Bug 127547

Summary: Crash in JSC::UnwindFunctor::operator()(JSC::StackVisitor&)
Product: WebKit Reporter: Dimitris Apostolou <dimitris.apostolou>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Normal CC: mwang
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Mac (Intel)   
OS: OS X 10.9   
URL: http://ultrarunnerpodcast.com/oz-pearlman-interview/
Attachments:
Description Flags
Crash log none

Description Dimitris Apostolou 2014-01-23 23:04:07 PST 
Created attachment 222081 [details]
Crash log

r162657

Reproducibility: always

Steps:
http://ultrarunnerpodcast.com/oz-pearlman-interview/

What happened:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x000000010e2140f9 JSC::UnwindFunctor::operator()(JSC::StackVisitor&) + 265
1   com.apple.JavaScriptCore      	0x000000010e211dcb JSC::Interpreter::unwind(JSC::ExecState*&, JSC::JSValue&) + 523
2   com.apple.JavaScriptCore      	0x000000010e238efd JSC::genericUnwind(JSC::VM*, JSC::ExecState*, JSC::JSValue) + 45
3   com.apple.JavaScriptCore      	0x000000010e31f0d5 llint_slow_path_handle_exception + 53
4   com.apple.JavaScriptCore      	0x000000010e323716 llint_throw_from_slow_path_trampoline + 15
5   com.apple.JavaScriptCore      	0x000000010e320c0d callToJavaScript + 194
6   com.apple.JavaScriptCore      	0x000000010e237aa0 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*, JSC::Register*) + 48
7   com.apple.JavaScriptCore      	0x000000010e2132b8 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 680
8   com.apple.JavaScriptCore      	0x000000010e0c135e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62
9   com.apple.JavaScriptCore      	0x000000010e28c991 JSC::boundFunctionCall(JSC::ExecState*) + 577
10  com.apple.JavaScriptCore      	0x000000010e320cfa callToNativeFunction + 200
11  ???                           	0x000000011070ffd0 0 + 4570808272
12  com.apple.JavaScriptCore      	0x000000010e213302 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 754
13  com.apple.JavaScriptCore      	0x000000010e0c135e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62
14  com.apple.WebCore             	0x000000010ed0a437 WebCore::JSMutationCallback::call(WTF::Vector<WTF::RefPtr<WebCore::MutationRecord>, 0ul, WTF::CrashOnOverflow> const&, WebCore::MutationObserver*) + 567
15  com.apple.WebCore             	0x000000010eef5276 WebCore::MutationObserver::deliver() + 406
16  com.apple.WebCore             	0x000000010eef56f7 WebCore::MutationObserver::deliverAllMutations() + 951
17  com.apple.WebCore             	0x000000010ec489e7 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 919
18  com.apple.WebCore             	0x000000010e90046e WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul, WTF::CrashOnOverflow>&) + 750
19  com.apple.WebCore             	0x000000010e900015 WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 181
20  com.apple.WebCore             	0x000000010e8eae27 WebCore::EventContext::handleLocalEvents(WebCore::Event&) const + 87
21  com.apple.WebCore             	0x000000010e8eba8a WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::Event>) + 954
22  com.apple.WebCore             	0x000000010ef05ead WebCore::Node::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) + 29
23  com.apple.WebCore             	0x000000010e82a23b WebCore::Document::finishedParsing() + 123
24  com.apple.WebCore             	0x000000010e9f76f6 WebCore::HTMLDocumentParser::prepareToStopParsing() + 166
25  com.apple.WebCore             	0x000000010e9f7b31 WebCore::HTMLDocumentParser::resumeParsingAfterYield() + 129
26  com.apple.WebCore             	0x000000010f27fa8f WebCore::ThreadTimers::sharedTimerFiredInternal() + 175
27  com.apple.WebCore             	0x000000010f134ada WebCore::timerFired(__CFRunLoopTimer*, void*) + 58
28  com.apple.CoreFoundation      	0x00007fff8b8f4564 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
29  com.apple.CoreFoundation      	0x00007fff8b8f409f __CFRunLoopDoTimer + 1151
30  com.apple.CoreFoundation      	0x00007fff8b9655aa __CFRunLoopDoTimers + 298
31  com.apple.CoreFoundation      	0x00007fff8b8af8e5 __CFRunLoopRun + 1525
32  com.apple.CoreFoundation      	0x00007fff8b8af0b5 CFRunLoopRunSpecific + 309
33  com.apple.HIToolbox           	0x00007fff921caa0d RunCurrentEventLoopInMode + 226
34  com.apple.HIToolbox           	0x00007fff921ca7b7 ReceiveNextEventCommon + 479
35  com.apple.HIToolbox           	0x00007fff921ca5bc _BlockUntilNextEventMatchingListInModeWithFilter + 65
36  com.apple.AppKit              	0x00007fff8ca8f4ce _DPSNextEvent + 1434
37  com.apple.AppKit              	0x00007fff8ca8eb1b -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122
38  com.apple.AppKit              	0x00007fff8ca82c1c -[NSApplication run] + 553
39  com.apple.AppKit              	0x00007fff8ca6da03 NSApplicationMain + 940
40  com.apple.XPCService          	0x00007fff91f0ac0f _xpc_main + 385
41  libxpc.dylib                  	0x00007fff88e82bde xpc_main + 399
42  com.apple.WebKit.WebContent.Development	0x000000010ab616a0 main + 16
43  libdyld.dylib                 	0x00007fff8da285fd start + 1

Expected result:
Webkit does not crash.
Comment 1 Mark Wang 2015-12-13 17:58:27 PST 
This issue also can be reproduced on our STB platform. Does someone have a workaround patch?
Comment 2 Mark Wang 2016-01-06 19:30:34 PST 
This issue is the duplicated issue of https://bugs.webkit.org/show_bug.cgi?id=131530, so it can be closed.