22797 2008-12-10 14:31:55 -0800 REGRESSION: Crash at http://news.cnet.com/8301-17939_109-10119149-2.html 2008-12-15 14:13:03 -0800 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED http://news.cnet.com/8301-17939_109-10119149-2.html NeedsReduction, Regression P2 Normal --- 1 ismail zwarich ap webkit zwarich oldest_to_newest 102148 0 ismail 2008-12-10 14:31:55 -0800 Reproducing this bug is kinda tricky, - Go to http://www.reddit.com/?count=50&after=t3_7im8f - Click the link which says "Firefox, Chrome builds virtually tied for JavaScript speed...." - Let the CNET page load - Press back button Safari crashes. 102150 1 zwarich 2008-12-10 14:34:46 -0800 I'll assign this to myself, at least to find the point of regression. It seems like a memory smasher, because the point at which it crashes is random, and sometimes it even crashes after it has gone back. 102159 2 zwarich 2008-12-10 14:49:02 -0800 I have narrowed this down to the range of revisions between the r37300 and r37376 nightlies. 102229 3 zwarich 2008-12-11 07:49:14 -0800 Here is a link that makes it easier to reproduce: http://www.reddit.com/search?q=firefox%2C+chrome I have verified that this occurs in the range r37338-r37376. 102242 4 zwarich 2008-12-11 09:50:43 -0800 It seems that the crash I was seeing in that range was due to r37370, which was rolled out in r37381. I'll have to investigate this further. 102249 5 25955 zwarich 2008-12-11 10:29:33 -0800 Created attachment 25955 Backtrace If I enable MallocScribble while simply loading the cnet URL in a debug build of ToT WebKit, I get this backtrace every I time. 102264 6 25958 andersca 2008-12-11 13:21:33 -0800 Created attachment 25958 Patch 102265 7 25958 zwarich 2008-12-11 13:22:45 -0800 Comment on attachment 25958 Patch r=me 102276 8 andersca 2008-12-11 14:01:14 -0800 Committed revision 39215. 102543 9 webkit 2008-12-14 22:12:41 -0800 Just saw this on r39293: Thread 0 Crashed: 0 com.apple.JavaScriptCore 0x0044754c WTF::HashTableIterator<JSC::UString::Rep*, JSC::UString::Rep*, WTF::IdentityExtractor<JSC::UString::Rep*>, WTF::StrHash<JSC::UString::Rep*>, WTF::HashTraits<JSC::UString::Rep*>, WTF::HashTraits<JSC::UString::Rep*> > WTF::HashTable<JSC::UString::Rep*, JSC::UString::Rep*, WTF::IdentityExtractor<JSC::UString::Rep*>, WTF::StrHash<JSC::UString::Rep*>, WTF::HashTraits<JSC::UString::Rep*>, WTF::HashTraits<JSC::UString::Rep*> >::find<JSC::UString::Rep*, WTF::IdentityHashTranslator<JSC::UString::Rep*, JSC::UString::Rep*, WTF::StrHash<JSC::UString::Rep*> > >(JSC::UString::Rep* const&) + 