Summary: | REGRESSION (r35445): In Gmail, a crash occurs at KJS::Machine::privateExecute() when applying list styling to text after a quote had been removed | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Geoffrey Garen <ggaren> | ||||
Component: | JavaScriptCore | Assignee: | Cameron Zwarich (cpst) <zwarich> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | ap, oliver, zwarich | ||||
Priority: | P1 | Keywords: | InRadar, NeedsReduction, Regression | ||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Mac | ||||||
OS: | OS X 10.5 | ||||||
URL: | http://gmail.com | ||||||
Attachments: |
|
Description
Geoffrey Garen
2008-08-14 14:09:03 PDT
I am assigning this to myself. This works in r35417, but it crashes in r35531. Since this is the same range as bug 20391, it seems like they might be the same bug. It crashes in the same opcode, get_scoped_var, but it hits ASSERT(iter != end); instead of crashing on a later line. I'll bisect to find the exact point of regression. The revision that causes this is r34445: http://trac.webkit.org/changeset/35445 It seems that the scope chain is being unwound too far. I'll try to make a test case. Thr problem is that the depth() function does not account for a 0-depth function not having a full scope chain node. I have patch that rectifies this. SImple test case : function runTest() { var test = "FAIL"; with({test:"PASS"}) (function () { try { throw ""; } finally { print(test); }})() } runTest(); Created attachment 22842 [details]
fix
Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/VM/Machine.cpp M LayoutTests/ChangeLog A LayoutTests/fast/js/exception-try-finally-scope-error-expected.txt A LayoutTests/fast/js/exception-try-finally-scope-error.html A LayoutTests/fast/js/resources/exception-try-finally-scope-error.js Committed r35812 |