98175 2012-10-02 10:49:12 -0700 REGRESSION(r128400): ASSERT (crash in release) @ app.asana.com 2012-10-02 16:28:05 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 eric fpizlo barraclough fpizlo ggaren oliver sam oldest_to_newest 732811 0 eric 2012-10-02 10:49:12 -0700 Reproduces every time, when clicking between projects in my task list. I'm currently using r130184. ASSERTION FAILED: value /Users/eseidel/Projects/WebKit/Source/JavaScriptCore/runtime/PropertySlot.h(110) : void JSC::PropertySlot::setValue(JSC::JSValue, JSC::JSValue, PropertyOffset) 1 0x1022d4057 JSC::PropertySlot::setValue(JSC::JSValue, JSC::JSValue, int) 2 0x1022d3e2d JSC::JSObject::inlineGetOwnPropertySlot(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) 3 0x1022d5225 JSC::JSCell::fastGetOwnPropertySlot(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) 4 0x1022d5020 JSC::JSObject::getPropertySlot(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) 5 0x1025224c5 JSC::JSObject::hasProperty(JSC::ExecState*, JSC::PropertyName) const 6 0x1024cb7de cti_has_property 7 0x1024cdf70 jscGeneratedNativeCode 8 0x102494564 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) 9 0x10249273c JSC::Interpreter::execute(JSC::CallFrameClosure&) 10 0x1022e0983 JSC::CachedCall::call() 11 0x1022dc696 JSC::arrayProtoFuncForEach(JSC::ExecState*) 12 0x3e09b4601265 13 0x102494564 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) 14 0x10249273c JSC::Interpreter::execute(JSC::CallFrameClosure&) 15 0x1022e0983 JSC::CachedCall::call() 16 0x1022dc696 JSC::arrayProtoFuncForEach(JSC::ExecState*) 17 0x3e09b4601265 18 0x102494564 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) 19 0x10249273c JSC::Interpreter::execute(JSC::CallFrameClosure&) 20 0x1022e0983 JSC::CachedCall::call() 21 0x1022dc696 JSC::arrayProtoFuncForEach(JSC::ExecState*) 22 0x3e09b4601265 23 0x102494564 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) 24 0x10249273c JSC::Interpreter::execute(JSC::CallFrameClosure&) 25 0x1022e0983 JSC::CachedCall::call() 26 0x1022dc696 JSC::arrayProtoFuncForEach(JSC::ExecState*) 27 0x3e09b4601265 28 0x102494564 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) 29 0x1024912f2 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 30 0x10233ca22 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 31 0x103bd1462 WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) LEAK: 2 WebPageProxy LEAK: 2 WebContext 732814 1 eric 2012-10-02 10:51:04 -0700 I've sent you all asana invites in case those are still needed. 732820 2 ggaren 2012-10-02 10:55:13 -0700 I can reproduce this with r130184. 732836 3 ggaren 2012-10-02 11:10:44 -0700 Regressed in <http://trac.webkit.org/changeset/128400> (property butterflies). 732837 4 ggaren 2012-10-02 11:11:06 -0700 <rdar://problem/12414251> 732855 5 eric 2012-10-02 11:21:48 -0700 Thanks Geoff. 733183 6 166771 fpizlo 2012-10-02 16:16:24 -0700 Created attachment 166771 the patch 733187 7 fpizlo 2012-10-02 16:19:22 -0700 Structure::nonPropertyTransition was forgetting to set m_offset. In other regards, what it's doing is right - it doesn't need to pin the property table since the property table is rematerializable; but in case someone steals our property table then a bunch of methods (including GC methods) need to be able to use the m_offset to get the property size. Since they had a bogus m_offset, properties weren't being copied by GC, and hence the crash. 733197 8 fpizlo 2012-10-02 16:28:05 -0700 Landed in http://trac.webkit.org/changeset/130228 166771 2012-10-02 16:16:24 -0700 2012-10-02 16:20:40 -0700 the patch asana.patch text/plain 1517 fpizlo SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTMwMjI1KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE3IEBA CisyMDEyLTEwLTAyICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg UkVHUkVTU0lPTihyMTI4NDAwKTogQVNTRVJUIChjcmFzaCBpbiByZWxlYXNlKSBAIGFwcC5hc2Fu YS5jb20KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTk4 MTc1CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgSXQn cyBiYWQga2FybWEgdG8gY3JlYXRlIGEgbmV3IHN0cnVjdHVyZSB3aGlsZSBzdGVhbGluZyBhbm90 aGVyIHN0cnVjdHVyZSdzIHByb3BlcnR5IHRhYmxlCisgICAgICAgIHdoaWxlIGxlYXZpbmcgdGhl IG1fb2Zmc2V0IHVuc2V0LiBFdmVudHVhbGx5IHNvbWVvbmUgd2lsbCB0aGVuIHN0ZWFsIHlvdXIg cHJvcGVydHkgdGFibGUsIGFuZAorICAgICAgICB0aGVuIHlvdSB3b24ndCBrbm93IGhvdyBtYW55 IHByb3BlcnRpZXMgeW91IGhhdmUgYW55bW9yZS4KKworICAgICAgICAqIHJ1bnRpbWUvU3RydWN0 dXJlLmNwcDoKKyAgICAgICAgKEpTQzo6U3RydWN0dXJlOjpub25Qcm9wZXJ0eVRyYW5zaXRpb24p OgorCiAyMDEyLTEwLTAyICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgogCiAg ICAgICAgIENvbW1lbnQgYWRkaXRpb25zIGFmdGVyIHIxMzAxMDkgCkluZGV4OiBTb3VyY2UvSmF2 YVNjcmlwdENvcmUvcnVudGltZS9TdHJ1Y3R1cmUuY3BwCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9K YXZhU2NyaXB0Q29yZS9ydW50aW1lL1N0cnVjdHVyZS5jcHAJKHJldmlzaW9uIDEzMDIwMikKKysr IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL1N0cnVjdHVyZS5jcHAJKHdvcmtpbmcgY29w eSkKQEAgLTU0Niw2ICs1NDYsNyBAQCBTdHJ1Y3R1cmUqIFN0cnVjdHVyZTo6bm9uUHJvcGVydHlU cmFuc2l0CiAgICAgdHJhbnNpdGlvbi0+bV9wcmV2aW91cy5zZXQoZ2xvYmFsRGF0YSwgdHJhbnNp dGlvbiwgc3RydWN0dXJlKTsKICAgICB0cmFuc2l0aW9uLT5tX2F0dHJpYnV0ZXNJblByZXZpb3Vz ID0gYXR0cmlidXRlczsKICAgICB0cmFuc2l0aW9uLT5tX2luZGV4aW5nVHlwZSA9IGluZGV4aW5n VHlwZTsKKyAgICB0cmFuc2l0aW9uLT5tX29mZnNldCA9IHN0cnVjdHVyZS0+bV9vZmZzZXQ7CiAg ICAgCiAgICAgaWYgKHN0cnVjdHVyZS0+bV9wcm9wZXJ0eVRhYmxlKSB7CiAgICAgICAgIGlmIChz dHJ1Y3R1cmUtPm1faXNQaW5uZWRQcm9wZXJ0eVRhYmxlKQo=