252 1 com.apple.JavaScriptCore 0x003be206 JSC::Identifier::remove(JSC::UString::Rep*) + 38 2 com.apple.JavaScriptCore 0x003be28e JSC::UString::Rep::destroy() + 30 3 com.apple.JavaScriptCore 0x004ccc4b JSC::Structure::~Structure() + 299 4 com.apple.JavaScriptCore 0x00459d8c JSC::JSObject::~JSObject() + 140 5 com.apple.JavaScriptCore 0x00457178 unsigned long JSC::Heap::sweep<(JSC::HeapType)0>() + 200 6 com.apple.JavaScriptCore 0x003cd859 JSC::Heap::collect() + 169 7 com.apple.WebCore 0x0107e492 WebCore::Timer<WebCore::GCController>::fired() + 82 8 com.apple.WebCore 0x014fe9d9 WebCore::TimerBase::fireTimers(double, WTF::Vector<WebCore::TimerBase*, 0ul> const&) + 137 9 com.apple.WebCore 0x014feaa2 WebCore::TimerBase::sharedTimerFired() + 162 10 com.apple.WebCore 0x014da904 WebCore::timerFired(__CFRunLoopTimer*, void*) + 68 11 com.apple.CoreFoundation 0x9683ab45 CFRunLoopRunSpecific + 4469 12 com.apple.CoreFoundation 0x9683acf8 CFRunLoopRunInMode + 88 13 com.apple.HIToolbox 0x90389480 RunCurrentEventLoopInMode + 283 14 com.apple.HIToolbox 0x90389299 ReceiveNextEventCommon + 374 15 com.apple.HIToolbox 0x9038910d BlockUntilNextEventMatchingListInMode + 106 16 com.apple.AppKit 0x92e983ed _DPSNextEvent + 657 17 com.apple.AppKit 0x92e97ca0 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128 18 com.apple.Safari 0x0000808e 0x1000 + 28814 19 com.apple.AppKit 0x92e90cdb -[NSApplication run] + 795 20 com.apple.AppKit 0x92e5df14 NSApplicationMain + 574 21 com.apple.Safari 0x000b9b16 0x1000 + 756502 102545 10 zwarich 2008-12-14 22:18:53 -0800 There seems to be another problem with this page that is not yet fixed. I can reproduce this after a few loads, even using the bytecode interpreter. 102546 11 zwarich 2008-12-14 22:35:56 -0800 This link reproduces the crash a lot better than the one in the title of this bug, although I am pretty sure it is still the same memory corruption: http://news.cnet.com/8301-13579_3-9953533-37.html I am having a lot of trouble reducing this. 102599 12 zwarich 2008-12-15 14:13:03 -0800 This new crash reproduces with no plugins, so I will close this bug and use bug 22869 for tracking the new crash. 