<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>97001</bug_id>
          
          <creation_ts>2012-09-18 05:07:15 -0700</creation_ts>
          <short_desc>REGRESSION(r128802): It made some JS tests crash</short_desc>
          <delta_ts>2012-09-19 16:26:42 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P1</priority>
          <bug_severity>Critical</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>79668</blocked>
    
    <blocked>96596</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="Csaba Osztrogonác">ossy</reporter>
          <assigned_to name="Filip Pizlo">fpizlo</assigned_to>
          <cc>barraclough</cc>
    
    <cc>cdumez</cc>
    
    <cc>fpizlo</cc>
    
    <cc>ossy</cc>
    
    <cc>rakuco</cc>
    
    <cc>simon.fraser</cc>
    
    <cc>svillar</cc>
    
    <cc>zan</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>722674</commentid>
    <comment_count>0</comment_count>
    <who name="Csaba Osztrogonác">ossy</who>
    <bug_when>2012-09-18 05:07:15 -0700</bug_when>
    <thetext>- storage/websql/execute-sql-args.html - crash in release/debug mode
- fast/js/object-bad-time.html - new test, crash in debug mode
- fast/js/array-slow-put.html - new test, crash in debug mode
- fast/js/Object-defineProperty.html - old test, crash in debug mode from r128802
- ietestcenter/Javascript/15.4.4.14-9-b-i-6.html - old test, crash in debug mode from r128802
- ietestcenter/Javascript/15.4.4.15-8-b-i-6.html - old test, crash in debug mode from r128802

Qt results:
------------
http://build.webkit.sed.hu/results/x86-64%20Linux%20Qt%20Debug/r128867%20%2825205%29/results.html

GTK results:
-------------
http://build.webkit.org/results/GTK%20Linux%2064-bit%20Debug/r128871%20%2836857%29/results.html

EFL results:
-------------
http://build.webkit.org/results/EFL%20Linux%2064-bit%20Debug/r128873%20%286043%29/results.html</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>722683</commentid>
    <comment_count>1</comment_count>
    <who name="Csaba Osztrogonác">ossy</who>
    <bug_when>2012-09-18 05:19:06 -0700</bug_when>
    <thetext>I tried to generate GDB backtraces for these crashes on Qt, but unfortunately
they pass if we run tests one by one, but crash if we run all fast/js tests.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>722698</commentid>
    <comment_count>2</comment_count>
    <who name="Csaba Osztrogonác">ossy</who>
    <bug_when>2012-09-18 05:44:39 -0700</bug_when>
    <thetext>I skipped them on Qt to paint the bots green - https://trac.webkit.org/changeset/128878

Please unskip them with the proper fix.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>722704</commentid>
    <comment_count>3</comment_count>
    <who name="Raphael Kubo da Costa (:rakuco)">rakuco</who>
    <bug_when>2012-09-18 05:51:28 -0700</bug_when>
    <thetext>(In reply to comment #1)
&gt; I tried to generate GDB backtraces for these crashes on Qt, but unfortunately
&gt; they pass if we run tests one by one, but crash if we run all fast/js tests.

Alternatively, if you just run the same test twice or more it crashes after the first run. Example backtrace:

