29599 2009-09-21 09:29:09 -0700 REGRESSION (r48582): Crash in StructureStubInfo::initPutByIdTransition when reloading trac.webkit.org 2009-09-21 12:00:28 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED http://trac.webkit.org/ InRadar, Regression P2 Normal --- 1 aroben webkit-unassigned mjs oliver xan.lopez oldest_to_newest 148719 0 aroben 2009-09-21 09:29:09 -0700 To reproduce: 1. Go to http://trac.webkit.org/ 2. Reload You'll crash. Here's the backtrace: JavaScriptCore_debug.dll!WTF::RefCountedBase::ref() Line 36 + 0x3 bytes C++ > JavaScriptCore_debug.dll!JSC::StructureStubInfo::initPutByIdTransition(JSC::Structure * previousStructure=0x00000000, JSC::Structure * structure=0x0ead7fe8, JSC::StructureChain * chain=0x08ae4818) Line 116 C++ JavaScriptCore_debug.dll!JSC::JITThunks::tryCachePutByID(JSC::ExecState * callFrame=0x08d603b0, JSC::CodeBlock * codeBlock=0x0e77f210, JSC::ReturnAddressPtr returnAddress={...}, JSC::JSValue baseValue={...}, const JSC::PutPropertySlot & slot={...}, JSC::StructureStubInfo * stubInfo=0x0e780fc8) Line 703 C++ JavaScriptCore_debug.dll!cti_op_put_by_id(void * * args=0x0012e4d4) Line 1089 + 0x2f bytes C++ JavaScriptCore_debug.dll!@cti_op_convert_this@4() + 0x10f bytes C++ JavaScriptCore_debug.dll!JSC::JITCode::execute(JSC::RegisterFile * registerFile=0x086a7330, JSC::ExecState * callFrame=0x08d60058, JSC::JSGlobalData * globalData=0x0867a500, JSC::JSValue * exception=0x0867b058) Line 79 + 0x24 bytes C++ JavaScriptCore_debug.dll!JSC::Interpreter::execute(JSC::FunctionExecutable * functionExecutable=0x08baeb40, JSC::ExecState * callFrame=0x0868f480, JSC::JSFunction * function=0x07c529c0, JSC::JSObject * thisObj=0x07c53440, const JSC::ArgList & args={...}, JSC::ScopeChainNode * scopeChain=0x0e1f3840, JSC::JSValue * exception=0x0867b058) Line 721 + 0x34 bytes C++ JavaScriptCore_debug.dll!JSC::JSFunction::call(JSC::ExecState * exec=0x0868f480, JSC::JSValue thisValue={...}, const JSC::ArgList & args={...}) Line 120 + 0x4e bytes C++ JavaScriptCore_debug.dll!JSC::call(JSC::ExecState * exec=0x0868f480, JSC::JSValue functionObject={...}, JSC::CallType callType=CallTypeJS, const JSC::CallData & callData={...}, JSC::JSValue thisValue={...}, const JSC::ArgList & args={...}) Line 39 + 0x2b bytes C++ WebKit_debug.dll!WebCore::JSEventListener::handleEvent(WebCore::Event * event=, bool isWindowEvent=) Line 120 + 0x4d bytes C++ WebKit_debug.dll!WebCore::DOMWindow::handleEvent(WebCore::Event * event=0x0ea09168, bool useCapture=false, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>,0> * alternateListeners=[...]