChar const*, int, KJS::JSValue*) + 823 (interpreter.cpp:366) 52 com.apple.WebCore 0x01e9338d WebCore::KJSProxy::evaluate(WebCore::String const&, int, WebCore::String const&) + 235 (kjs_proxy.cpp:87) 53 com.apple.WebCore 0x020925ba WebCore::FrameLoader::executeScript(WebCore::String const&, int, WebCore::String const&) + 92 (FrameLoader.cpp:761) 54 com.apple.WebCore 0x01ba9770 WebCore::HTMLTokenizer::scriptExecution(WebCore::DeprecatedString const&, WebCore::HTMLTokenizer::State, WebCore::DeprecatedString, int) + 308 (HTMLTokenizer.cpp:520) 55 com.apple.WebCore 0x01bab2bc WebCore::HTMLTokenizer::scriptHandler(WebCore::HTMLTokenizer::State) + 1466 (HTMLTokenizer.cpp:470) 56 com.apple.WebCore 0x01bab7c6 WebCore::HTMLTokenizer::parseSpecial(WebCore::SegmentedString&, WebCore::HTMLTokenizer::State) + 932 (HTMLTokenizer.cpp:319) 57 com.apple.WebCore 0x01bad563 WebCore::HTMLTokenizer::parseTag(WebCore::SegmentedString&, WebCore::HTMLTokenizer::State) + 6235 (HTMLTokenizer.cpp:1231) 58 com.apple.WebCore 0x01badd67 WebCore::HTMLTokenizer::write(WebCore::SegmentedString const&, bool) + 1243 (HTMLTokenizer.cpp:1449) 59 com.apple.WebCore 0x01baa172 WebCore::HTMLTokenizer::notifyFinished(WebCore::CachedResource*) + 1048 (HTMLTokenizer.cpp:1762) 60 com.apple.WebCore 0x01d0611e WebCore::CachedScript::checkNotify() + 68 (CachedScript.cpp:92) 61 com.apple.WebCore 0x01d0627f WebCore::CachedScript::data(WTF::PassRefPtr<WebCore::SharedBuffer>, bool) + 279 (CachedScript.cpp:84) 62 com.apple.WebCore 0x01d08884 WebCore::Loader::didFinishLoading(WebCore::SubresourceLoader*) + 340 (loader.cpp:116) 63 com.apple.WebCore 0x0209e11f WebCore::SubresourceLoader::didFinishLoading() + 169 (SubresourceLoader.cpp:195) 64 com.apple.WebCore 0x0209c62c WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*) + 24 (ResourceLoader.cpp:362) 65 com.apple.WebCore 0x0206bbfe -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:] + 116 (ResourceHandleMac.mm:456) 66 com.apple.Foundation 0x91496357 -[NSURLConnection(NSURLConnectionReallyInternal) sendDidFinishLoading] + 87 67 com.apple.Foundation 0x914962e4 _NSURLConnectionDidFinishLoading + 68 68 com.apple.CFNetwork 0x92c17adb sendDidFinishLoadingCallback + 148 69 com.apple.CFNetwork 0x92c149ce _CFURLConnectionSendCallbacks + 1908 70 com.apple.CFNetwork 0x92c141df muxerSourcePerform + 283 71 com.apple.CoreFoundation 0x9281f64e CFRunLoopRunSpecific + 3166 72 com.apple.CoreFoundation 0x9281fd38 CFRunLoopRunInMode + 88 73 com.apple.HIToolbox 0x90c0e8a4 RunCurrentEventLoopInMode + 283 74 com.apple.HIToolbox 0x90c0e6bd ReceiveNextEventCommon + 374 75 com.apple.HIToolbox 0x90c0e531 BlockUntilNextEventMatchingListInMode + 106 76 com.apple.AppKit 0x91fa4d5b _DPSNextEvent + 657 77 com.apple.AppKit 0x91fa46a0 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128 78 com.apple.Safari 0x00009d4e 0x1000 + 36174 79 com.apple.AppKit 0x91f9d6d1 -[NSApplication run] + 795 80 com.apple.AppKit 0x91f6a9ba NSApplicationMain + 574 81 com.apple.Safari 0x00002876 0x1000 + 6262 59597 1 dev+webkit 2007-10-26 21:15:21 -0700 Actually, Google ads trips this so it's reproducible on any site that uses them (ie: <http://digg.com/>). 