#0  0x080d3a5c in JSC::WriteBarrierBase&lt;JSC::Structure&gt;::unvalidatedGet (this=0x0) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/WriteBarrier.h:139
#1  0x080d24a1 in JSC::JSCell::unvalidatedStructure (this=0x0) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSCell.h:143
#2  0xb786f9bc in JSC::slowValidateCell (cell=0xabadf610) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSCell.cpp:167
#3  0x080d2072 in JSC::validateCell&lt;JSC::JSCell*&gt; (cell=0xabadf610) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/WriteBarrier.h:55
#4  0x080d3a98 in JSC::WriteBarrierBase&lt;JSC::Structure&gt;::get (this=0xabbcf420) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/WriteBarrier.h:103
#5  0xb787d74d in JSC::JSGlobalObject::haveABadTime (this=0xabbcf250, globalData=...) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.cpp:409
#6  0xb788ced7 in JSC::JSObject::notifyPresenceOfIndexedAccessors (this=0xabbef890, globalData=...) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSObject.cpp:470
#7  0xb788f84f in JSC::JSObject::defineOwnIndexedProperty (this=0xabbef890, exec=0xacee00d8, index=0, descriptor=..., throwException=true) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSObject.cpp:1105
#8  0xb786777f in JSC::JSArray::defineOwnProperty (object=0xabbef890, exec=0xacee00d8, propertyName=..., descriptor=..., throwException=true) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSArray.cpp:179
#9  0xb78bf776 in JSC::objectConstructorDefineProperty (exec=0xacee00d8) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/ObjectConstructor.cpp:304
#10 0xacebd72f in ?? ()
#11 0xb778e3d3 in JSC::JITCode::execute (this=0xabb5fe64, registerFile=0x822042c, callFrame=0xacee0038, globalData=0x8279128) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/jit/JITCode.h:134
#12 0xb778ab08 in JSC::Interpreter::execute (this=0x8220420, program=0xabb5fe50, callFrame=0xabbcf3ac, thisObj=0xabbefff0) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/interpreter/Interpreter.cpp:992
#13 0xb784d07e in JSC::evaluate (exec=0xabbcf3ac, source=..., thisValue=..., returnedException=0xbfffe70c) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/Completion.cpp:75
#14 0xb35813fa in WebCore::JSMainThreadExecState::evaluate (exec=0xabbcf3ac, source=..., thisValue=..., exception=0xbfffe70c) at /home/rakuco/dev/WebKit/Source/WebCore/bindings/js/JSMainThreadExecState.h:77
#15 0xb359ea11 in WebCore::ScriptController::evaluateInWorld (this=0x81d9b34, sourceCode=..., world=0x821dea0) at /home/rakuco/dev/WebKit/Source/WebCore/bindings/js/ScriptController.cpp:148
#16 0xb359eb08 in WebCore::ScriptController::evaluate (this=0x81d9b34, sourceCode=...) at /home/rakuco/dev/WebKit/Source/WebCore/bindings/js/ScriptController.cpp:165
#17 0xb2b7ece4 in WebCore::ScriptElement::executeScript (this=0x8421604, sourceCode=...) at /home/rakuco/dev/WebKit/Source/WebCore/dom/ScriptElement.cpp:301
#18 0xb2d64db1 in WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent (this=0x81f6470, pendingScript=...) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLScriptRunner.cpp:139
#19 0xb2d64c29 in WebCore::HTMLScriptRunner::executeParsingBlockingScript (this=0x81f6470) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLScriptRunner.cpp:118
#20 0xb2d6512d in WebCore::HTMLScriptRunner::executeParsingBlockingScripts (this=0x81f6470) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLScriptRunner.cpp:190
#21 0xb2d650d9 in WebCore::HTMLScriptRunner::execute (this=0x81f6470, scriptElement=..., scriptStartPosition=...) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLScriptRunner.cpp:178
#22 0xb2d560bb in WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder (this=0x81ecc88) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:200
