86918 2012-05-18 16:01:22 -0700 DFG CFG simplification crashes if it's trying to remove an unreachable block that has an already-killed-off unreachable successor 2012-05-18 16:20:12 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 84553 1 fpizlo webkit-unassigned oldest_to_newest 628206 0 fpizlo 2012-05-18 16:01:22 -0700 We kill off unreachable blocks in arbitrary order. Therefore if there is a network of unreachable blocks, we may try to do unreachable-successor fix-up when the successor has already been deleted. Then we crash. This is hit by: inspector/styles/styles-computed-trace.html inspector/console/console-big-array.html 628208 1 142810 fpizlo 2012-05-18 16:03:34 -0700 Created attachment 142810 the patch 628228 2 fpizlo 2012-05-18 16:20:12 -0700 Landed in http://trac.webkit.org/changeset/117654 142810 2012-05-18 16:03:34 -0700 2012-05-18 16:04:32 -0700 the patch fixdeadnetwork_patch_1.diff text/plain 1748 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTE3NjUxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBA CisyMDEyLTA1LTE4ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg REZHIENGRyBzaW1wbGlmaWNhdGlvbiBjcmFzaGVzIGlmIGl0J3MgdHJ5aW5nIHRvIHJlbW92ZSBh biB1bnJlYWNoYWJsZSBibG9jaworICAgICAgICB0aGF0IGhhcyBhbiBhbHJlYWR5LWtpbGxlZC1v ZmYgdW5yZWFjaGFibGUgc3VjY2Vzc29yCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD04NjkxOAorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorICAgICAgICAKKyAgICAgICAgVGhpcyBmaXhlcyBjcmFzaGVzIGluOgorICAgICAgICBp bnNwZWN0b3Ivc3R5bGVzL3N0eWxlcy1jb21wdXRlZC10cmFjZS5odG1sCisgICAgICAgIGluc3Bl Y3Rvci9jb25zb2xlL2NvbnNvbGUtYmlnLWFycmF5Lmh0bWwKKworICAgICAgICAqIGRmZy9ERkdD RkdTaW1wbGlmaWNhdGlvblBoYXNlLmNwcDoKKyAgICAgICAgKEpTQzo6REZHOjpDRkdTaW1wbGlm aWNhdGlvblBoYXNlOjpmaXhQaGlzKToKKwogMjAxMi0wNS0xOCAgRmlsaXAgUGl6bG8gIDxmcGl6 bG9AYXBwbGUuY29tPgogCiAgICAgICAgIERGRyBzaG91bGQgaGF2ZSBjb250cm9sIGZsb3cgZ3Jh cGggc2ltcGxpZmljYXRpb24KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQ0ZH U2ltcGxpZmljYXRpb25QaGFzZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRD b3JlL2RmZy9ERkdDRkdTaW1wbGlmaWNhdGlvblBoYXNlLmNwcAkocmV2aXNpb24gMTE3NjQ2KQor KysgU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdDRkdTaW1wbGlmaWNhdGlvblBoYXNlLmNw cAkod29ya2luZyBjb3B5KQpAQCAtMzIzLDYgKzMyMywxMSBAQCBwcml2YXRlOgogICAgIHsKICAg ICAgICAgQmFzaWNCbG9jayogc291cmNlQmxvY2sgPSBtX2dyYXBoLm1fYmxvY2tzW3NvdXJjZUJs b2NrSW5kZXhdLmdldCgpOwogICAgICAgICBCYXNpY0Jsb2NrKiBkZXN0aW5hdGlvbkJsb2NrID0g bV9ncmFwaC5tX2Jsb2Nrc1tkZXN0aW5hdGlvbkJsb2NrSW5kZXhdLmdldCgpOworICAgICAgICBp ZiAoIWRlc3RpbmF0aW9uQmxvY2spIHsKKyAgICAgICAgICAgIC8vIElmIHdlJ3JlIHRyeWluZyB0 byBraWxsIG9mZiB0aGUgc291cmNlIGJsb2NrIGFuZCB0aGUgZGVzdGluYXRpb24gYmxvY2sgaXMg YWxyZWFkeQorICAgICAgICAgICAgLy8gZGVhZCwgdGhlbiB3ZSdyZSBkb25lIQorICAgICAgICAg ICAgcmV0dXJuOworICAgICAgICB9CiAgICAgICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgZGVz dGluYXRpb25CbG9jay0+cGhpcy5zaXplKCk7ICsraSkgewogICAgICAgICAgICAgTm9kZUluZGV4 IHBoaU5vZGVJbmRleCA9IGRlc3RpbmF0aW9uQmxvY2stPnBoaXNbaV07CiAgICAgICAgICAgICBO b2RlJiBwaGlOb2RlID0gbV9ncmFwaFtwaGlOb2RlSW5kZXhdOwo=