59603 2 mrowe 2007-10-27 01:01:17 -0700 I can reproduce this easily at http://webkit.org/blog/wp-admin/. I'll see if I can't cook up a reduction later this evening. 59613 3 16900 mjs 2007-10-27 03:31:57 -0700 Created attachment 16900 fix 59614 4 16900 mrowe 2007-10-27 03:33:43 -0700 Comment on attachment 16900 fix r=me 59619 5 mrowe 2007-10-27 05:18:04 -0700 The buildbot is still hitting this on one test after Maciej's fix: http://build.webkit.org/results/trunk-mac-intel-debug/1868/plugins/root-object-premature-delete-crash-stderr.txt Crash log is at http://build.webkit.org/results/trunk-mac-intel-debug/1868/DumpRenderTree.crash.log. 59628 6 16902 ggaren 2007-10-27 12:16:46 -0700 Created attachment 16902 fix 2 I'm in the middle of testing, but I'm pretty sure this is right. 59629 7 16902 darin 2007-10-27 12:20:08 -0700 Comment on attachment 16902 fix 2 + if (!strlen(c)) { Need the O(1) check of c[0] instead of the O(string-length) check of strlen. I think it would be even better to do this in UString -- guarantee that null and empty both have a precomputed hash. It's annoying to have extra overhead in Identifier::add for 1-time setup. 59630 8 ggaren 2007-10-27 12:25:51 -0700 Darin suggested on IRC that we could write the hash value directly into Rep::null and Rep::empty, and ASSERT in the UString constructor that it's correct. To save time, I haven't done that, but it seems like a prudent change to make later. 59633 9 ggaren 2007-10-27 12:31:59 -0700 Committed revision 27153, with the O(n) -> O(1) change. 340091 10 rniwa 2011-01-25 19:12:47 -0800 This may have caused platform/mac/fast/AppleScript/date.html to fail on Leopard: http://build.webkit.org/results/Leopard%20Intel%20Release%20(Tests)/r76652%20(27152)/results.html http://build.webkit.org/results/Leopard%20Intel%20Release%20(Tests)/r76653%20(27153)/results.html 16900 2007-10-27 03:31:57 -0700 2007-10-27 03:33:43 -0700 fix ustring-assert.patch.txt text/plain 1142 mjs SW5kZXg6IENoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBDaGFuZ2VMb2cJKHJldmlzaW9uIDI3MTQ1 KQorKysgQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMDctMTAt MjcgIE1hY2llaiBTdGFjaG93aWFrICA8bWpzQGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdl ZCBieSBOT0JPRFkgKE9PUFMhKS4KKyAgICAgICAgCisgICAgICAgIC0gZml4ZWQgIkFTU0VSVElP TiBGQUlMRUQ6IF9oYXNoIGluIEtKUzo6VVN0cmluZzo6UmVwOjpjb21wdXRlZEhhc2goKSIKKyAg ICAgICAgaHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU3MTgKKworICAg ICAgICAqIGtqcy9pZGVudGlmaWVyLmNwcDoKKyAgICAgICAgKEtKUzo6SWRlbnRpZmllcjo6YWRk U2xvd0Nhc2UpOiBFbnN1cmUgdGhhdCBlbXB0eSBJZGVudGlmaWVycyBoYXZlIGEgaGFzaCBjb21w dXRlZCwKKyAgICAgICAgbm93IHRoYXQgd2UgY291bnQgb24gYWxsIElkZW50aWZpZXJzIGFscmVh ZHkgaGF2aW5nIG9uZS4KKwogMjAwNy0xMC0yNyAgTWFyayBSb3dlICA8bXJvd2VAYXBwbGUuY29t