25955 2008-12-11 10:29:33 -0800 2008-12-11 10:29:33 -0800 Backtrace backtrace.txt text/plain 2499 zwarich QVNTRVJUSU9OIEZBSUxFRDogIW1fc3RyZWFtLm5kYXRhCigvVXNlcnMvQ2FtZXJvbi9XZWJLaXQv V2ViS2l0L21hYy9QbHVnaW5zL1dlYkJhc2VOZXRzY2FwZVBsdWdpblN0cmVhbS5tbTo0NDAgdm9p ZCBXZWJOZXRzY2FwZVBsdWdpblN0cmVhbTo6ZGVzdHJveVN0cmVhbVdpdGhSZWFzb24oTlBSZWFz b24pKQoKUHJvZ3JhbSByZWNlaXZlZCBzaWduYWwgRVhDX0JBRF9BQ0NFU1MsIENvdWxkIG5vdCBh Y2Nlc3MgbWVtb3J5LgpSZWFzb246IEtFUk5fSU5WQUxJRF9BRERSRVNTIGF0IGFkZHJlc3M6IDB4 YmJhZGJlZWYKMHgwMDE4OTcxYyBpbiBXZWJOZXRzY2FwZVBsdWdpblN0cmVhbTo6ZGVzdHJveVN0 cmVhbVdpdGhSZWFzb24gKHRoaXM9MHgxY2UyNzMxMCwgcmVhc29uPTApIGF0IC9Vc2Vycy9DYW1l cm9uL1dlYktpdC9XZWJLaXQvbWFjL1BsdWdpbnMvV2ViQmFzZU5ldHNjYXBlUGx1Z2luU3RyZWFt Lm1tOjQ0MAo0NDAJICAgIEFTU0VSVCghbV9zdHJlYW0ubmRhdGEpOwooZ2RiKSBiYWNrdHJhY2UK IzAgIDB4MDAxODk3MWMgaW4gV2ViTmV0c2NhcGVQbHVnaW5TdHJlYW06OmRlc3Ryb3lTdHJlYW1X aXRoUmVhc29uICh0aGlzPTB4MWNlMjczMTAsIHJlYXNvbj0wKSBhdCAvVXNlcnMvQ2FtZXJvbi9X ZWJLaXQvV2ViS2l0L21hYy9QbHVnaW5zL1dlYkJhc2VOZXRzY2FwZVBsdWdpblN0cmVhbS5tbTo0 NDAKIzEgIDB4MDAxODk5ZjQgaW4gV2ViTmV0c2NhcGVQbHVnaW5TdHJlYW06OmRpZEZpbmlzaExv YWRpbmcgKHRoaXM9MHgxY2UyNzMxMCkgYXQgL1VzZXJzL0NhbWVyb24vV2ViS2l0L1dlYktpdC9t YWMvUGx1Z2lucy9XZWJCYXNlTmV0c2NhcGVQbHVnaW5TdHJlYW0ubW06NTg4CiMyICAweDAzOTRl NmI3IGluIFdlYkNvcmU6Ok5ldHNjYXBlUGx1Z0luU3RyZWFtTG9hZGVyOjpkaWRGaW5pc2hMb2Fk aW5nICh0aGlzPTB4NmM2MzQwMCkgYXQgL1VzZXJzL0NhbWVyb24vV2ViS2l0L1dlYkNvcmUvbG9h ZGVyL05ldHNjYXBlUGx1Z0luU3RyZWFtTG9hZGVyLmNwcDoxMDMKIzMgIDB4MDNhN2E0YTAgaW4g V2ViQ29yZTo6UmVzb3VyY2VMb2FkZXI6OmRpZEZpbmlzaExvYWRpbmcgKHRoaXM9MHg2YzYzNDAw KSBhdCAvVXNlcnMvQ2FtZXJvbi9XZWJLaXQvV2ViQ29yZS9sb2FkZXIvUmVzb3VyY2VMb2FkZXIu Y3BwOjM5OAojNCAgMHgwM2E3N2Y1NCBpbiAtW1dlYkNvcmVSZXNvdXJjZUhhbmRsZUFzRGVsZWdh dGUgY29ubmVjdGlvbkRpZEZpbmlzaExvYWRpbmc6XSAoc2VsZj0weDFjZTUxMGIwLCBfY21kPTB4 OTRiMWE1NjQsIGNvbj0weDFjZTUxMDYwKSBhdCAvVXNlcnMvQ2FtZXJvbi9XZWJLaXQvV2ViQ29y ZS9wbGF0Zm9ybS9uZXR3b3JrL21hYy9SZXNvdXJjZUhhbmRsZU1hYy5tbTo1NjAKIzUgIDB4OTNm MWRjZDcgaW4gLVtOU1VSTENvbm5lY3Rpb24oTlNVUkxDb25uZWN0aW9uUmVhbGx5SW50ZXJuYWwp IHNlbmREaWRGaW5pc2hMb2FkaW5nXSAoKQojNiAgMHg5M2YxZGM0MyBpbiBfTlNVUkxDb25uZWN0 aW9uRGlkRmluaXNoTG9hZGluZyAoKQojNyAgMHg5MTI5MzIyYyBpbiBVUkxDb25uZWN0aW9uQ2xp ZW50OjpjbGllbnREaWRGaW5pc2hMb2FkaW5nICgpCiM4ICAweDkxMjkyMDU0IGluIFVSTENvbm5l Y3Rpb25DbGllbnQ6OmhhbmRsZUNhY2hlUmVzcG9uc2VJc1ZhbGlkICgpCiM5ICAweDkxMjkzODJl IGluIFVSTENvbm5lY3Rpb25DbGllbnQ6OmNsaWVudFdpbGxTZW5kUmVxdWVzdCAoKQojMTAgMHg5 MTI5MWQwMyBpbiBVUkxDb25uZWN0aW9uQ2xpZW50OjpDbGllbnRDb25uZWN0aW9uRXZlbnRRdWV1 ZTo6cHJvY2Vzc0FsbEV2ZW50c0FuZENvbnN1bWVQYXlsb2FkICgpCiMxMSAweDkxMjkyZGE4IGlu IFVSTENvbm5lY3Rpb25DbGllbnQ6OnByb2Nlc3NFdmVudHMgKCkKIzEyIDB4OTEyNDJkMzcgaW4g