#23 0xb2d56160 in WebCore::HTMLDocumentParser::canTakeNextToken (this=0x81ecc88, mode=WebCore::HTMLDocumentParser::AllowYield, session=...) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:217
#24 0xb2d56556 in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x81ecc88, mode=WebCore::HTMLDocumentParser::AllowYield) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:254
#25 0xb2d55f4a in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x81ecc88, mode=WebCore::HTMLDocumentParser::AllowYield) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:173
#26 0xb2d570d3 in WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution (this=0x81ecc88) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:476
#27 0xb2d573a4 in WebCore::HTMLDocumentParser::notifyFinished (this=0x81ecc88, cachedResource=0x8257350) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:516
#28 0xb2f27f4b in WebCore::CachedResource::checkNotify (this=0x8257350) at /home/rakuco/dev/WebKit/Source/WebCore/loader/cache/CachedResource.cpp:248
#29 0xb2f3bccf in WebCore::CachedScript::data (this=0x8257350, data=..., allDataReceived=true) at /home/rakuco/dev/WebKit/Source/WebCore/loader/cache/CachedScript.cpp:90
#30 0xb2eeb897 in WebCore::SubresourceLoader::didFinishLoading (this=0x824ece8, finishTime=0) at /home/rakuco/dev/WebKit/Source/WebCore/loader/SubresourceLoader.cpp:300
#31 0xb2ee6cf5 in WebCore::ResourceLoader::didFinishLoading (this=0x824ece8, finishTime=0) at /home/rakuco/dev/WebKit/Source/WebCore/loader/ResourceLoader.cpp:441
#32 0xb3a19bc0 in WebCore::readCallback (asyncResult=0x8273b60, data=0x8275a78) at /home/rakuco/dev/WebKit/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:953
#33 0xb01c62e8 in async_ready_callback_wrapper (source_object=0x8261980, res=0x8273b60, user_data=user_data@entry=0x8275a78) at ginputstream.c:529
#34 0xb01dd200 in g_simple_async_result_complete (simple=simple@entry=0x8273b60) at gsimpleasyncresult.c:767
#35 0xb01dd273 in complete_in_idle_cb_for_thread (_data=_data@entry=0x81f3cd0) at gsimpleasyncresult.c:835
#36 0xb03c0af0 in g_idle_dispatch (source=source@entry=0xac561db8, callback=0xb01dd240 &lt;complete_in_idle_cb_for_thread&gt;, user_data=0x81f3cd0) at gmain.c:4657
#37 0xb03c3033 in g_main_dispatch (context=0x81c4a68) at gmain.c:2539
#38 g_main_context_dispatch (context=context@entry=0x81c4a68) at gmain.c:3075
#39 0xb09af09c in _ecore_glib_select__locked (ecore_timeout=0xbfffee08, efds=0xbfffef10, wfds=0xbfffee90, rfds=0xbfffee10, ecore_fds=10, ctx=0x81c4a68) at ecore_glib.c:171
#40 _ecore_glib_select (ecore_fds=10, rfds=0xbfffee10, wfds=0xbfffee90, efds=0xbfffef10, ecore_timeout=0xbfffee08) at ecore_glib.c:205#41 0xb09a8d9f in _ecore_main_select (timeout=0) at ecore_main.c:1370
#42 0xb09a9875 in _ecore_main_loop_iterate_internal (once_only=once_only@entry=0) at ecore_main.c:1786
#43 0xb09a9c0f in ecore_main_loop_begin () at ecore_main.c:931
#44 0x080b7bd7 in runTest (inputLine=0xbffff4cb &quot;LayoutTests/ietestcenter/Javascript/15.4.4.14-9-b-i-5.html&quot;) at /home/rakuco/dev/WebKit/Tools/DumpRenderTree/efl/DumpRenderTree.cpp:289
#45 0x080b8463 in main (argc=3, argv=0xbffff2d4) at /home/rakuco/dev/WebKit/Tools/DumpRenderTree/efl/DumpRenderTree.cpp:457</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>722708</commentid>
    <comment_count>4</comment_count>
    <who name="Raphael Kubo da Costa (:rakuco)">rakuco</who>
    <bug_when>2012-09-18 05:56:44 -0700</bug_when>
    <thetext>(In reply to comment #2)
&gt; I skipped them on Qt to paint the bots green - https://trac.webkit.org/changeset/128878
&gt; 
&gt; Please unskip them with the proper fix.