()) Line 1260 + 0x20 bytes C++ WebKit_debug.dll!WebCore::DOMWindow::dispatchEventWithDocumentAsTarget(WTF::PassRefPtr<WebCore::Event> e={...}, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>,0> * alternateEventListeners=[...]()) Line 1341 C++ WebKit_debug.dll!WebCore::DOMWindow::dispatchUnloadEvent(WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>,0> * alternateEventListeners=[...]()) Line 1361 C++ WebKit_debug.dll!WebCore::FrameLoader::stopLoading(WebCore::UnloadEventPolicy unloadEventPolicy=UnloadEventPolicyUnloadAndPageHide, WebCore::DatabasePolicy databasePolicy=DatabasePolicyStop) Line 588 C++ WebKit_debug.dll!WebCore::FrameLoader::closeURL() Line 650 C++ WebKit_debug.dll!WebCore::FrameLoader::transitionToCommitted(WTF::PassRefPtr<WebCore::CachedPage> cachedPage={...}) Line 2952 C++ WebKit_debug.dll!WebCore::FrameLoader::commitProvisionalLoad(WTF::PassRefPtr<WebCore::CachedPage> prpCachedPage={...}) Line 2883 C++ WebKit_debug.dll!WebCore::DocumentLoader::commitIfReady() Line 322 C++ WebKit_debug.dll!WebCore::DocumentLoader::commitLoad(const char * data=0x0eb48aa8, int length=1971) Line 341 C++ WebKit_debug.dll!WebCore::DocumentLoader::receivedData(const char * data=0x0eb48aa8, int length=1971) Line 355 C++ WebKit_debug.dll!WebCore::FrameLoader::receivedData(const char * data=0x0eb48aa8, int length=1971) Line 2524 C++ WebKit_debug.dll!WebCore::MainResourceLoader::addData(const char * data=0x0eb48aa8, int length=1971, bool allAtOnce=false) Line 144 C++ WebKit_debug.dll!WebCore::ResourceLoader::didReceiveData(const char * data=0x0eb48aa8, int length=1971, __int64 lengthReceived=1971, bool allAtOnce=false) Line 248 + 0x1b bytes C++ WebKit_debug.dll!WebCore::MainResourceLoader::didReceiveData(const char * data=0x0eb48aa8, int length=1971, __int64 lengthReceived=1971, bool allAtOnce=false) Line 357 C++ WebKit_debug.dll!WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle * __formal=0x0eaa0ad0, const char * data=0x0eb48aa8, int length=1971, int lengthReceived=1971) Line 398 + 0x1f bytes C++ WebKit_debug.dll!WebCore::didReceiveData(_CFURLConnection * conn=0x08d035d8, const __CFData * data=0x0e784d10, long originalLength=1971, const void * clientInfo=0x0eaa0ad0) Line 176 + 0x2a bytes C++ 148720 1 aroben 2009-09-21 09:30:17 -0700 <rdar://problem/7239395> 148751 2 39861 oliver 2009-09-21 11:49:42 -0700 