TXVsdGlwbGV4ZXJTb3VyY2U6OnBlcmZvcm0gKCkKIzEzIDB4OTAwNzY1ZjUgaW4gQ0ZSdW5Mb29w UnVuU3BlY2lmaWMgKCkKIzE0IDB4OTAwNzZjZDggaW4gQ0ZSdW5Mb29wUnVuSW5Nb2RlICgpCiMx NSAweDk1YzdhMmMwIGluIFJ1bkN1cnJlbnRFdmVudExvb3BJbk1vZGUgKCkKIzE2IDB4OTVjN2Ew MTIgaW4gUmVjZWl2ZU5leHRFdmVudENvbW1vbiAoKQojMTcgMHg5NWM3OWY0ZCBpbiBCbG9ja1Vu dGlsTmV4dEV2ZW50TWF0Y2hpbmdMaXN0SW5Nb2RlICgpCiMxOCAweDk0Zjk4ZDdkIGluIF9EUFNO ZXh0RXZlbnQgKCkKIzE5IDB4OTRmOTg2MzAgaW4gLVtOU0FwcGxpY2F0aW9uIG5leHRFdmVudE1h dGNoaW5nTWFzazp1bnRpbERhdGU6aW5Nb2RlOmRlcXVldWU6XSAoKQojMjAgMHgwMDAwODZiZSBp biA/PyAoKQojMjEgMHg5NGY5MTY2YiBpbiAtW05TQXBwbGljYXRpb24gcnVuXSAoKQojMjIgMHg5 NGY1ZThhNCBpbiBOU0FwcGxpY2F0aW9uTWFpbiAoKQojMjMgMHgwMDBiYTRkNiBpbiA/PyAoKQpD dXJyZW50IGxhbmd1YWdlOiAgYXV0bzsgY3VycmVudGx5IG9iamVjdGl2ZS1jKysKV2FybmluZzog dGhlIGN1cnJlbnQgbGFuZ3VhZ2UgZG9lcyBub3QgbWF0Y2ggdGhpcyBmcmFtZS4K 25958 2008-12-11 13:21:33 -0800 2008-12-11 13:22:45 -0800 Patch textmate stdin F31SO0.txt text/plain 3129 andersca SW5kZXg6IFdlYktpdC9tYWMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYktpdC9tYWMvQ2hh bmdlTG9nCShyZXZpc2lvbiAzOTIxNCkKKysrIFdlYktpdC9tYWMvQ2hhbmdlTG9nCSh3b3JraW5n IGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMDgtMTItMTEgIEFuZGVycyBDYXJsc3NvbiAgPGFu ZGVyc2NhQGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4K KworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjI3OTcK KyAgICAgICAgUkVHUkVTU0lPTjogQ3Jhc2ggYXQgaHR0cDovL25ld3MuY25ldC5jb20vODMwMS0x NzkzOV8xMDktMTAxMTkxNDktMi5odG1sCisKKyAgICAgICAgTWFrZSBzdXJlIHRvIHByb3RlY3Qg dGhlIHN0cmVhbSBiZWNhdXNlIGRlc3Ryb3lTdHJlYW0gY2FuIG90aGVyd2lzZSBjYXVzZSBpdCB0 byBiZSBkZWxldGVkLgorICAgICAgICAKKyAgICAgICAgKiBQbHVnaW5zL1dlYkJhc2VOZXRzY2Fw ZVBsdWdpblN0cmVhbS5tbToKKyAgICAgICAgKFdlYk5ldHNjYXBlUGx1Z2luU3RyZWFtOjpkZXN0 cm95U3RyZWFtV2l0aFJlYXNvbik6CisKIDIwMDgtMTItMTAgIEdsZW5uIFdpbHNvbiAgPGd3aWxz b25AZ29vZ2xlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBBZGFtIFJvYmVuLgpJbmRleDog V2ViS2l0L21hYy9QbHVnaW5zL1dlYkJhc2VOZXRzY2FwZVBsdWdpblN0cmVhbS5tbQo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBXZWJLaXQvbWFjL1BsdWdpbnMvV2ViQmFzZU5ldHNjYXBlUGx1Z2luU3RyZWFtLm1t CShyZXZpc2lvbiAzOTIxMSkKKysrIFdlYktpdC9tYWMvUGx1Z2lucy9XZWJCYXNlTmV0c2NhcGVQ bHVnaW5TdHJlYW0ubW0JKHdvcmtpbmcgY29weSkKQEAgLTQzNiw2ICs0MzYsOCBAQCB2b2lkIFdl Yk5ldHNjYXBlUGx1Z2luU3RyZWFtOjpkZXN0cm95U3RyCiAgICAgICAgIC8vIFRoZXJlIGlzIG1v cmUgZGF0YSB0byBiZSBzdHJlYW1lZCwgZG9uJ3QgZGVzdHJveSB0aGUgc3RyZWFtIG5vdy4KICAg ICAgICAgcmV0dXJuOwogICAgIH0KKworICAgIFJlZlB0cjxXZWJOZXRzY2FwZVBsdWdpblN0cmVh