Tests skipped on EFL as well: &lt;http://trac.webkit.org/changeset/128881&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>722864</commentid>
    <comment_count>5</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-18 09:32:55 -0700</bug_when>
    <thetext>Yup, I&apos;m looking at it.  Strange that I didn&apos;t see these on Mac. :-/</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>722972</commentid>
    <comment_count>6</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-18 12:21:03 -0700</bug_when>
    <thetext>Which test were you running?

(In reply to comment #3)
&gt; (In reply to comment #1)
&gt; &gt; I tried to generate GDB backtraces for these crashes on Qt, but unfortunately
&gt; &gt; they pass if we run tests one by one, but crash if we run all fast/js tests.
&gt; 
&gt; Alternatively, if you just run the same test twice or more it crashes after the first run. Example backtrace:
&gt; 
&gt; #0  0x080d3a5c in JSC::WriteBarrierBase&lt;JSC::Structure&gt;::unvalidatedGet (this=0x0) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/WriteBarrier.h:139
&gt; #1  0x080d24a1 in JSC::JSCell::unvalidatedStructure (this=0x0) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSCell.h:143
&gt; #2  0xb786f9bc in JSC::slowValidateCell (cell=0xabadf610) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSCell.cpp:167
&gt; #3  0x080d2072 in JSC::validateCell&lt;JSC::JSCell*&gt; (cell=0xabadf610) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/WriteBarrier.h:55
&gt; #4  0x080d3a98 in JSC::WriteBarrierBase&lt;JSC::Structure&gt;::get (this=0xabbcf420) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/WriteBarrier.h:103
&gt; #5  0xb787d74d in JSC::JSGlobalObject::haveABadTime (this=0xabbcf250, globalData=...) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSGlobalObject.cpp:409
&gt; #6  0xb788ced7 in JSC::JSObject::notifyPresenceOfIndexedAccessors (this=0xabbef890, globalData=...) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSObject.cpp:470
&gt; #7  0xb788f84f in JSC::JSObject::defineOwnIndexedProperty (this=0xabbef890, exec=0xacee00d8, index=0, descriptor=..., throwException=true) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSObject.cpp:1105
&gt; #8  0xb786777f in JSC::JSArray::defineOwnProperty (object=0xabbef890, exec=0xacee00d8, propertyName=..., descriptor=..., throwException=true) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/JSArray.cpp:179
&gt; #9  0xb78bf776 in JSC::objectConstructorDefineProperty (exec=0xacee00d8) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/ObjectConstructor.cpp:304
&gt; #10 0xacebd72f in ?? ()
&gt; #11 0xb778e3d3 in JSC::JITCode::execute (this=0xabb5fe64, registerFile=0x822042c, callFrame=0xacee0038, globalData=0x8279128) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/jit/JITCode.h:134
&gt; #12 0xb778ab08 in JSC::Interpreter::execute (this=0x8220420, program=0xabb5fe50, callFrame=0xabbcf3ac, thisObj=0xabbefff0) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/interpreter/Interpreter.cpp:992
&gt; #13 0xb784d07e in JSC::evaluate (exec=0xabbcf3ac, source=..., thisValue=..., returnedException=0xbfffe70c) at /home/rakuco/dev/WebKit/Source/JavaScriptCore/runtime/Completion.cpp:75
&gt; #14 0xb35813fa in WebCore::JSMainThreadExecState::evaluate (exec=0xabbcf3ac, source=..., thisValue=..., exception=0xbfffe70c) at /home/rakuco/dev/WebKit/Source/WebCore/bindings/js/JSMainThreadExecState.h:77
&gt; #15 0xb359ea11 in WebCore::ScriptController::evaluateInWorld (this=0x81d9b34, sourceCode=..., world=0x821dea0) at /home/rakuco/dev/WebKit/Source/WebCore/bindings/js/ScriptController.cpp:148
&gt; #16 0xb359eb08 in WebCore::ScriptController::evaluate (this=0x81d9b34, sourceCode=...) at /home/rakuco/dev/WebKit/Source/WebCore/bindings/js/ScriptController.cpp:165
&gt; #17 0xb2b7ece4 in WebCore::ScriptElement::executeScript (this=0x8421604, sourceCode=...) at /home/rakuco/dev/WebKit/Source/WebCore/dom/ScriptElement.cpp:301
&gt; #18 0xb2d64db1 in WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent (this=0x81f6470, pendingScript=...) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLScriptRunner.cpp:139
&gt; #19 0xb2d64c29 in WebCore::HTMLScriptRunner::executeParsingBlockingScript (this=0x81f6470) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLScriptRunner.cpp:118
&gt; #20 0xb2d6512d in WebCore::HTMLScriptRunner::executeParsingBlockingScripts (this=0x81f6470) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLScriptRunner.cpp:190
&gt; #21 0xb2d650d9 in WebCore::HTMLScriptRunner::execute (this=0x81f6470, scriptElement=..., scriptStartPosition=...) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLScriptRunner.cpp:178
