Summary: | REGRESSION (SquirrelFish): Reproducible crash after entering a username at mint.com | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Aaron Gyes <floam> | ||||||||
Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Critical | CC: | i.am, oliver, zwarich | ||||||||
Priority: | P1 | Keywords: | InRadar, NeedsReduction, Regression | ||||||||
Version: | 528+ (Nightly build) | ||||||||||
Hardware: | Mac | ||||||||||
OS: | OS X 10.5 | ||||||||||
URL: | http://mint.com | ||||||||||
Attachments: |
|
Description
Aaron Gyes
2008-06-22 16:11:05 PDT
I can reproduce this by creating a new account and trying to add an E*trade account to it. Hopefully I can reduce it. The crashes occurs in the body of get_scoped_var. It seems that there is a problem with the multiscope lookup optimization. I will disable it and try again. Interestingly enough, it still crashes even when I disable multiscope lookup optimization. Created attachment 21877 [details]
Code dump
Here is the code with multiscope lookup optimization turned off. It dies in resolve_with_base. I wanted to get the call frame as well, but gdb didn't agree. I'll get it by just printing it every time it enters that opcode body.
The problem is that the registerBase of the JSVariableObject (the value pointed to by JSVariableObject::registerBase()) is 0. The register base is a valid pointer to m_base of some RegisterFile. However, setBase() is never called on that RegisterFile to make it null, and it's not the default value (I made it something other than null to test). Since m_base is private, this means that the cause is likely random corruption from something else going wrong. The RegisterFile instance containing the offending m_base field has already been freed when the field is being used by JSVariableObject::valueAt(). I'll try to figure out why it is being incorrectly freed. Created attachment 21879 [details]
Destructor backtrace
Here's a destructor backtrace of the RegisterFile. The problem isn't really that a RegisterFile is being freed, it is that the JSActivation instance still refers to it. The copyRegisters() method should have been called on the JSActivation instance, but it seems that it wasn't.
Created attachment 21892 [details]
Proposed patch
Comment on attachment 21892 [details]
Proposed patch
good detectoring
Landed in r34751. *** Bug 19467 has been marked as a duplicate of this bug. *** |