Bug 120509 – crashed while sending fb msg

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

Process:         WebProcess [1062]
Path:            /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess
Identifier:      com.apple.WebProcess
Version:         538+ (538.1+)
Code Type:       X86-64 (Native)
Parent Process:  ??? [1]
User ID:         501

Date/Time:       2013-08-30 00:54:21.992 -0400
OS Version:      Mac OS X 10.8.4 (12E3067)
Report Version:  10
Sleep/Wake UUID: 09CB4380-257A-49F9-9579-228F1E9C5F35

Interval Since Last Report:          492693 sec
Crashes Since Last Report:           5
Per-App Interval Since Last Report:  174023 sec
Per-App Crashes Since Last Report:   5
Anonymous UUID:                      DCE721A9-E6D2-843E-8602-282ED14B7DF9

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0xfffffffffffffff8

VM Regions Near 0xfffffffffffffff8:
--> shared memory          00007ffffff89000-00007ffffff8a000 [    4K] r-x/r-x SM=SHM  
    

Application Specific Information:
Bundle controller class:
BrowserBundleController
 

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x000000010780cd0a JSC::VM::throwException(JSC::ExecState*, JSC::JSValue) + 1370
1   com.apple.JavaScriptCore      	0x000000010780d499 JSC::VM::throwException(JSC::ExecState*, JSC::JSObject*) + 9
2   com.apple.JavaScriptCore      	0x00000001076e1814 JSC::JSValue::toObjectSlowCase(JSC::ExecState*, JSC::JSGlobalObject*) const + 132
3   com.apple.JavaScriptCore      	0x0000000107726eb3 JSValueToObject + 195
4   com.apple.Safari.framework    	0x00007fff89e8eb73 Safari::controlObject(Safari::WK::BundleFrame const&, Safari::WK::Double const&, Safari::WK::String const&) + 230
5   com.apple.Safari.framework    	0x00007fff89e8e7bc Safari::FrameMetadata::computeMetadata() + 538
6   com.apple.Safari.framework    	0x00007fff89e8ebc1 Safari::FrameMetadata::metadataForAllForms() + 21
7   com.apple.Safari.framework    	0x00007fff89e8f71f Safari::FormMetadataController::frameMetadata(Safari::WK::BundleFrame const&) + 95
8   com.apple.Safari.framework    	0x00007fff89e8f90d Safari::FormMetadataController::metadataForForm(Safari::WK::BundleFrame const&, Safari::WK::BundleNodeHandle const&) + 109
9   com.apple.Safari.framework    	0x00007fff89d61272 Safari::BrowserBundlePageFormClient::willSendSubmitEvent(Safari::WK::BundlePage const&, Safari::WK::BundleNodeHandle const&, Safari::WK::BundleFrame const&, Safari::WK::BundleFrame const&, Safari::WK::Dictionary const&) + 102
10  com.apple.Safari.framework    	0x00007fff89ddfd0a Safari::WK::willSendSubmitEvent(OpaqueWKBundlePage const*, OpaqueWKBundleNodeHandle const*, OpaqueWKBundleFrame const*, OpaqueWKBundleFrame const*, OpaqueWKDictionary const*, void const*) + 151
11  com.apple.WebKit2             	0x0000000107116d2f WebKit::InjectedBundlePageFormClient::willSendSubmitEvent(WebKit::WebPage*, WebCore::HTMLFormElement*, WebKit::WebFrame*, WebKit::WebFrame*, WTF::Vector<std::__1::pair<WTF::String, WTF::String>, 0ul, WTF::CrashOnOverflow> const&) + 277
12  com.apple.WebKit2             	0x00000001071b693b WebKit::WebFrameLoaderClient::dispatchWillSendSubmitEvent(WTF::PassRefPtr<WebCore::FormState>) + 123
13  com.apple.WebCore             	0x0000000107dde7a6 WebCore::HTMLFormElement::prepareForSubmission(WebCore::Event*) + 294
14  com.apple.WebCore             	0x00000001084e465a WebCore::SubmitInputType::handleDOMActivateEvent(WebCore::Event*) + 74
15  com.apple.WebCore             	0x0000000107de9b1b WebCore::HTMLInputElement::defaultEventHandler(WebCore::Event*) + 619
16  com.apple.WebCore             	0x0000000107ccfe69 WebCore::EventDispatcher::dispatchEventPostProcess(void*) + 313
17  com.apple.WebCore             	0x0000000107ccfbac WebCore::EventDispatcher::dispatch() + 764
18  com.apple.WebCore             	0x0000000107cd028c WebCore::EventDispatchMediator::dispatchEvent(WebCore::EventDispatcher*) const + 12
19  com.apple.WebCore             	0x0000000107ccefac WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::EventDispatchMediator>) + 124
20  com.apple.WebCore             	0x000000010843126f WebCore::ScopedEventQueue::enqueueEventDispatchMediator(WTF::PassRefPtr<WebCore::EventDispatchMediator>) + 175
21  com.apple.WebCore             	0x0000000107ccf177 WebCore::EventDispatcher::dispatchScopedEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::EventDispatchMediator>) + 247
22  com.apple.WebCore             	0x0000000108252443 WebCore::Node::dispatchScopedEvent(WTF::PassRefPtr<WebCore::Event>) + 67
23  com.apple.WebCore             	0x000000010825290e WebCore::Node::dispatchDOMActivateEvent(int, WTF::PassRefPtr<WebCore::Event>) + 302
24  com.apple.WebCore             	0x00000001082530e4 WebCore::Node::defaultEventHandler(WebCore::Event*) + 404
25  com.apple.WebCore             	0x0000000107de9dbe WebCore::HTMLInputElement::defaultEventHandler(WebCore::Event*) + 1294
26  com.apple.WebCore             	0x0000000107ccfe69 WebCore::EventDispatcher::dispatchEventPostProcess(void*) + 313
27  com.apple.WebCore             	0x0000000107ccfbac WebCore::EventDispatcher::dispatch() + 764
