Bug 13182

Summary: REGRESSION: REPRO CRASH: JVM crash using Qwest's online customer support
Product: WebKit Reporter: David Kilzer (:ddkilzer) <ddkilzer>
Component: Plug-insAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: dacarson, ggaren
Priority: P1    
Version: 523.x (Safari 3)   
Hardware: Mac   
OS: OS X 10.4   

Description David Kilzer (:ddkilzer) 2007-03-24 13:58:42 PDT 
Summary:

JVM crashed while trying to access Qwest's online customer support.

Steps to reproduce:

1. Open Safari/WebKit.
2. Go to:  http://www.qwest.com/
3. Click on "Small Business" button in upper-right. (https://www.qwest.com/myaccount/signin/index.html)
4. Click on "Want Help?" button in upper right.
5. Type "phone number?" and hit Enter.
6. Type "yes" and hit Enter.
7. Click "OK" on the "Sorry, but your browser does not allow this application to run." JS dialog.
8. Type in your first name, then click Send.

Expected results:

The Java applet should run, allowing you to connect to the online customer support.

Actual results:

JVM and browser crash.

Regression:

Not tested with shipping Safari 2.0.4 (419.3) on Mac OS X 10.4.9 (8P135).

Reproduced with a local debug build of WebKit r20470 using the above software.
Comment 1 David Kilzer (:ddkilzer) 2007-03-24 13:59:14 PDT 
Console output before crash:

Unsafe JavaScript attempt to access frame with URL https://server.iad.liveperson.net/hc/78221172/78221172?SESSIONVAR%21skill=SmallBusiness&SESSIONVAR%21User+Type=small+business&SESSIONVAR%21AskQwest+Transcript=http%3A%2F%2Fqwest.agent.asahost.com%2FviewTranscript.html%3FUID%3D7289a1174768740692&cmd=file&file=visitorWantsToChat&site=78221172&byhref=1&sessionkey=H4346360985769602527K26797422 from frame with URL https://ecom.qwest.com/www/global/includes/c2c/checkLivePerson1.html. Domains must match.
HumanClick Poll 2.17
ERROR: could not show status message (Applet PPoll stopped) because plug-in has already been destroyed
(/Volumes/Data/WebKit/WebKit/Plugins/WebPluginController.mm:341 -[WebPluginController webPlugInContainerShowStatus:])
ERROR: could not show status message (Applet PPoll notstarted) because plug-in has already been destroyed
(/Volumes/Data/WebKit/WebKit/Plugins/WebPluginController.mm:341 -[WebPluginController webPlugInContainerShowStatus:])
ERROR: could not show status message (Applet PPoll destroyed) because plug-in has already been destroyed
(/Volumes/Data/WebKit/WebKit/Plugins/WebPluginController.mm:341 -[WebPluginController webPlugInContainerShowStatus:])
ERROR: could not show status message (Applet PPoll disposed) because plug-in has already been destroyed
(/Volumes/Data/WebKit/WebKit/Plugins/WebPluginController.mm:341 -[WebPluginController webPlugInContainerShowStatus:])
java.lang.InterruptedException: sleep interrupted
        at java.lang.Thread.sleep(Native Method)
        at PPoll.run(Unknown Source)
        at java.lang.Thread.run(Thread.java:613)
Unsafe JavaScript attempt to access frame with URL https://server.iad.liveperson.net/hc/78221172/?cmd=file&amp;file=chatStart&amp;site=78221172&amp;sessionkey=H4346360985769602527K26797422 from frame with URL https://ecom.qwest.com/www/global/includes/c2c/checkLivePerson1.html. Domains must match.
HumanClick Chat 7.8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a16284 for 0x17a0d034
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e84c for 0x17a0d098
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e838 for 0x17a0d0b4
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e830 for 0x17a0d0d0
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e82c for 0x17a0d0ec
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e828 for 0x17a0d0e4
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e824 for 0x17a0d0b4
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e820 for 0x17a0d080
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e81c for 0x17a0d0b4