&gt; #22 0xb2d560bb in WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder (this=0x81ecc88) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:200
&gt; #23 0xb2d56160 in WebCore::HTMLDocumentParser::canTakeNextToken (this=0x81ecc88, mode=WebCore::HTMLDocumentParser::AllowYield, session=...) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:217
&gt; #24 0xb2d56556 in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x81ecc88, mode=WebCore::HTMLDocumentParser::AllowYield) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:254
&gt; #25 0xb2d55f4a in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x81ecc88, mode=WebCore::HTMLDocumentParser::AllowYield) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:173
&gt; #26 0xb2d570d3 in WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution (this=0x81ecc88) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:476
&gt; #27 0xb2d573a4 in WebCore::HTMLDocumentParser::notifyFinished (this=0x81ecc88, cachedResource=0x8257350) at /home/rakuco/dev/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp:516
&gt; #28 0xb2f27f4b in WebCore::CachedResource::checkNotify (this=0x8257350) at /home/rakuco/dev/WebKit/Source/WebCore/loader/cache/CachedResource.cpp:248
&gt; #29 0xb2f3bccf in WebCore::CachedScript::data (this=0x8257350, data=..., allDataReceived=true) at /home/rakuco/dev/WebKit/Source/WebCore/loader/cache/CachedScript.cpp:90
&gt; #30 0xb2eeb897 in WebCore::SubresourceLoader::didFinishLoading (this=0x824ece8, finishTime=0) at /home/rakuco/dev/WebKit/Source/WebCore/loader/SubresourceLoader.cpp:300
&gt; #31 0xb2ee6cf5 in WebCore::ResourceLoader::didFinishLoading (this=0x824ece8, finishTime=0) at /home/rakuco/dev/WebKit/Source/WebCore/loader/ResourceLoader.cpp:441
&gt; #32 0xb3a19bc0 in WebCore::readCallback (asyncResult=0x8273b60, data=0x8275a78) at /home/rakuco/dev/WebKit/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:953
&gt; #33 0xb01c62e8 in async_ready_callback_wrapper (source_object=0x8261980, res=0x8273b60, user_data=user_data@entry=0x8275a78) at ginputstream.c:529
&gt; #34 0xb01dd200 in g_simple_async_result_complete (simple=simple@entry=0x8273b60) at gsimpleasyncresult.c:767
&gt; #35 0xb01dd273 in complete_in_idle_cb_for_thread (_data=_data@entry=0x81f3cd0) at gsimpleasyncresult.c:835
&gt; #36 0xb03c0af0 in g_idle_dispatch (source=source@entry=0xac561db8, callback=0xb01dd240 &lt;complete_in_idle_cb_for_thread&gt;, user_data=0x81f3cd0) at gmain.c:4657
&gt; #37 0xb03c3033 in g_main_dispatch (context=0x81c4a68) at gmain.c:2539
&gt; #38 g_main_context_dispatch (context=context@entry=0x81c4a68) at gmain.c:3075
&gt; #39 0xb09af09c in _ecore_glib_select__locked (ecore_timeout=0xbfffee08, efds=0xbfffef10, wfds=0xbfffee90, rfds=0xbfffee10, ecore_fds=10, ctx=0x81c4a68) at ecore_glib.c:171
&gt; #40 _ecore_glib_select (ecore_fds=10, rfds=0xbfffee10, wfds=0xbfffee90, efds=0xbfffef10, ecore_timeout=0xbfffee08) at ecore_glib.c:205#41 0xb09a8d9f in _ecore_main_select (timeout=0) at ecore_main.c:1370
&gt; #42 0xb09a9875 in _ecore_main_loop_iterate_internal (once_only=once_only@entry=0) at ecore_main.c:1786
&gt; #43 0xb09a9c0f in ecore_main_loop_begin () at ecore_main.c:931
&gt; #44 0x080b7bd7 in runTest (inputLine=0xbffff4cb &quot;LayoutTests/ietestcenter/Javascript/15.4.4.14-9-b-i-5.html&quot;) at /home/rakuco/dev/WebKit/Tools/DumpRenderTree/efl/DumpRenderTree.cpp:289
&gt; #45 0x080b8463 in main (argc=3, argv=0xbffff2d4) at /home/rakuco/dev/WebKit/Tools/DumpRenderTree/efl/DumpRenderTree.cpp:457</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723032</commentid>
    <comment_count>7</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-18 13:55:52 -0700</bug_when>
    <thetext>Found it.  IndexingHeaderInlineMethods was incorrectly assuming that if the HasArrayStorage bit is clear, then that means that indexing payload capacity is zero.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723033</commentid>
    <comment_count>8</comment_count>
      <attachid>164617</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-18 13:59:00 -0700</bug_when>
    <thetext>Created attachment 164617
the patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723034</commentid>
    <comment_count>9</comment_count>
      <attachid>164617</attachid>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2012-09-18 13:59:40 -0700</bug_when>
    <thetext>Comment on attachment 164617
the patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723046</commentid>
    <comment_count>10</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-18 14:18:42 -0700</bug_when>
    <thetext>Fix landed in http://trac.webkit.org/changeset/128928