Created attachment 39861 Patch v1 148753 3 39861 ggaren 2009-09-21 11:57:26 -0700 Comment on attachment 39861 Patch v1 r=me 148756 4 oliver 2009-09-21 12:00:28 -0700 Committed r48590 39861 2009-09-21 11:49:42 -0700 2009-09-21 11:57:25 -0700 Patch v1 bug-29599-20090921114940.patch text/plain 5097 oliver ZGlmZiAtLWdpdCBhL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZyBiL0phdmFTY3JpcHRDb3JlL0No YW5nZUxvZwppbmRleCAyZjMwZGVjLi5kZDE4MTM0IDEwMDY0NAotLS0gYS9KYXZhU2NyaXB0Q29y ZS9DaGFuZ2VMb2cKKysrIGIvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCkBAIC0xLDUgKzEsMjAg QEAKIDIwMDktMDktMjEgIE9saXZlciBIdW50ICA8b2xpdmVyQGFwcGxlLmNvbT4KIAorICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBSRUdSRVNTSU9OIChyNDg1 ODIpOiBDcmFzaCBpbiBTdHJ1Y3R1cmVTdHViSW5mbzo6aW5pdFB1dEJ5SWRUcmFuc2l0aW9uIHdo ZW4gcmVsb2FkaW5nIHRyYWMud2Via2l0Lm9yZworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9Mjk1OTkKKworICAgICAgICBJdCBpcyB1bnNhZmUgdG8gYXR0 ZW1wdCB0byBjYWNoZSBuZXcgcHJvcGVydHkgdHJhbnNpdGlvbnMgb24KKyAgICAgICAgZGljdGlv bmFyaWVzIG9mIGFueSB0eXBlLgorCisgICAgICAgICogaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIu Y3BwOgorICAgICAgICAoSlNDOjpJbnRlcnByZXRlcjo6dHJ5Q2FjaGVQdXRCeUlEKToKKyAgICAg ICAgKiBqaXQvSklUU3R1YnMuY3BwOgorICAgICAgICAoSlNDOjpKSVRUaHVua3M6OnRyeUNhY2hl UHV0QnlJRCk6CisKKzIwMDktMDktMjEgIE9saXZlciBIdW50ICA8b2xpdmVyQGFwcGxlLmNvbT4K KwogICAgICAgICBSUz1NYWNpZWogU3RhY2hvd2lhay4KIAogICAgICAgICBSZS1sYW5kIFNORVMg Zml4IHdpdGggY29ycmVjdGVkIGFzc2VydGlvbi4KZGlmZiAtLWdpdCBhL0phdmFTY3JpcHRDb3Jl L2ludGVycHJldGVyL0ludGVycHJldGVyLmNwcCBiL0phdmFTY3JpcHRDb3JlL2ludGVycHJldGVy L0ludGVycHJldGVyLmNwcAppbmRleCA2MjQ4MzJjLi44YThmYjNjIDEwMDY0NAotLS0gYS9KYXZh U2NyaXB0Q29yZS9pbnRlcnByZXRlci9JbnRlcnByZXRlci5jcHAKKysrIGIvSmF2YVNjcmlwdENv cmUvaW50ZXJwcmV0ZXIvSW50ZXJwcmV0ZXIuY3BwCkBAIC05ODgsNiArOTg4LDEwIEBAIE5FVkVS X0lOTElORSB2b2lkIEludGVycHJldGVyOjp0cnlDYWNoZVB1dEJ5SUQoQ2FsbEZyYW1lKiBjYWxs RnJhbWUsIENvZGVCbG9jayoKIAogICAgIC8vIFN0cnVjdHVyZSB0cmFuc2l0aW9uLCBjYWNoZSB0 cmFuc2l0aW9uIGluZm8KICAgICBpZiAoc2xvdC50eXBlKCkgPT0gUHV0UHJvcGVydHlTbG90OjpO ZXdQcm9wZXJ0eSkgeworICAgICAgICBpZiAoc3RydWN0dXJlLT5pc0RpY3Rpb25hcnkoKSkgewor ICAgICAgICAgICAgdlBDWzBdID0gZ2V0T3Bjb2RlKG9wX3B1dF9ieV9pZF9nZW5lcmljKTsKKyAg ICAgICAgICAgIHJldHVybjsKKyAgICAgICAgfQogICAgICAgICB2UENbMF0gPSBnZXRPcGNvZGUo b3BfcHV0X2J5X2lkX3RyYW5zaXRpb24pOwogICAgICAgICB2UENbNF0gPSBzdHJ1Y3R1cmUtPnBy ZXZpb3VzSUQoKTsKICAgICAgICAgdlBDWzVdID0gc3RydWN0dXJlOwpkaWZmIC0tZ2l0IGEvSmF2 