71227 2011-10-31 10:47:21 -0700 REGRESSION (r97118): Reproducible crash in JSCell::toPrimitive when adding 2011-10-31 14:04:03 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED http://webmop.de/app/context.html InRadar, Regression P1 Normal --- 1 ap webkit-unassigned barraclough fpizlo oldest_to_newest 493408 0 ap 2011-10-31 10:47:21 -0700 Steps to reproduce: open http://webmop.de/app/context.html Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010afc5c34 JSC::JSCell::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 4 1 com.apple.JavaScriptCore 0x000000010af022cd JSC::jsAddSlowCase(JSC::ExecState*, JSC::JSValue, JSC::JSValue) + 941 2 com.apple.JavaScriptCore 0x000000010ae966e9 cti_op_add + 121 3 ??? 0x00004cbbf7f54454 0 + 84370202641492 4 com.apple.JavaScriptCore 0x000000010ae37128 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1112 5 com.apple.JavaScriptCore 0x000000010ae36cbd JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 45 <rdar://problem/10306791> 493483 1 113084 fpizlo 2011-10-31 14:00:47 -0700 Created attachment 113084 the patch 493485 2 fpizlo 2011-10-31 14:04:03 -0700 Landed in http://trac.webkit.org/changeset/98878 113084 2011-10-31 14:00:47 -0700 2011-10-31 14:02:07 -0700 the patch spillfilldouble_patch_1.diff text/plain 2076 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gOTg4NzcpCisrKyBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMjEgQEAK KzIwMTEtMTAtMzEgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KKworICAgICAgICBS RUdSRVNTSU9OIChyOTcxMTgpOiBSZXByb2R1Y2libGUgY3Jhc2ggaW4gSlNDZWxsOjp0b1ByaW1p dGl2ZSB3aGVuIGFkZGluZworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9NzEyMjcKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKyAg ICAgICAgCisgICAgICAgIE5vIG5ldyB0ZXN0cywgc2luY2Ugd2hpbGUgSSBjYW4gc2VlIGV4YWN0 bHkgd2hlcmUgdGhlIERGRyB3ZW50IHdyb25nIG9uIHRoZQorICAgICAgICBzaXRlIGluIHF1ZXN0 aW9uIGZyb20gbG9va2luZyBhdCB0aGUgZ2VuZXJhdGVkIG1hY2hpbmUgY29kZSwgYW5kIHdoaWxl IEkgY2FuCisgICAgICAgIGNlcnRhaW5seSBiZWxpZXZlIHRoYXQgc3VjaCBhIHNjZW5hcmlvIHdv dWxkIGhhcHBlbiwgSSBjYW5ub3QgdmlzdWFsaXplIGhvdworICAgICAgICB0byBtYWtlIGl0IGhh cHBlbiByZXByb2R1Y2libHkuIEl0IHJlcXVpcmVzIGFuIG9kZCBjb21iaW5hdGlvbiBvZiBkb3Vi bGUKKyAgICAgICAgdmFsdWVzIGdldHRpbmcgc3BpbGxlZCBhbmQgdGhlbiByZWZpbGxlZCwgYnV0 IHRoZW4gcmVib3hlZCBhdCBqdXN0IHRoZSByaWdodAorICAgICAgICB0aW1lIHNvIHRoYXQgdGhl IHNwaWxsZWQgdmFsdWUgaXMgYW4gdW5ib3hlZCBkb3VibGUgd2hpbGUgdGhlIGluLXJlZ2lzdGVy CisgICAgICAgIHZhbHVlIGlzIGEgYm94ZWQgZG91YmxlLgorCisgICAgICAgICogZGZnL0RGR0pJ VENvZGVHZW5lcmF0b3IuaDoKKyAgICAgICAgKEpTQzo6REZHOjpKSVRDb2RlR2VuZXJhdG9yOjpz aWxlbnRGaWxsR1BSKToKKwogMjAxMS0xMC0zMCAgRmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUu Y29tPgogCiAgICAgICAgIEpTUGFyc2VyOjpwYXJzZVByaW1hcnlFeHByZXNzaW9uIHNob3VsZCBo YXZlIGFuIG92ZXJmbG93IGNoZWNrCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RG R0pJVENvZGVHZW5lcmF0b3IuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUv ZGZnL0RGR0pJVENvZGVHZW5lcmF0b3IuaAkocmV2aXNpb24gOTg4NzQpCisrKyBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvZGZnL0RGR0pJVENvZGVHZW5lcmF0b3IuaAkod29ya2luZyBjb3B5KQpAQCAt Mzk3LDYgKzM5NywxMCBAQCBwcm90ZWN0ZWQ6CiAgICAgICAgICAgICBBU1NFUlQocmVnaXN0ZXJG b3JtYXQgPT0gRGF0YUZvcm1hdEpTSW50ZWdlcik7CiAgICAgICAgICAgICBtX2ppdC5sb2FkMzIo SklUQ29tcGlsZXI6OnBheWxvYWRGb3Ioc3BpbGxNZSksIGluZm8uZ3ByKCkpOwogICAgICAgICAg ICAgbV9qaXQub3JQdHIoR1BSSW5mbzo6dGFnVHlwZU51bWJlclJlZ2lzdGVyLCBpbmZvLmdwcigp KTsKKyAgICAgICAgfSBlbHNlIGlmIChpbmZvLnNwaWxsRm9ybWF0KCkgPT0gRGF0YUZvcm1hdERv dWJsZSkgeworICAgICAgICAgICAgQVNTRVJUKHJlZ2lzdGVyRm9ybWF0ID09IERhdGFGb3JtYXRK U0RvdWJsZSk7CisgICAgICAgICAgICBtX2ppdC5sb2FkUHRyKEpJVENvbXBpbGVyOjphZGRyZXNz Rm9yKHNwaWxsTWUpLCBpbmZvLmdwcigpKTsKKyAgICAgICAgICAgIG1faml0LnN1YlB0cihHUFJJ bmZvOjp0YWdUeXBlTnVtYmVyUmVnaXN0ZXIsIGluZm8uZ3ByKCkpOwogICAgICAgICB9IGVsc2UK ICAgICAgICAgICAgIG1faml0LmxvYWRQdHIoSklUQ29tcGlsZXI6OmFkZHJlc3NGb3Ioc3BpbGxN ZSksIGluZm8uZ3ByKCkpOwogI2Vsc2UK