Will land unskippage in separate revision.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723051</commentid>
    <comment_count>11</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-18 14:27:13 -0700</bug_when>
    <thetext>Bunch of unskippage in http://trac.webkit.org/changeset/128929</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723266</commentid>
    <comment_count>12</comment_count>
    <who name="Csaba Osztrogonác">ossy</who>
    <bug_when>2012-09-18 22:12:34 -0700</bug_when>
    <thetext>Reopen, because unfortunately these tests still crash on Qt:
http://build.webkit.sed.hu/results/x86-64%20Linux%20Qt%20Debug/r128935%20%2825217%29/results.html

and on EFL too: http://build.webkit.org/results/EFL%20Linux%2064-bit%20Debug/r128933%20%286069%29/results.html</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723284</commentid>
    <comment_count>13</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-18 22:42:38 -0700</bug_when>
    <thetext>(In reply to comment #12)
&gt; Reopen, because unfortunately these tests still crash on Qt:
&gt; http://build.webkit.sed.hu/results/x86-64%20Linux%20Qt%20Debug/r128935%20%2825217%29/results.html
&gt; 
&gt; and on EFL too: http://build.webkit.org/results/EFL%20Linux%2064-bit%20Debug/r128933%20%286069%29/results.html

That is unfortunate!  I will look.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723313</commentid>
    <comment_count>14</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2012-09-18 23:27:13 -0700</bug_when>
    <thetext>Skipping those tests again for EFL port in Bug 97074 since they crash consistently on the debug bots.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723612</commentid>
    <comment_count>15</comment_count>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2012-09-19 09:33:03 -0700</bug_when>
    <thetext>Still seeing crashes here:
http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK2%20(Tests)/r129007%20(1227)/ietestcenter/Javascript/15.4.4.14-9-b-i-6-crash-log.txt</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723933</commentid>
    <comment_count>16</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-19 16:22:29 -0700</bug_when>
    <thetext>OK.  I think I&apos;ve found the real problem.  Testing now.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723939</commentid>
    <comment_count>17</comment_count>
      <attachid>164800</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-19 16:25:53 -0700</bug_when>
    <thetext>Created attachment 164800
patch for landing