YVNjcmlwdENvcmUvaml0L0pJVFN0dWJzLmNwcCBiL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRTdHVi cy5jcHAKaW5kZXggZjE5NzUyNi4uMDU1YTUzNiAxMDA2NDQKLS0tIGEvSmF2YVNjcmlwdENvcmUv aml0L0pJVFN0dWJzLmNwcAorKysgYi9KYXZhU2NyaXB0Q29yZS9qaXQvSklUU3R1YnMuY3BwCkBA IC02OTUsNyArNjk1LDcgQEAgTkVWRVJfSU5MSU5FIHZvaWQgSklUVGh1bmtzOjp0cnlDYWNoZVB1 dEJ5SUQoQ2FsbEZyYW1lKiBjYWxsRnJhbWUsIENvZGVCbG9jayogY28KICAgICAvLyBTdHJ1Y3R1 cmUgdHJhbnNpdGlvbiwgY2FjaGUgdHJhbnNpdGlvbiBpbmZvCiAgICAgaWYgKHNsb3QudHlwZSgp ID09IFB1dFByb3BlcnR5U2xvdDo6TmV3UHJvcGVydHkpIHsKICAgICAgICAgU3RydWN0dXJlQ2hh aW4qIHByb3RvdHlwZUNoYWluID0gc3RydWN0dXJlLT5wcm90b3R5cGVDaGFpbihjYWxsRnJhbWUp OwotICAgICAgICBpZiAoIXByb3RvdHlwZUNoYWluLT5pc0NhY2hlYWJsZSgpKSB7CisgICAgICAg IGlmICghcHJvdG90eXBlQ2hhaW4tPmlzQ2FjaGVhYmxlKCkgfHwgc3RydWN0dXJlLT5pc0RpY3Rp b25hcnkoKSkgewogICAgICAgICAgICAgY3RpUGF0Y2hDYWxsQnlSZXR1cm5BZGRyZXNzKGNvZGVC bG9jaywgcmV0dXJuQWRkcmVzcywgRnVuY3Rpb25QdHIoY3RpX29wX3B1dF9ieV9pZF9nZW5lcmlj KSk7CiAgICAgICAgICAgICByZXR1cm47CiAgICAgICAgIH0KZGlmZiAtLWdpdCBhL0xheW91dFRl c3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCAxMDdmMDBiLi4wZjdi NTBhIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMDktMDktMjEgIE9saXZlciBIdW50ICA8b2xp dmVyQGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwor ICAgICAgICBSRUdSRVNTSU9OIChyNDg1ODIpOiBDcmFzaCBpbiBTdHJ1Y3R1cmVTdHViSW5mbzo6 aW5pdFB1dEJ5SWRUcmFuc2l0aW9uIHdoZW4gcmVsb2FkaW5nIHRyYWMud2Via2l0Lm9yZworICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9Mjk1OTkKKworICAg ICAgICBBZGQgdGVzdCBjYXNlIGZvciBwcmV2ZW50aW5nIHByb3BlcnR5IGFkZGl0aW9uIHRyYW5z aXRpb24gY2FjaGluZyBvbiBkaWN0aW9uYXJpZXMuCisKKyAgICAgICAgKiBmYXN0L2pzL3Jlc291 cmNlcy90cmFuc2l0aW9uLWNhY2hlLWRpY3Rpb25hcnktY3Jhc2guanM6IEFkZGVkLgorICAgICAg ICAoZik6CisgICAgICAgICogZmFzdC9qcy90cmFuc2l0aW9uLWNhY2hlLWRpY3Rpb25hcnktY3Jh c2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2pzL3RyYW5zaXRpb24tY2Fj aGUtZGljdGlvbmFyeS1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAwOS0wOS0yMCAgQWRhbSBCYXJ0 aCAgPGFiYXJ0aEB3ZWJraXQub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IE1hY2llaiBTdGFj aG93aWFrLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9qcy9yZXNvdXJjZXMvdHJhbnNp dGlvbi1jYWNoZS1kaWN0aW9uYXJ5LWNyYXNoLmpzIGIvTGF5b3V0VGVzdHMvZmFzdC9qcy9yZXNv dXJjZXMvdHJhbnNpdGlvbi1jYWNoZS1kaWN0aW9uYXJ5LWNyYXNoLmpzCm5ldyBmaWxlIG1vZGUg MTAwNjQ0CmluZGV4IDAwMDAwMDAuLmU4M2JjZTgKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRU ZXN0cy9mYXN0L2pzL3Jlc291cmNlcy90cmFuc2l0aW9uLWNhY2hlLWRpY3Rpb25hcnktY3Jhc2gu