Bug 109838

Summary: A crash in llint_slow_path_resolve_base on news.cnet.com and other sites
Product: WebKit Reporter: Sanford Selznick <sanford-webkit-bugzilla>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: adrongardner, ap, ggaren, kevin, oliver
Priority: P1 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Mac (Intel)   
OS: OS X 10.8   
URL: http://news.cnet.com/8301-1023_3-57569342-93/javascript-expert-webkit-get-your-bug-ridden-house-in-order/
Attachments:
Description Flags
Crash report
none
Crash Report r143103 after a period of use. none

Sanford Selznick
Reported 2013-02-14 09:01:46 PST
Created attachment 188366 [details] Crash report The irony of the link is unintentional. Crash report attached. Please let me know if I can be of further assistance. 10.8.2. WebKit r142854.
Attachments
Crash report (51.97 KB, text/plain)
2013-02-14 09:01 PST, Sanford Selznick 		no flags
Details
Crash Report r143103 after a period of use. (68.48 KB, text/rtf)
2013-02-16 18:12 PST, Jim Oase 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2013-02-14 14:22:36 PST
ASSERTION FAILED: !globalData.exception /Users/ap/Safari/OpenSource/Source/JavaScriptCore/interpreter/Interpreter.cpp(837) : JSC::JSValue JSC::Interpreter::execute(JSC::ProgramExecutable *, CallFrame *, JSC::JSObject *) 1 0x107dbd7e7 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) 2 0x107c35477 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) 3 0x109a62082 WebCore::JSMainThreadExecState::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) 4 0x10a2e3503 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*)
Alexey Proskuryakov
Comment 2 2013-02-14 14:22:57 PST
<rdar://problem/13219405>
Sanford Selznick
Comment 3 2013-02-14 21:04:58 PST
Another URL that causes the same crash report: http://azstarnet.com, but a little later in the load.
Alexey Proskuryakov
Comment 4 2013-02-15 10:55:31 PST
*** Bug 109936 has been marked as a duplicate of this bug. ***
Sanford Selznick
Comment 5 2013-02-16 08:59:55 PST
One more URL that crashes the same way: http://finance.yahoo.com/currency-converter/#from=USD;to=EUR;amt=1 Hope this helps.
Alexey Proskuryakov
Comment 6 2013-02-16 10:20:12 PST
Geoff, is bug 110017 expected to fix this? Oliver suspected another change.
Geoffrey Garen
Comment 7 2013-02-16 14:19:44 PST
(In reply to comment #6) > Geoff, is bug 110017 expected to fix this? Oliver suspected another change. The release symptom of bug 110017 is attachment 188366 [details]. I didn't test the debug symptom, but an ASSERT about an exception is consistent with the patch I rolled out.
Geoffrey Garen
Comment 8 2013-02-16 14:26:52 PST
*** This bug has been marked as a duplicate of bug 110017 ***
Jim Oase
Comment 9 2013-02-16 18:12:17 PST
Created attachment 188749 [details] Crash Report r143103 after a period of use.
Kevin M. Dean
Comment 10 2013-02-16 21:11:50 PST
(In reply to comment #9) > Created an attachment (id=188749) [details] > Crash Report r143103 after a period of use. The rollout was in 143104, so you'll need to try a later build.
Sanford Selznick
Comment 11 2013-02-16 21:17:21 PST
This appears to be fixed for me now. Thank you!
adrongardner
Comment 12 2013-02-16 21:23:47 PST
r143119 is stable on this for me also. Excellent work!
Alexey Proskuryakov
Comment 13 2013-03-08 16:53:08 PST
*** Bug 109852 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.