28  com.apple.WebCore             	0x0000000107ccf7d7 WebCore::EventDispatcher::dispatchSimulatedClick(WebCore::Element*, WebCore::Event*, WebCore::SimulatedClickMouseEventOptions, WebCore::SimulatedClickVisualOptions) + 1575
29  com.apple.WebCore             	0x000000010802d091 WebCore::jsHTMLElementPrototypeFunctionClick(JSC::ExecState*) + 97
30  ???                           	0x0000285e96601045 0 + 44386714914885
31  com.apple.JavaScriptCore      	0x00000001076a3371 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*) + 49
32  com.apple.JavaScriptCore      	0x0000000107689cbd JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 573
33  com.apple.JavaScriptCore      	0x000000010755ea25 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 69
34  com.apple.JavaScriptCore      	0x00000001076d98ae JSC::boundFunctionCall(JSC::ExecState*) + 526
35  ???                           	0x0000285e96601045 0 + 44386714914885
36  com.apple.JavaScriptCore      	0x00000001076a3371 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::VM*) + 49
37  com.apple.JavaScriptCore      	0x0000000107689cbd JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 573
38  com.apple.JavaScriptCore      	0x000000010755ea25 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 69
39  com.apple.WebCore             	0x000000010800153c WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 908
40  com.apple.WebCore             	0x0000000107ce77cc WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul, WTF::CrashOnOverflow>&) + 364
41  com.apple.WebCore             	0x0000000107ce7475 WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 469
42  com.apple.WebCore             	0x00000001082523f3 WebCore::Node::handleLocalEvents(WebCore::Event*) + 67
43  com.apple.WebCore             	0x0000000107cced97 WebCore::EventContext::handleLocalEvents(WebCore::Event*) const + 87
44  com.apple.WebCore             	0x0000000107ccfcb8 WebCore::EventDispatcher::dispatchEventAtBubbling(WebCore::WindowEventContext&) + 56
45  com.apple.WebCore             	0x0000000107ccfba1 WebCore::EventDispatcher::dispatch() + 753
46  com.apple.WebCore             	0x0000000107cd028c WebCore::EventDispatchMediator::dispatchEvent(WebCore::EventDispatcher*) const + 12
47  com.apple.WebCore             	0x0000000107ccefac WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::EventDispatchMediator>) + 124
48  com.apple.WebCore             	0x00000001082525fa WebCore::Node::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) + 234
49  com.apple.WebCore             	0x0000000107ce71f0 WebCore::EventTarget::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&) + 112
50  com.apple.WebCore             	0x0000000107cdb4d9 WebCore::EventHandler::keyEvent(WebCore::PlatformKeyboardEvent const&) + 1097
51  com.apple.WebKit2             	0x00000001071d7869 WebKit::handleKeyEvent(WebKit::WebKeyboardEvent const&, WebCore::Page*) + 244
52  com.apple.WebKit2             	0x00000001071d772e WebKit::WebPage::keyEvent(WebKit::WebKeyboardEvent const&) + 42
53  com.apple.WebKit2             	0x00000001071ea2d7 void CoreIPC::handleMessage<Messages::WebPage::KeyEvent, WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebKeyboardEvent const&)>(CoreIPC::MessageDecoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(WebKit::WebKeyboardEvent const&)) + 107
54  com.apple.WebKit2             	0x000000010711f9b3 CoreIPC::MessageReceiverMap::dispatchMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&) + 137
55  com.apple.WebKit2             	0x00000001072255ce WebKit::WebProcess::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&) + 34
56  com.apple.WebKit2             	0x00000001070f5005 CoreIPC::Connection::dispatchMessage(WTF::PassOwnPtr<CoreIPC::MessageDecoder>) + 105
57  com.apple.WebKit2             	0x00000001070f6b6e CoreIPC::Connection::dispatchOneMessage() + 106
58  com.apple.WebCore             	0x000000010842aa11 WebCore::RunLoop::performWork() + 129
59  com.apple.WebCore             	0x000000010842afd2 WebCore::RunLoop::performWork(void*) + 34
60  com.apple.CoreFoundation      	0x00007fff8fab4b31 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
61  com.apple.CoreFoundation      	0x00007fff8fab4455 __CFRunLoopDoSources0 + 245
62  com.apple.CoreFoundation      	0x00007fff8fad77f5 __CFRunLoopRun + 789
63  com.apple.CoreFoundation      	0x00007fff8fad70e2 CFRunLoopRunSpecific + 290
64  com.apple.HIToolbox           	0x00007fff88a82eb4 RunCurrentEventLoopInMode + 209
65  com.apple.HIToolbox           	0x00007fff88a82c52 ReceiveNextEventCommon + 356
66  com.apple.HIToolbox           	0x00007fff88a82ae3 BlockUntilNextEventMatchingListInMode + 62
67  com.apple.AppKit              	0x00007fff8b9e0533 _DPSNextEvent + 685
68  com.apple.AppKit              	0x00007fff8b9dfdf2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
69  com.apple.AppKit              	0x00007fff8b9d71a3 -[NSApplication run] + 517
70  com.apple.WebCore             	0x000000010842b652 WebCore::RunLoop::run() + 82
71  com.apple.WebKit2             	0x000000010719529a int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebContentProcessMainDelegate>(int, char**) + 422
72  com.apple.WebProcess          	0x00000001070ade23 main + 337
73  libdyld.dylib                 	0x00007fff8de727e1 start + 1