anMKQEAgLTAsMCArMSwxOSBAQAorZGVzY3JpcHRpb24oIlRlc3QgdG8gZW5zdXJlIHdlIGRvbid0 IGF0dGVtcHQgdG8gY2FjaGUgbmV3IHByb3BlcnR5IHRyYW5zaXRpb25zIG9uIGRpY3Rpb25hcnku ICBQYXNzZXMgaWYgeW91IGRvbid0IGNyYXNoLiIpOworCit2YXIgY2FjaGVhYmxlRGljdGlvbmFy eSA9IHt9OworZm9yICh2YXIgaSA9IDA7IGkgPCA1MDA7IGkrKykKKyAgICBjYWNoZWFibGVEaWN0 aW9uYXJ5WyJhIiArIGldID0gaTsKKworZnVuY3Rpb24gZihvKSB7CisgICAgby5jcmFzaCA9ICJk b29tISI7Cit9CitmKHt9KTsKK2YoY2FjaGVhYmxlRGljdGlvbmFyeSk7CitmKGNhY2hlYWJsZURp Y3Rpb25hcnkpOworZihjYWNoZWFibGVEaWN0aW9uYXJ5KTsKK2YoY2FjaGVhYmxlRGljdGlvbmFy eSk7CitmKGNhY2hlYWJsZURpY3Rpb25hcnkpOworZihjYWNoZWFibGVEaWN0aW9uYXJ5KTsKK2Yo Y2FjaGVhYmxlRGljdGlvbmFyeSk7CitmKGNhY2hlYWJsZURpY3Rpb25hcnkpOworc3VjY2Vzc2Z1 bGx5UGFyc2VkID0gdHJ1ZTsKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvanMvdHJhbnNp dGlvbi1jYWNoZS1kaWN0aW9uYXJ5LWNyYXNoLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zh c3QvanMvdHJhbnNpdGlvbi1jYWNoZS1kaWN0aW9uYXJ5LWNyYXNoLWV4cGVjdGVkLnR4dApuZXcg ZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi4zZjY1OTE3Ci0tLSAvZGV2L251bGwKKysr IGIvTGF5b3V0VGVzdHMvZmFzdC9qcy90cmFuc2l0aW9uLWNhY2hlLWRpY3Rpb25hcnktY3Jhc2gt ZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsOSBAQAorVGVzdCB0byBlbnN1cmUgd2UgZG9uJ3QgYXR0 ZW1wdCB0byBjYWNoZSBuZXcgcHJvcGVydHkgdHJhbnNpdGlvbnMgb24gZGljdGlvbmFyeS4gUGFz c2VzIGlmIHlvdSBkb24ndCBjcmFzaC4KKworT24gc3VjY2VzcywgeW91IHdpbGwgc2VlIGEgc2Vy aWVzIG9mICJQQVNTIiBtZXNzYWdlcywgZm9sbG93ZWQgYnkgIlRFU1QgQ09NUExFVEUiLgorCisK K1BBU1Mgc3VjY2Vzc2Z1bGx5UGFyc2VkIGlzIHRydWUKKworVEVTVCBDT01QTEVURQorCmRpZmYg LS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2pzL3RyYW5zaXRpb24tY2FjaGUtZGljdGlvbmFyeS1j cmFzaC5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9qcy90cmFuc2l0aW9uLWNhY2hlLWRpY3Rpb25h cnktY3Jhc2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5kMjI5M2Zh Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9qcy90cmFuc2l0aW9uLWNhY2hl LWRpY3Rpb25hcnktY3Jhc2guaHRtbApAQCAtMCwwICsxLDEzIEBACis8IURPQ1RZUEUgSFRNTCBQ VUJMSUMgIi0vL0lFVEYvL0RURCBIVE1MLy9FTiI+Cis8aHRtbD4KKzxoZWFkPgorPGxpbmsgcmVs PSJzdHlsZXNoZWV0IiBocmVmPSJyZXNvdXJjZXMvanMtdGVzdC1zdHlsZS5jc3MiPgorPHNjcmlw dCBzcmM9InJlc291cmNlcy9qcy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9k eT4KKzxwIGlkPSJkZXNjcmlwdGlvbiI+PC9wPgorPGRpdiBpZD0iY29uc29sZSI+PC9kaXY+Cis8 c2NyaXB0IHNyYz0icmVzb3VyY2VzL3RyYW5zaXRpb24tY2FjaGUtZGljdGlvbmFyeS1jcmFzaC5q cyI+PC9zY3JpcHQ+Cis8c2NyaXB0IHNyYz0icmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9z Y3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+