bT4gcHJvdGVjdCh0aGlzKTsKICAgICBkZXN0cm95U3RyZWFtKCk7CiAgICAgQVNTRVJUKCFtX3N0 cmVhbS5uZGF0YSk7CiB9CkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lvbiAzOTIxNCkKKysrIExheW91dFRlc3Rz L0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDA4LTEyLTExICBB bmRlcnMgQ2FybHNzb24gIDxhbmRlcnNjYUBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQg YnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hv d19idWcuY2dpP2lkPTIyNzk3CisgICAgICAgIFJFR1JFU1NJT046IENyYXNoIGF0IGh0dHA6Ly9u ZXdzLmNuZXQuY29tLzgzMDEtMTc5MzlfMTA5LTEwMTE5MTQ5LTIuaHRtbAorICAgICAgICAKKyAg ICAgICAgKiBodHRwL3Rlc3RzL3BsdWdpbnMvZ2V0LXVybC1leHBlY3RlZC50eHQ6IEFkZGVkLgor ICAgICAgICAqIGh0dHAvdGVzdHMvcGx1Z2lucy9nZXQtdXJsLmh0bWw6IEFkZGVkLgorCiAyMDA4 LTEyLTExICBOaWtvbGFzIFppbW1lcm1hbm4gIDxuaWtvbGFzLnppbW1lcm1hbm5AdG9yY2htb2Jp bGUuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEVyaWMgU2VpZGVsLgpJbmRleDogTGF5b3V0 VGVzdHMvaHR0cC90ZXN0cy9wbHVnaW5zL2dldC11cmwtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIExheW91dFRlc3RzL2h0dHAvdGVzdHMvcGx1Z2lucy9nZXQtdXJsLWV4cGVjdGVkLnR4dAko cmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2h0dHAvdGVzdHMvcGx1Z2lucy9nZXQtdXJsLWV4 cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSBAQAorVGhpcyB0ZXN0cyB0aGF0IE5Q Tl9HZXRVUkxOb3RpZnkgd29ya3MgYXMgZXhwZWN0ZWQgYW5kIGRvZXMgbm90IEFTU0VSVCBpbnRl cm1pdHRlbnRseSBpbiBkZWJ1ZyBidWlsZHMuIApJbmRleDogTGF5b3V0VGVzdHMvaHR0cC90ZXN0 cy9wbHVnaW5zL2dldC11cmwuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9odHRwL3Rl c3RzL3BsdWdpbnMvZ2V0LXVybC5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0 cC90ZXN0cy9wbHVnaW5zL2dldC11cmwuaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwxOSBA QAorPGh0bWw+Cis8Ym9keT4KK1RoaXMgdGVzdHMgdGhhdCBOUE5fR2V0VVJMTm90aWZ5IHdvcmtz IGFzIGV4cGVjdGVkIGFuZCBkb2VzIG5vdCBBU1NFUlQgaW50ZXJtaXR0ZW50bHkgaW4gZGVidWcg YnVpbGRzLgorPGVtYmVkIG5hbWU9InBsZyIgdHlwZT0iYXBwbGljYXRpb24veC13ZWJraXQtdGVz dC1uZXRzY2FwZSI+PC9lbWJlZD4KKzxzY3JpcHQ+CisgICAgZnVuY3Rpb24gbm90aWZ5KCkKKyAg ICB7CisgICAgICAgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgICAgICAg ICBsYXlvdXRUZXN0Q29udHJvbGxlci5ub3RpZnlEb25lKCk7CisgICAgfQorICAgIGlmICh3aW5k b3cubGF5b3V0VGVzdENvbnRyb2xsZXIpIHsKKyAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIu ZHVtcEFzVGV4dCgpOworICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci53YWl0VW50aWxEb25l KCk7CisgICAgfQorCisgICAgcGxnLmdldFVSTE5vdGlmeSgicmVzb3VyY2VzL2xvYWQtbWUtMS50 eHQiLCBudWxsLCAibm90aWZ5Iik7Cis8L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4K