| Summary: | Google doc spreadsheet reproducibly crashes when sorting | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Gavin Sherlock <gsherloc> | ||||||
| Component: | JavaScriptCore | Assignee: | Michael Saboff <msaboff> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | ap, bfulgham, ggaren, mark.lam, ossy, webkit-bug-importer | ||||||
| Priority: | P1 | Keywords: | InRadar | ||||||
| Version: | 528+ (Nightly build) | ||||||||
| Hardware: | Mac | ||||||||
| OS: | OS X 10.10 | ||||||||
| Bug Depends on: | 141577, 141671, 141676 | ||||||||
| Bug Blocks: | |||||||||
| Attachments: |
|
||||||||
|
Description
Gavin Sherlock
2015-01-30 13:59:46 PST
Can you supply an example spreadsheet that causes this crash when viewed and sorted? Shared a google spreadsheet with you that has the behavior. I couldn't successfully reduce it unfortunately. Thanks! I can reproduce this crash now. Created attachment 246503 [details]
Patch
This fixes the crash. Now we throw an out of stack exception. There is still an issue with the webpage after the fix. Now a dialog pops up after the sort completes saying the File is unavailable and that there was a problem. This is probably due to the out of stack exception.
Comment on attachment 246503 [details]
Patch
R=me we should work out what is causing the pathological growth in intermediates. I suspect we're trying to simplify something else in a bad way :(
Committed r180060: <http://trac.webkit.org/changeset/180060> (In reply to comment #7) > Committed r180060: <http://trac.webkit.org/changeset/180060> It broke the cloop bot: 2015-02-13 10:59:03.659 testapi[3268:12127526] Testing Objective-C API testAPI completed with rc=11 (254) (In reply to comment #8) > (In reply to comment #7) > > Committed r180060: <http://trac.webkit.org/changeset/180060> > > It broke the cloop bot: > > 2015-02-13 10:59:03.659 testapi[3268:12127526] Testing Objective-C API > testAPI completed with rc=11 (254) Looking at the loop now. It looks like this may have broken JSC tests on Windows (one test): ** The following JSC stress test failures have been introduced: jsc-layout-tests.yaml/js/script-tests/regress-141098.js.layout-no-llint (In reply to comment #10) > It looks like this may have broken JSC tests on Windows (one test): > > ** The following JSC stress test failures have been introduced: > jsc-layout-tests.yaml/js/script-tests/regress-141098.js.layout-no-llint That is the new test. Here is the Windows test failure from the log: jsc-layout-tests.yaml/js/script-tests/regress-141098.js.layout-no-llint: Regression test for https://webkit.org/b/141098. Make sure eval() properly handles running out of stack space. This test should run without crashing. jsc-layout-tests.yaml/js/script-tests/regress-141098.js.layout-no-llint: jsc-layout-tests.yaml/js/script-tests/regress-141098.js.layout-no-llint: On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". jsc-layout-tests.yaml/js/script-tests/regress-141098.js.layout-no-llint: jsc-layout-tests.yaml/js/script-tests/regress-141098.js.layout-no-llint: jsc-layout-tests.yaml/js/script-tests/regress-141098.js.layout-no-llint: test_script_9825: line 2: 1584 Segmentation fault "$@" ../../../../.vm/JavaScriptCore.framework/Resources/jsc --useFTLJIT\=false --enableFunctionDotArguments\=true --useLLInt\=false resources/standalone-pre.js regress-141098.js resources/standalone-post.js jsc-layout-tests.yaml/js/script-tests/regress-141098.js.layout-no-llint: ERROR: Unexpected exit code: 139 FAIL: jsc-layout-tests.yaml/js/script-tests/regress-141098.js.layout-no-llint Need to fix the C Loop and Windows as noted above. Windows / Baseline crash tracked in https://bugs.webkit.org/show_bug.cgi?id=141577 and landed with change set r180083: <http://trac.webkit.org/changeset/180083>. C Loop issue tracked in https://bugs.webkit.org/show_bug.cgi?id=141671 Similar issue in DFG discovered via code inspection and tracked in https://bugs.webkit.org/show_bug.cgi?id=141676. Closing this defect as the primary issue is resolved for non-C Loop builds. The C Loop issue is tracked in https://bugs.webkit.org/show_bug.cgi?id=141671 |