157273 2016-05-02 13:03:20 -0700 CRASH when continuing from uncaught exception in inspector 2016-05-04 17:27:04 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 156924 InRadar P2 Normal --- 1 joepeck mark.lam fpizlo ggaren joepeck mark.lam saam webkit-bug-importer oldest_to_newest 1189482 0 joepeck 2016-05-02 13:03:20 -0700 * SUMMARY CRASH when continuing from uncaught exception in inspector * STEPS TO REPRODUCE 1. Inspect about:blank 2. Show Debugger Tab and enable Break on All Exceptions 3. In quick console, evaluate: throw "Hi" => You should pause 4. Click Continue in the Debugger Sidebar => Crash * CRASH SNIPPET Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000005 Exception Note: EXC_CORPSE_NOTIFY Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x00000001080d6659 llint_slow_path_jtrue + 201 (JSCellInlines.h:251) 1 com.apple.JavaScriptCore 0x00000001080e41cf llint_entry + 20750 2 com.apple.JavaScriptCore 0x00000001080deede vmEntryToJavaScript + 299 3 com.apple.JavaScriptCore 0x0000000107f5469e JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 158 (JITCode.cpp:81) 4 com.apple.JavaScriptCore 0x0000000107eb3862 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 450 (Interpreter.cpp:1020) 5 com.apple.JavaScriptCore 0x0000000107abdb27 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 71 (MarkedBlock.h:235) 6 com.apple.WebCore 0x0000000109248bf0 WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 96 (JSMainThreadExecState.h:57) ... 1189497 1 joepeck 2016-05-02 13:43:41 -0700 (lldb) btjs * thread #1: tid = 0x52e179, 0x000000010b0978bc, queue = 'com.apple.main-thread, stop reason = EXC_BAD_ACCESS (code=1, addre???? frame #0: 0x000000010b0978bc JavaScriptCore`JSC::JSCell::isString(this=0x0000000000000000) const + 12 at JSCellInlines.h:160 frame #1: 0x000000010b147800 JavaScriptCore`JSC::JSCell::toBoolean(this=0x0000000000000000, exec=0x00007fff5830b0e0) const + 32 at JSCellInlines.h:251 frame #2: 0x000000010b1477b8 JavaScriptCore`JSC::JSValue::toBoolean(this=0x00007fff5830afd0, exec=0x00007fff5830b0e0) const + 200 at JSString.h:759 frame #3: 0x000000010bb502b1 JavaScriptCore`::llint_slow_path_jtrue(exec=0x00007fff5830b0e0, pc=0x000000011d829448) + 129 at LLIntSlowPaths.cpp:944 frame #4: 0x000000010bb5c580 evaluateOnCallFrame#CeyOXK [LLInt](Cell[Object ID: 1009]: 0x12113ff80, <JSValue()>, \"{\"ordinal\":0,\"injectedScriptId\":1}\", \"\n//# sourceURL=__WebInspectorInternal__\nthis\", \"watch-expressions\", False, Fa frame #5: 0x000000010bb5684e JavaScriptCore`llintPCRangeStart + 334 frame #6: 0x000000010b9650ea JavaScriptCore`JSC::JITCode::execute(this=0x000000011d8204d8, vm=0x0000000120df1000, protoCallFrame=0x00007fff5830b280) + 218 at JITCode.cpp:80 frame #7: 0x000000010b8f859c JavaScriptCore`JSC::Interpreter::executeCall(this=0x000000011d9f3630, callFrame=0x00000001211d7740, function=0x000000012111fb20, callType=JS, callData=0x00007fff5830b618, thisValue=JSValue at 0x00007fff5830b340, args=0x00007fff5830b5d0) + 1100 at Interpreter.cpp:1020 frame #8: 0x000000010b1cf63e JavaScriptCore`JSC::call(exec=0x00000001211d7740, functionObject=JSValue at 0x00007fff5830b3c0, callType=JS, callData=0x00007fff5830b618, thisValue=JSValue at 0x00007fff5830b3b8, args=0x00007fff5830b5d0) + 190 at CallData.cpp:40 frame #9: 0x000000010b1cf6a3 JavaScriptCore`JSC::call(exec=0x00000001211d7740, functionObject=JSValue at 0x00007fff5830b440, callType=JS, callData=0x00007fff5830b618, thisValue=JSValue at 0x00007fff5830b438, args=0x00007fff5830b5d0, returnedException=0x00007fff5830b5f8) + 83 at CallData.cpp:45 frame #10: 0x000000010f30de9b WebCore`WebCore::JSMainThreadExecState::call(exec=0x00000001211d7740, functionObject=JSValue at 0x00007fff5830b4c0, callType=JS, callData=0x00007fff5830b618, thisValue=JSValue at 0x00007fff5830b4b8, args=0x00007fff5830b5d0, returnedException=0x00007fff5830b5f8) + 107 at JSMainThreadExecState.h:57 frame #11: 0x000000010f5a4bfd WebCore`WebCore::functionCallHandlerFromAnyThread(exec=0x00000001211d7740, functionObject=JSValue at 0x00007fff5830b540, callType=JS, callData=0x00007fff5830b618, thisValue=JSValue at 0x00007fff5830b538, args=0x00007fff5830b5d0, returnedException=0x00007fff5830b5f8) + 109 at JSMainThreadExecState.cpp:44 ... (lldb) f 2 frame #2: 0x000000010b1477b8 JavaScriptCore`JSC::JSValue::toBoolean(this=0x00007fff5830afd0, exec=0x00007fff5830b0e0) const + 200 at JSString.h:759 756 if (isDouble()) 757 return asDouble() > 0.0 || asDouble() < 0.0; // false for NaN 758 if (isCell()) -> 759 return asCell()->toBoolean(exec); 760 return isTrue(); // false, null, and undefined all convert to false. 761 } 762 (lldb) p isCell() (bool) $3 = true (lldb) p asCell() (JSC::JSCell *) $4 = 0x0000000000000000 1189953 2 webkit-bug-importer 2016-05-03 19:42:42 -0700 <rdar://problem/26081180> 1190153 3 mark.lam 2016-05-04 12:10:44 -0700 Just re-tested this on ToT r200422, and the issue no longer reproduces. Will close this issue. 1190254 4 joepeck 2016-05-04 16:00:16 -0700 (In reply to comment #3) > Just re-tested this on ToT r200422, and the issue no longer reproduces. > Will close this issue. Reopening. We saw this on r200426 and r200429 on my machine. I wasn't able to reproduce on Mark's machine though. 1190282 5 joepeck 2016-05-04 17:27:04 -0700 Duplicate. *** This bug has been marked as a duplicate of bug 156924 ***