Thread 1:: Dispatch queue: com.apple.libdispatch-manager
0   libsystem_kernel.dylib        	0x00007fff86202d16 kevent + 10
1   libdispatch.dylib             	0x00007fff8d773dea _dispatch_mgr_invoke + 883
2   libdispatch.dylib             	0x00007fff8d7739ee _dispatch_mgr_thread + 54

Thread 2:
0   libsystem_kernel.dylib        	0x00007fff862026d6 __workq_kernreturn + 10
1   libsystem_c.dylib             	0x00007fff8aafaafc _pthread_workq_return + 25
2   libsystem_c.dylib             	0x00007fff8aafa8c3 _pthread_wqthread + 412
3   libsystem_c.dylib             	0x00007fff8aae4d71 start_wqthread + 13

Thread 3:: JavaScriptCore::BlockFree
0   libsystem_kernel.dylib        	0x00007fff862020fa __psynch_cvwait + 10
1   libsystem_c.dylib             	0x00007fff8aafcb99 _pthread_cond_wait + 869
2   com.apple.JavaScriptCore      	0x0000000107865636 WTF::ThreadCondition::timedWait(WTF::Mutex&, double) + 118
3   com.apple.JavaScriptCore      	0x0000000107544d5b JSC::BlockAllocator::blockFreeingThreadMain() + 123
4   com.apple.JavaScriptCore      	0x000000010786494f WTF::wtfThreadEntryPoint(void*) + 15
5   libsystem_c.dylib             	0x00007fff8aaf8352 _pthread_start + 327
6   libsystem_c.dylib             	0x00007fff8aae4d81 thread_start + 13