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e818 for 0x17a0d6dc
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e814 for 0x17a0d6f8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e810 for 0x17a0d714
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e80c for 0x17a0d730
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e808 for 0x17a0d74c
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e804 for 0x17a0d718
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e800 for 0x17a0d6e8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7fc for 0x17a0d0b4
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7f8 for 0x17a0c89c
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7f4 for 0x17a0c8b8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7f0 for 0x17a0c8d4
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7ec for 0x17a0c8f0
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7e8 for 0x17a0c90c
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7e4 for 0x17a0c8d8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7e0 for 0x17a0c8a8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7dc for 0x17a0d728
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7d8 for 0x17a0d6d4
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7d4 for 0x17a0f0e8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a0e7d0 for 0x17a0f104
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08bcc for 0x17a0f120
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08bc8 for 0x17a0f13c
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08bc4 for 0x17a0f158
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08bc0 for 0x17a0f12c
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08bbc for 0x17a0f0fc
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08bb8 for 0x17a0c8f4
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08bb4 for 0x17a0c8a0
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08bb0 for 0x17a0d6d4
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08bac for 0x17a0eb40
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08ba8 for 0x17a0eb5c
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08ba4 for 0x17a0eb78
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08ba0 for 0x17a0eb94
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b9c for 0x17a0ea90
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b98 for 0x17a0eaac
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b94 for 0x17a0eac8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b90 for 0x17a0eae4
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b8c for 0x17a0eb00
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b88 for 0x17a0eae8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b84 for 0x17a0eab8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b80 for 0x17a0eba8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b7c for 0x17a0eb78
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b78 for 0x17a0eb44
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b74 for 0x17a0f13c
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b70 for 0x17a0f0e8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b6c for 0x17a0c894
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b68 for 0x17a0e9f8
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b64 for 0x17a0ea14
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b60 for 0x17a0ea30
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:343 -- JObjectWrapper:  new global ref 0x17a08b5c for 0x17a0ea4c
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:128 -- invokeMethod:  call getErrorLine ()Ljava/lang/String; on 0x17a16284
/Volumes/Data/WebKit/JavaScriptCore/bindings/jni/jni_instance.cpp:128 -- invokeMethod:  call isNewText ()Z on 0x17a16284
Bus error
Comment 2 David Kilzer (:ddkilzer) 2007-03-24 13:59:30 PDT 
Stack trace:

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   libjvm.dylib                	0x9ca3ef34 JVM_MonitorWait + 14340
1   libjvm.dylib                	0x9cbd855c JNI_GetDefaultJavaVMInitArgs_Impl + 52476
2   com.apple.JavaPluginCocoa15 	0x1755e0f0 ConvertJavaToJValue + 196
3   com.apple.JavaPluginCocoa15 	0x175643d0 MethodSwizzle + 10712
4   com.apple.JavaScriptCore    	0x005971d0 KJS::Bindings::dispatchJNICall(void const*, _jobject*, bool, JNIType, _jmethodID*, jvalue*, jvalue&, char const*, KJS::JSValue*&) + 236 (jni_objc.mm:56)
5   com.apple.JavaScriptCore    	0x005898b0 KJS::Bindings::JavaInstance::invokeMethod(KJS::ExecState*, KJS::Bindings::MethodList const&, KJS::List const&) + 1100 (jni_instance.cpp:156)
6   com.apple.JavaScriptCore    	0x0058a3f4 KJS::RuntimeMethod::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 404 (runtime_method.cpp:89)
7   com.apple.JavaScriptCore    	0x00564be8 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 288 (object.cpp:97)
8   com.apple.JavaScriptCore    	0x00559c60 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 1088 (nodes.cpp:781)
9   com.apple.JavaScriptCore    	0x0054fc7c KJS::AssignExprNode::evaluate(KJS::ExecState*) + 84 (nodes.cpp:1536)
10  com.apple.JavaScriptCore    	0x00556490 KJS::VarDeclNode::evaluate(KJS::ExecState*) + 184 (nodes.cpp:1554)
11  com.apple.JavaScriptCore    	0x00556318 KJS::VarDeclListNode::evaluate(KJS::ExecState*) + 96 (nodes.cpp:1602)
12  com.apple.JavaScriptCore    	0x005561bc KJS::VarStatementNode::execute(KJS::ExecState*) + 220 (nodes.cpp:1626)
13  com.apple.JavaScriptCore    	0x00553408 KJS::SourceElementsNode::execute(KJS::ExecState*) + 300 (nodes.cpp:2459)
14  com.apple.JavaScriptCore    	0x00551ec0 KJS::BlockNode::execute(KJS::ExecState*) + 216 (nodes.cpp:1658)
15  com.apple.JavaScriptCore    	0x005525b4 KJS::TryNode::execute(KJS::ExecState*) + 228 (nodes.cpp:2305)
16  com.apple.JavaScriptCore    	0x0055356c KJS::SourceElementsNode::execute(KJS::ExecState*) + 656 (nodes.cpp:2465)
17  com.apple.JavaScriptCore    	0x00551ec0 KJS::BlockNode::execute(KJS::ExecState*) + 216 (nodes.cpp:1658)
18  com.apple.JavaScriptCore    	0x00542180 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 92 (function.cpp:364)
19  com.apple.JavaScriptCore    	0x005431d4 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 688 (function.cpp:114)
20  com.apple.JavaScriptCore    	0x00564be8 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 288 (object.cpp:97)
21  com.apple.JavaScriptCore    	0x0055a54c KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 856 (nodes.cpp:687)
22  com.apple.JavaScriptCore    	0x00555fdc KJS::ExprStatementNode::execute(KJS::ExecState*) + 220 (nodes.cpp:1681)
23  com.apple.JavaScriptCore    	0x00553408 KJS::SourceElementsNode::execute(KJS::ExecState*) + 300 (nodes.cpp:2459)
24  com.apple.JavaScriptCore    	0x00551ec0 KJS::BlockNode::execute(KJS::ExecState*) + 216 (nodes.cpp:1658)
25  com.apple.JavaScriptCore    	0x00542180 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 92 (function.cpp:364)
26  com.apple.JavaScriptCore    	0x005431d4 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 688 (function.cpp:114)
27  com.apple.JavaScriptCore    	0x00564be8 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 288 (object.cpp:97)
28  com.apple.JavaScriptCore    	0x0055a54c KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 856 (nodes.cpp:687)
29  com.apple.JavaScriptCore    	0x00555fdc KJS::ExprStatementNode::execute(KJS::ExecState*) + 220 (nodes.cpp:1681)
30  com.apple.JavaScriptCore    	0x00555e64 KJS::IfNode::execute(KJS::ExecState*) + 520 (nodes.cpp:1700)
31  com.apple.JavaScriptCore    	0x00553408 KJS::SourceElementsNode::execute(KJS::ExecState*) + 300 (nodes.cpp:2459)
32  com.apple.JavaScriptCore    	0x00551ec0 KJS::BlockNode::execute(KJS::ExecState*) + 216 (nodes.cpp:1658)
33  com.apple.JavaScriptCore    	0x005525b4 KJS::TryNode::execute(KJS::ExecState*) + 228 (nodes.cpp:2305)
34  com.apple.JavaScriptCore    	0x0055356c KJS::SourceElementsNode::execute(KJS::ExecState*) + 656 (nodes.cpp:2465)
35  com.apple.JavaScriptCore    	0x00551ec0 KJS::BlockNode::execute(KJS::ExecState*) + 216 (nodes.cpp:1658)
36  com.apple.JavaScriptCore    	0x00542180 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 92 (function.cpp:364)
