Summary: | REGRESSION(r27176): Reproducible crash while trying to order dinner makes bdash sad | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Mark Rowe (bdash) <mrowe> | ||||||||
Component: | New Bugs | Assignee: | Maciej Stachowiak <mjs> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Major | CC: | mjs | ||||||||
Priority: | P1 | Keywords: | HasReduction, Regression | ||||||||
Version: | 523.x (Safari 3) | ||||||||||
Hardware: | Mac | ||||||||||
OS: | OS X 10.5 | ||||||||||
Attachments: |
|
Description
Mark Rowe (bdash)
2007-10-28 02:28:15 PDT
Created attachment 16911 [details]
Crash log
Top of the crash log for easy reference: Exception Type: EXC_BAD_ACCESS (SIGBUS) Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000000 Crashed Thread: 0 Thread 0 Crashed: 0 com.apple.WebCore 0x01e7838c KJS::Window::pauseTimeouts() + 248 (kjs_window.cpp:1564) 1 com.apple.WebCore 0x020a15af WebCore::CachedPage::CachedPage(WebCore::Page*) + 615 (CachedPage.cpp:101) 2 com.apple.WebCore 0x020a1668 WebCore::CachedPage::CachedPage(WebCore::Page*) + 24 (CachedPage.cpp:110) 3 com.apple.WebCore 0x020a169b WebCore::CachedPage::create(WebCore::Page*) + 49 (CachedPage.cpp:72) > Actual results:
> Crash after step 5.
This should have said step 4.
Doesn't crash for me in a debug build. Hrm, in step 2 try the second restaurant in the list, "Foodgame". Some others appear to not crash. "git bisect" has narrowed this down to Maciej's HashTable change in http://trac.webkit.org/projects/webkit/changeset/27176. Previous revisions do not crash. Reduction: <script> setTimeout('',1000); clearTimeout(0); clearTimeout(0); window.location = 'about:blank'; </script> In pauseTimeouts, d->m_timeouts.size() is returning a negative number. Created attachment 16924 [details] Reduction from Comment #7 (In reply to comment #7) > Reduction: [...[ > > In pauseTimeouts, d->m_timeouts.size() is returning a negative number. Thanks, John! Created attachment 16929 [details]
let bdash have dinner
Comment on attachment 16929 [details]
let bdash have dinner
r=me
|