Already reviewed by Mark in person.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>723940</commentid>
    <comment_count>18</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2012-09-19 16:26:42 -0700</bug_when>
    <thetext>Landed in http://trac.webkit.org/changeset/129065</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>164617</attachid>
            <date>2012-09-18 13:59:00 -0700</date>
            <delta_ts>2012-09-18 22:35:51 -0700</delta_ts>
            <desc>the patch</desc>
            <filename>fix.patch</filename>
            <type>text/plain</type>
            <size>1862</size>
            <attacher name="Filip Pizlo">fpizlo</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTI4OTI3KQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBA
CisyMDEyLTA5LTE4ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg
UkVHUkVTU0lPTihyMTI4ODAyKTogSXQgbWFkZSBzb21lIEpTIHRlc3RzIGNyYXNoCisgICAgICAg
IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05NzAwMQorCisgICAgICAg
IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEluZGV4aW5nSGVhZGVySW5s
aW5lTWV0aG9kcyB3YXMgaW5jb3JyZWN0bHkgYXNzdW1pbmcgdGhhdCBpZiB0aGUgSGFzQXJyYXlT
dG9yYWdlIGJpdCBpcyBjbGVhciwgdGhlbiB0aGF0IG1lYW5zIHRoYXQgaW5kZXhpbmcgcGF5bG9h
ZCBjYXBhY2l0eSBpcyB6ZXJvLgorCisgICAgICAgICogcnVudGltZS9JbmRleGluZ0hlYWRlcklu
bGluZU1ldGhvZHMuaDoKKyAgICAgICAgKEpTQzo6SW5kZXhpbmdIZWFkZXI6OnByZUNhcGFjaXR5
KToKKyAgICAgICAgKEpTQzo6SW5kZXhpbmdIZWFkZXI6OmluZGV4aW5nUGF5bG9hZFNpemVJbkJ5
dGVzKToKKwogMjAxMi0wOS0xOCAgTWFyayBIYWhuZW5iZXJnICA8bWhhaG5lbmJlcmdAYXBwbGUu
Y29tPgogCiAgICAgICAgIFVzZSBXVEY6Okhhc1RyaXZpYWxEZXN0cnVjdG9yIGluc3RlYWQgb2Yg
Y29tcGlsZXItc3BlY2lmaWMgdmVyc2lvbnMgaW4gSlNDOjpOZWVkc0Rlc3RydWN0b3IKSW5kZXg6
IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0luZGV4aW5nSGVhZGVySW5saW5lTWV0aG9k
cy5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0luZGV4aW5n
SGVhZGVySW5saW5lTWV0aG9kcy5oCShyZXZpc2lvbiAxMjg5MDEpCisrKyBTb3VyY2UvSmF2YVNj
cmlwdENvcmUvcnVudGltZS9JbmRleGluZ0hlYWRlcklubGluZU1ldGhvZHMuaAkod29ya2luZyBj
b3B5KQpAQCAtMzQsNyArMzQsNyBAQCBuYW1lc3BhY2UgSlNDIHsKIAogaW5saW5lIHNpemVfdCBJ
bmRleGluZ0hlYWRlcjo6cHJlQ2FwYWNpdHkoU3RydWN0dXJlKiBzdHJ1Y3R1cmUpCiB7Ci0gICAg
aWYgKExJS0VMWSghKHN0cnVjdHVyZS0+aW5kZXhpbmdUeXBlKCkgJiBIYXNBcnJheVN0b3JhZ2Up
KSkKKyAgICBpZiAoTElLRUxZKCFoYXNBcnJheVN0b3JhZ2Uoc3RydWN0dXJlLT5pbmRleGluZ1R5
cGUoKSkpKQogICAgICAgICByZXR1cm4gMDsKICAgICAKICAgICByZXR1cm4gYXJyYXlTdG9yYWdl
KCktPm1faW5kZXhCaWFzOwpAQCAtNDIsNyArNDIsNyBAQCBpbmxpbmUgc2l6ZV90IEluZGV4aW5n