37  com.apple.JavaScriptCore    	0x005431d4 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 688 (function.cpp:114)
38  com.apple.JavaScriptCore    	0x00564be8 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 288 (object.cpp:97)
39  com.apple.WebCore           	0x012cff28 KJS::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 736 (kjs_events.cpp:123)
40  com.apple.WebCore           	0x010fc008 WebCore::Document::handleWindowEvent(WebCore::Event*, bool) + 416 (Document.cpp:2342)
41  com.apple.WebCore           	0x01291a30 WebCore::EventTargetNode::dispatchWindowEvent(WebCore::AtomicString const&, bool, bool) + 360 (EventTargetNode.cpp:339)
42  com.apple.WebCore           	0x010fe004 WebCore::Document::implicitClose() + 796 (Document.cpp:1385)
43  com.apple.WebCore           	0x01467c44 WebCore::FrameLoader::checkEmitLoadEvent() + 596 (FrameLoader.cpp:1133)
44  com.apple.WebCore           	0x014736c0 WebCore::FrameLoader::checkCompleted() + 492 (FrameLoader.cpp:1093)
45  com.apple.WebCore           	0x014734ac WebCore::FrameLoader::completed() + 216 (FrameLoader.cpp:1667)
46  com.apple.WebCore           	0x0147374c WebCore::FrameLoader::checkCompleted() + 632 (FrameLoader.cpp:1096)
47  com.apple.WebCore           	0x014747f4 WebCore::FrameLoader::loadDone() + 80 (FrameLoader.cpp:1063)
48  com.apple.WebCore           	0x0111c3ac WebCore::DocLoader::setLoadInProgress(bool) + 84 (DocLoader.cpp:182)
49  com.apple.WebCore           	0x0111e0b0 WebCore::Loader::didFinishLoading(WebCore::SubresourceLoader*) + 400 (loader.cpp:109)
50  com.apple.WebCore           	0x0148011c WebCore::SubresourceLoader::didFinishLoading() + 204 (SubresourceLoader.cpp:192)
51  com.apple.WebCore           	0x0147e250 WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*) + 60
52  com.apple.WebCore           	0x014549a4 -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:] + 148 (ResourceHandleMac.mm:370)
53  com.apple.Foundation        	0x92c1389c -[NSURLConnection(NSURLConnectionInternal) _sendDidFinishLoadingCallback] + 188
54  com.apple.Foundation        	0x92c11b08 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 556
55  com.apple.Foundation        	0x92c11860 _sendCallbacks + 156
56  com.apple.CoreFoundation    	0x907df4fc __CFRunLoopDoSources0 + 384
57  com.apple.CoreFoundation    	0x907dea2c __CFRunLoopRun + 452
58  com.apple.CoreFoundation    	0x907de4ac CFRunLoopRunSpecific + 268
59  com.apple.HIToolbox         	0x93298b20 RunCurrentEventLoopInMode + 264
60  com.apple.HIToolbox         	0x932981b4 ReceiveNextEventCommon + 380
61  com.apple.HIToolbox         	0x93298020 BlockUntilNextEventMatchingListInMode + 96
62  com.apple.AppKit            	0x9379eae4 _DPSNextEvent + 384
63  com.apple.AppKit            	0x9379e7a8 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116
64  com.apple.Safari            	0x00006740 0x1000 + 22336
65  com.apple.AppKit            	0x9379acec -[NSApplication run] + 472
66  com.apple.AppKit            	0x9388b87c NSApplicationMain + 452
67  com.apple.Safari            	0x0005c77c 0x1000 + 374652
68  com.apple.Safari            	0x0005c624 0x1000 + 374308
Comment 3 David Kilzer (:ddkilzer) 2007-03-24 14:04:05 PDT 
(In reply to comment #0)
> Regression:
> Not tested with shipping Safari 2.0.4 (419.3) on Mac OS X 10.4.9 (8P135).
> Reproduced with a local debug build of WebKit r20470 using the above software.

This does not crash with shipping Safari 2.0.4 (419.3) on Mac OS X 10.4.9 (8P135).
Comment 4 David Kilzer (:ddkilzer) 2007-03-24 14:05:46 PDT 
(In reply to comment #0)
> Steps to reproduce:
> 
> 1. Open Safari/WebKit.
> 2. Go to:  http://www.qwest.com/
> 3. Click on "Small Business" button in upper-right.
> (https://www.qwest.com/myaccount/signin/index.html)
> 4. Click on "Want Help?" button in upper right.
> 5. Type "phone number?" and hit Enter.
> 6. Type "yes" and hit Enter.
> 7. Click "OK" on the "Sorry, but your browser does not allow this application
> to run." JS dialog.
> 8. Type in your first name, then click Send.

In Step 6, you are typing "Yes" after the system asked if you wanted to be connected to customer support.

In Step 7, this appears to happen any time the small browser window (opened in Step 4) is closed.

In Step 8, there is no need to enter a phone number.
Comment 5 David Kilzer (:ddkilzer) 2007-03-24 15:08:21 PDT 

*** This bug has been marked as a duplicate of 13142 ***