Bug 15731

Summary: REGRESSION(r27176): Reproducible crash while trying to order dinner makes bdash sad
Product: WebKit Reporter: Mark Rowe (bdash) <mrowe>
Component: New BugsAssignee: Maciej Stachowiak <mjs>
Severity: Major CC: mjs
Priority: P1 Keywords: HasReduction, Regression
Version: 523.x (Safari 3)   
Hardware: Mac   
OS: OS X 10.5   
Description Flags
Crash log
Reduction from Comment #7
let bdash have dinner mrowe: review+

Description Mark Rowe (bdash) 2007-10-28 02:28:15 PDT
Steps to reproduce:
1. Visit http://www.menulog.com.au/search.php?submit2=T&searchMode=takeaway&cartType=delivery&majorRegionId=28&postcode=2010
2. Click the "Order" button alongside one of the restaurants that prepares yummy food.
3. Click "Order Delivery".
4. Click on "Surry Hills - 2010" so that the food can be delivered to me.

Expected results:
Tasty food delivered to my door.

Actual results:
Crash after step 5.

This worked as recently as last Wednesday.
Comment 1 Mark Rowe (bdash) 2007-10-28 02:29:19 PDT
Created attachment 16911 [details]
Crash log
Comment 2 Mark Rowe (bdash) 2007-10-28 02:30:21 PDT
Top of the crash log for easy reference:

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000000
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.WebCore             	0x01e7838c KJS::Window::pauseTimeouts() + 248 (kjs_window.cpp:1564)
1   com.apple.WebCore             	0x020a15af WebCore::CachedPage::CachedPage(WebCore::Page*) + 615 (CachedPage.cpp:101)
2   com.apple.WebCore             	0x020a1668 WebCore::CachedPage::CachedPage(WebCore::Page*) + 24 (CachedPage.cpp:110)
3   com.apple.WebCore             	0x020a169b WebCore::CachedPage::create(WebCore::Page*) + 49 (CachedPage.cpp:72)

Comment 3 Mark Rowe (bdash) 2007-10-28 02:32:44 PDT
> Actual results:
> Crash after step 5.

This should have said step 4.
Comment 4 Eric Seidel (no email) 2007-10-28 02:34:24 PDT
Doesn't crash for me in a debug build.
Comment 5 Mark Rowe (bdash) 2007-10-28 02:35:31 PDT
Hrm, in step 2 try the second restaurant in the list, "Foodgame".  Some others appear to not crash.
Comment 6 Mark Rowe (bdash) 2007-10-28 05:09:18 PDT
"git bisect" has narrowed this down to Maciej's HashTable change in http://trac.webkit.org/projects/webkit/changeset/27176.  Previous revisions do not crash.
Comment 7 John Moe 2007-10-28 13:11:00 PDT
window.location = 'about:blank';

In pauseTimeouts, d->m_timeouts.size() is returning a negative number.
Comment 8 David Kilzer (:ddkilzer) 2007-10-28 16:45:39 PDT
Created attachment 16924 [details]
Reduction from Comment #7
Comment 9 David Kilzer (:ddkilzer) 2007-10-28 16:46:17 PDT
(In reply to comment #7)
> Reduction: [...[
> In pauseTimeouts, d->m_timeouts.size() is returning a negative number.

Thanks, John!

Comment 10 Maciej Stachowiak 2007-10-28 18:31:14 PDT
Created attachment 16929 [details]
let bdash have dinner
Comment 11 Mark Rowe (bdash) 2007-10-28 18:35:38 PDT
Comment on attachment 16929 [details]
let bdash have dinner