SGVhZGVyOjpwcmVDYXBhY2l0CiAKIGlubGluZSBzaXplX3QgSW5kZXhpbmdIZWFkZXI6OmluZGV4
aW5nUGF5bG9hZFNpemVJbkJ5dGVzKFN0cnVjdHVyZSogc3RydWN0dXJlKQogewotICAgIGlmIChM
SUtFTFkoIShzdHJ1Y3R1cmUtPmluZGV4aW5nVHlwZSgpICYgSGFzQXJyYXlTdG9yYWdlKSkpCisg
ICAgaWYgKExJS0VMWSghaGFzQXJyYXlTdG9yYWdlKHN0cnVjdHVyZS0+aW5kZXhpbmdUeXBlKCkp
KSkKICAgICAgICAgcmV0dXJuIDA7CiAgICAgCiAgICAgcmV0dXJuIEFycmF5U3RvcmFnZTo6c2l6
ZUZvcihhcnJheVN0b3JhZ2UoKS0+dmVjdG9yTGVuZ3RoKCkpOwo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>164800</attachid>
            <date>2012-09-19 16:25:53 -0700</date>
            <delta_ts>2012-09-19 16:25:53 -0700</delta_ts>
            <desc>patch for landing</desc>
            <filename>arraystruct.patch</filename>
            <type>text/plain</type>
            <size>1398</size>
            <attacher name="Filip Pizlo">fpizlo</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTI5MDYzKQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBA
CisyMDEyLTA5LTE5ICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg
UkVHUkVTU0lPTihyMTI4ODAyKTogSXQgbWFkZSBzb21lIEpTIHRlc3RzIGNyYXNoCisgICAgICAg
IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05NzAwMQorCisgICAgICAg
IFJldmlld2VkIGJ5IE1hcmsgSGFobmVuYmVyZy4KKworICAgICAgICAqIHJ1bnRpbWUvSlNHbG9i
YWxPYmplY3QuY3BwOgorICAgICAgICAoSlNDOjpKU0dsb2JhbE9iamVjdDo6dmlzaXRDaGlsZHJl
bik6CisKIDIwMTItMDktMTkgIEZpbGlwIFBpemxvICA8ZnBpemxvQGFwcGxlLmNvbT4KIAogICAg
ICAgICBERkcgc2hvdWxkIG5vdCBhc3N1bWUgdGhhdCBhIEJ5VmFsIGFjY2VzcyBpcyBnZW5lcmlj
IGp1c3QgYmVjYXVzZSBpdCB3YXMgdW5wcm9maWxlZApJbmRleDogU291cmNlL0phdmFTY3JpcHRD
b3JlL3J1bnRpbWUvSlNHbG9iYWxPYmplY3QuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZh
U2NyaXB0Q29yZS9ydW50aW1lL0pTR2xvYmFsT2JqZWN0LmNwcAkocmV2aXNpb24gMTI5MDQxKQor
KysgU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNHbG9iYWxPYmplY3QuY3BwCSh3b3Jr
aW5nIGNvcHkpCkBAIC00ODIsNiArNDgyLDcgQEAgdm9pZCBKU0dsb2JhbE9iamVjdDo6dmlzaXRD
aGlsZHJlbihKU0NlbAogICAgIHZpc2l0b3IuYXBwZW5kKCZ0aGlzT2JqZWN0LT5tX25hbWVTY29w
ZVN0cnVjdHVyZSk7CiAgICAgdmlzaXRvci5hcHBlbmQoJnRoaXNPYmplY3QtPm1fYXJndW1lbnRz
U3RydWN0dXJlKTsKICAgICB2aXNpdG9yLmFwcGVuZCgmdGhpc09iamVjdC0+bV9hcnJheVN0cnVj
dHVyZSk7CisgICAgdmlzaXRvci5hcHBlbmQoJnRoaXNPYmplY3QtPm1fYXJyYXlTdHJ1Y3R1cmVG
b3JTbG93UHV0KTsKICAgICB2aXNpdG9yLmFwcGVuZCgmdGhpc09iamVjdC0+bV9ib29sZWFuT2Jq
ZWN0U3RydWN0dXJlKTsKICAgICB2aXNpdG9yLmFwcGVuZCgmdGhpc09iamVjdC0+bV9jYWxsYmFj
a0NvbnN0cnVjdG9yU3RydWN0dXJlKTsKICAgICB2aXNpdG9yLmFwcGVuZCgmdGhpc09iamVjdC0+
bV9jYWxsYmFja0Z1bmN0aW9uU3RydWN0dXJlKTsK
</data>

          </attachment>
      

    </bug>

</bugzilla>