Summary: | REGRESSION: Crash in sort() when visiting http://www.onnyturf.com/subway/ | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Anders Carlsson <andersca> | ||||||||
Component: | JavaScriptCore | Assignee: | Alexey Proskuryakov <ap> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | ap | ||||||||
Priority: | P1 | Keywords: | Regression | ||||||||
Version: | 528+ (Nightly build) | ||||||||||
Hardware: | Mac | ||||||||||
OS: | OS X 10.5 | ||||||||||
Attachments: |
|
Description
Anders Carlsson
2008-06-25 09:00:56 PDT
Created attachment 21932 [details]
Reduction
Here's a reduction
The reduction crashes in release build. Created attachment 21944 [details]
further reduction
So, it's just the data set that makes the algorithm go crazy, not a tricky compare function.
Comment on attachment 21932 [details]
Reduction
Actually, the crash happens at a different place, so let's not mark this version obsolete yet.
Created attachment 21954 [details]
proposed fix
Comment on attachment 21954 [details]
proposed fix
r=me
Committed revision 34809. |