Thread 4:: JavaScriptCore::Marking
0   libsystem_kernel.dylib        	0x00007fff862020fa __psynch_cvwait + 10
1   libsystem_c.dylib             	0x00007fff8aafcb99 _pthread_cond_wait + 869
2   com.apple.JavaScriptCore      	0x000000010767be5b JSC::GCThread::waitForNextPhase() + 123
3   com.apple.JavaScriptCore      	0x000000010767bf1f JSC::GCThread::gcThreadMain() + 143
4   com.apple.JavaScriptCore      	0x000000010786494f WTF::wtfThreadEntryPoint(void*) + 15
5   libsystem_c.dylib             	0x00007fff8aaf8352 _pthread_start + 327
6   libsystem_c.dylib             	0x00007fff8aae4d81 thread_start + 13

Thread 5:: JavaScriptCore::Marking
0   libsystem_kernel.dylib        	0x00007fff862020fa __psynch_cvwait + 10
1   libsystem_c.dylib             	0x00007fff8aafcb99 _pthread_cond_wait + 869
2   com.apple.JavaScriptCore      	0x000000010767be5b JSC::GCThread::waitForNextPhase() + 123
3   com.apple.JavaScriptCore      	0x000000010767bf1f JSC::GCThread::gcThreadMain() + 143
4   com.apple.JavaScriptCore      	0x000000010786494f WTF::wtfThreadEntryPoint(void*) + 15
5   libsystem_c.dylib             	0x00007fff8aaf8352 _pthread_start + 327
6   libsystem_c.dylib             	0x00007fff8aae4d81 thread_start + 13

Thread 6:: JavaScriptCore::Marking
0   libsystem_kernel.dylib        	0x00007fff862020fa __psynch_cvwait + 10
1   libsystem_c.dylib             	0x00007fff8aafcb99 _pthread_cond_wait + 869
2   com.apple.JavaScriptCore      	0x000000010767be5b JSC::GCThread::waitForNextPhase() + 123
3   com.apple.JavaScriptCore      	0x000000010767bf1f JSC::GCThread::gcThreadMain() + 143
4   com.apple.JavaScriptCore      	0x000000010786494f WTF::wtfThreadEntryPoint(void*) + 15
5   libsystem_c.dylib             	0x00007fff8aaf8352 _pthread_start + 327
6   libsystem_c.dylib             	0x00007fff8aae4d81 thread_start + 13

Thread 7:: WebCore: Scrolling
0   libsystem_kernel.dylib        	0x00007fff86200686 mach_msg_trap + 10
1   libsystem_kernel.dylib        	0x00007fff861ffc42 mach_msg + 70
2   com.apple.CoreFoundation      	0x00007fff8fad2233 __CFRunLoopServiceMachPort + 195
3   com.apple.CoreFoundation      	0x00007fff8fad7916 __CFRunLoopRun + 1078
4   com.apple.CoreFoundation      	0x00007fff8fad70e2 CFRunLoopRunSpecific + 290
5   com.apple.CoreFoundation      	0x00007fff8fae5dd1 CFRunLoopRun + 97
6   com.apple.WebCore             	0x000000010845643e WebCore::ScrollingThread::initializeRunLoop() + 254
7   com.apple.JavaScriptCore      	0x000000010786494f WTF::wtfThreadEntryPoint(void*) + 15
8   libsystem_c.dylib             	0x00007fff8aaf8352 _pthread_start + 327
9   libsystem_c.dylib             	0x00007fff8aae4d81 thread_start + 13

Thread 8:: com.apple.NSURLConnectionLoader
0   libsystem_kernel.dylib        	0x00007fff86200686 mach_msg_trap + 10
1   libsystem_kernel.dylib        	0x00007fff861ffc42 mach_msg + 70
2   com.apple.CoreFoundation      	0x00007fff8fad2233 __CFRunLoopServiceMachPort + 195
3   com.apple.CoreFoundation      	0x00007fff8fad7916 __CFRunLoopRun + 1078
4   com.apple.CoreFoundation      	0x00007fff8fad70e2 CFRunLoopRunSpecific + 290
5   com.apple.Foundation          	0x00007fff880de546 +[NSURLConnection(Loader) _resourceLoadLoop:] + 356
6   com.apple.Foundation          	0x00007fff8813c562 __NSThread__main__ + 1345
7   libsystem_c.dylib             	0x00007fff8aaf8352 _pthread_start + 327
8   libsystem_c.dylib             	0x00007fff8aae4d81 thread_start + 13

Thread 9:: com.apple.CFSocket.private
0   libsystem_kernel.dylib        	0x00007fff86202322 __select + 10
1   com.apple.CoreFoundation      	0x00007fff8fb16f46 __CFSocketManager + 1302
2   libsystem_c.dylib             	0x00007fff8aaf8352 _pthread_start + 327
3   libsystem_c.dylib             	0x00007fff8aae4d81 thread_start + 13