PgogCiAgICAgICAgIFNpbGVuY2UgYSB3YXJuaW5nLgpJbmRleDoga2pzL2lkZW50aWZpZXIuY3Bw Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIGtqcy9pZGVudGlmaWVyLmNwcAkocmV2aXNpb24gMjcxNDQpCisrKyBr anMvaWRlbnRpZmllci5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE3OSw4ICsxNzksMTAgQEAgUGFz c1JlZlB0cjxVU3RyaW5nOjpSZXA+IElkZW50aWZpZXI6OmFkZAogewogICAgIEFTU0VSVCghci0+ aXNJZGVudGlmaWVyKTsKIAotICAgIGlmIChyLT5sZW4gPT0gMCkKKyAgICBpZiAoci0+bGVuID09 IDApIHsKKyAgICAgICAgVVN0cmluZzo6UmVwOjplbXB0eS5oYXNoKCk7CiAgICAgICAgIHJldHVy biAmVVN0cmluZzo6UmVwOjplbXB0eTsKKyAgICB9CiAKICAgICBVU3RyaW5nOjpSZXAgKnJlc3Vs dCA9ICppZGVudGlmaWVyVGFibGUoKS5hZGQocikuZmlyc3Q7CiAgICAgaWYgKHJlc3VsdCA9PSBy KQo= 16902 2007-10-27 12:16:46 -0700 2007-10-27 12:20:08 -0700 fix 2 patch-identifier-assert.txt text/plain 1640 ggaren SW5kZXg6IENoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBDaGFuZ2VMb2cJKHJldmlzaW9uIDI3MTUx KQorKysgQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMDctMTAt MjcgIEdlb2ZmcmV5IEdhcmVuICA8Z2dhcmVuQGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdl ZCBieSBOT0JPRFkgKE9PUFMhKS4KKyAgICAgICAgCisgICAgICAgIEZpeGVkIHRoZSByZXN0IG9m ICJBU1NFUlRJT04gRkFJTEVEOiBfaGFzaCBpbiBLSlM6OlVTdHJpbmc6OlJlcDo6CisgICAgICAg IGNvbXB1dGVkSGFzaCgpIgorICAgICAgICBodHRwOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD0xNTcxOAorCisgICAgICAgICoga2pzL2lkZW50aWZpZXIuY3BwOiBGaXhlZCBtb3Jl IGNhc2VzIHdoZXJlIGFuIElkZW50aWZpZXIgZGlkbid0IGdldCBhIAorICAgICAgICBoYXNoIHZh bHVlLgorICAgICAgICAoS0pTOjpJZGVudGlmaWVyOjphZGQpOgorCiAyMDA3LTEwLTI3ICBEYXJp biBBZGxlciAgPGRhcmluQGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBNYWNpZWou CkluZGV4OiBranMvaWRlbnRpZmllci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0ga2pzL2lkZW50aWZpZXIu Y3BwCShyZXZpc2lvbiAyNzE1MSkKKysrIGtqcy9pZGVudGlmaWVyLmNwcAkod29ya2luZyBjb3B5 KQpAQCAtMTI1LDExICsxMjUsMTUgQEAgc3RydWN0IENTdHJpbmdUcmFuc2xhdG9yCiAKIFBhc3NS ZWZQdHI8VVN0cmluZzo6UmVwPiBJZGVudGlmaWVyOjphZGQoY29uc3QgY2hhciAqYykKIHsKLSAg ICBpZiAoIWMpCisgICAgaWYgKCFjKSB7CisgICAgICAgIFVTdHJpbmc6OlJlcDo6bnVsbC5oYXNo KCk7CiAgICAgICAgIHJldHVybiAmVVN0cmluZzo6UmVwOjpudWxsOwotICAgIHNpemVfdCBsZW5n dGggPSBzdHJsZW4oYyk7Ci0gICAgaWYgKGxlbmd0aCA9PSAwKQorICAgIH0KKworICAgIGlmICgh c3RybGVuKGMpKSB7CisgICAgICAgIFVTdHJpbmc6OlJlcDo6ZW1wdHkuaGFzaCgpOwogICAgICAg ICByZXR1cm4gJlVTdHJpbmc6OlJlcDo6ZW1wdHk7CisgICAgfQogICAgIAogICAgIHJldHVybiAq aWRlbnRpZmllclRhYmxlKCkuYWRkPGNvbnN0IGNoYXIgKiwgQ1N0cmluZ1RyYW5zbGF0b3I+KGMp LmZpcnN0OwogfQpAQCAtMTY4LDggKzE3MiwxMCBAQCBzdHJ1Y3QgVUNoYXJCdWZmZXJUcmFuc2xh dG9yCiAKIFBhc3NSZWZQdHI8VVN0cmluZzo6UmVwPiBJZGVudGlmaWVyOjphZGQoY29uc3QgVUNo YXIgKnMsIGludCBsZW5ndGgpCiB7Ci0gICAgaWYgKGxlbmd0aCA9PSAwKQorICAgIGlmICghbGVu Z3RoKSB7CisgICAgICAgIFVTdHJpbmc6OlJlcDo6ZW1wdHkuaGFzaCgpOwogICAgICAgICByZXR1 cm4gJlVTdHJpbmc6OlJlcDo6ZW1wdHk7CisgICAgfQogICAgIAogICAgIFVDaGFyQnVmZmVyIGJ1 ZiA9IHtzLCBsZW5ndGh9OyAKICAgICByZXR1cm4gKmlkZW50aWZpZXJUYWJsZSgpLmFkZDxVQ2hh ckJ1ZmZlciwgVUNoYXJCdWZmZXJUcmFuc2xhdG9yPihidWYpLmZpcnN0Owo=