Thread 10:: JSC Compilation Thread
0   libsystem_kernel.dylib        	0x00007fff862020fa __psynch_cvwait + 10
1   libsystem_c.dylib             	0x00007fff8aafcb99 _pthread_cond_wait + 869
2   com.apple.JavaScriptCore      	0x000000010766fc6b JSC::DFG::Worklist::runThread() + 731
3   com.apple.JavaScriptCore      	0x000000010786494f WTF::wtfThreadEntryPoint(void*) + 15
4   libsystem_c.dylib             	0x00007fff8aaf8352 _pthread_start + 327
5   libsystem_c.dylib             	0x00007fff8aae4d81 thread_start + 13

Thread 11:: QTKit: listenOnDelegatePort
0   libsystem_kernel.dylib        	0x00007fff86200686 mach_msg_trap + 10
1   libsystem_kernel.dylib        	0x00007fff861ffc42 mach_msg + 70
2   com.apple.CoreFoundation      	0x00007fff8fad2233 __CFRunLoopServiceMachPort + 195
3   com.apple.CoreFoundation      	0x00007fff8fad7916 __CFRunLoopRun + 1078
4   com.apple.CoreFoundation      	0x00007fff8fad70e2 CFRunLoopRunSpecific + 290
5   com.apple.CoreFoundation      	0x00007fff8fae5dd1 CFRunLoopRun + 97
6   com.apple.QTKit               	0x00007fff8d6112d6 listenOnDelegatePort + 403
7   libsystem_c.dylib             	0x00007fff8aaf8352 _pthread_start + 327
8   libsystem_c.dylib             	0x00007fff8aae4d81 thread_start + 13

Thread 12:: QTKit: listenOnNotificationPort
0   libsystem_kernel.dylib        	0x00007fff86200686 mach_msg_trap + 10
1   libsystem_kernel.dylib        	0x00007fff861ffc42 mach_msg + 70
2   com.apple.CoreFoundation      	0x00007fff8fad2233 __CFRunLoopServiceMachPort + 195
3   com.apple.CoreFoundation      	0x00007fff8fad7916 __CFRunLoopRun + 1078
4   com.apple.CoreFoundation      	0x00007fff8fad70e2 CFRunLoopRunSpecific + 290
5   com.apple.CoreFoundation      	0x00007fff8fae5dd1 CFRunLoopRun + 97
6   com.apple.QTKit               	0x00007fff8d611771 listenOnNotificationPort + 371
7   libsystem_c.dylib             	0x00007fff8aaf8352 _pthread_start + 327
8   libsystem_c.dylib             	0x00007fff8aae4d81 thread_start + 13

Thread 13:
0   libsystem_kernel.dylib        	0x00007fff862026d6 __workq_kernreturn + 10
1   libsystem_c.dylib             	0x00007fff8aafaafc _pthread_workq_return + 25
2   libsystem_c.dylib             	0x00007fff8aafa8c3 _pthread_wqthread + 412
3   libsystem_c.dylib             	0x00007fff8aae4d71 start_wqthread + 13

Thread 14:
0   libsystem_kernel.dylib        	0x00007fff862026d6 __workq_kernreturn + 10
1   libsystem_c.dylib             	0x00007fff8aafaafc _pthread_workq_return + 25
2   libsystem_c.dylib             	0x00007fff8aafa8c3 _pthread_wqthread + 412
3   libsystem_c.dylib             	0x00007fff8aae4d71 start_wqthread + 13

Thread 0 crashed with X86 Thread State (64-bit):
  rax: 0x00007fff58b4f4e8  rbx: 0x000000010cde1670  rcx: 0x000000010e975c70  rdx: 0x00007fff58b4f420
  rdi: 0x0000000110157a80  rsi: 0x00000000000000e1  rbp: 0x00007fff58b4f650  rsp: 0x00007fff58b4f470
   r8: 0xffff000000000002   r9: 0x000000010e975c70  r10: 0x00000001171a93c0  r11: 0x0000000000000003
  r12: 0x0000000000000000  r13: 0x0000000000000000  r14: 0x000000010cb5d580  r15: 0x000000010cde1670
  rip: 0x000000010780cd0a  rfl: 0x0000000000010213  cr2: 0xfffffffffffffff8
Logical CPU: 2

[Alexey Proskuryakov]

Reverse duping to a bug with a proposed fix.

*** This bug has been marked as a duplicate of bug 120612 ***