Bug 28948 – reproducible freeze and crash on closing form popup at bosch-home.nl

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Julian Gonggrijp]

I found this bug using Nightly build r48004.

To reproduce:
 - visit http://www.bosch-home.nl/sitemap/quick-links/service/reparaties.html?rw=true
 - about halfway the page in the wide center column, press the "Online Reparatieformulier" hyperlink; a form will open in a new window
 - next to the "E-Nr.*" input field, press the button with the downwards arrow symbol; a popup will open with a error message (because you didn't fill out the necessary fields)
 - by now, WebKit has already frozen more or less, e.g. you can't switch to another window anymore
 - close the popup with the close button or with the "Sluit Venster" hyperlink; after about a second WebKit crashes.

Backtrace is in the attachment.
The system console reports that Webkit exited abnormally because of a bus error.

[Julian Gonggrijp]

Created attachment 38989 [details]
backtrace of the described crash

[Alexey Proskuryakov]

Stack trace from debug build:

#0	0x009a1af9 in JSC::JSValue::toBoolean at JSCell.h:279
#1	0x00a25069 in cti_op_jtrue at JITStubs.cpp:2281
#2	0x00a23f20 in WTF::doubleHash at HashTable.h:437
#3	0x00a03979 in JSC::JITCode::execute at JITCode.h:79
#4	0x009ef971 in JSC::Interpreter::execute at Interpreter.cpp:721
#5	0x00951d25 in JSC::JSFunction::call at JSFunction.cpp:120
#6	0x00951e01 in JSC::call at CallData.cpp:39
#7	0x03fa19a3 in WebCore::JSEventListener::handleEvent at JSEventListener.cpp:133
<...> 

> - by now, WebKit has already frozen more or less, e.g. you can't switch to
> another window anymore

This is expected and correct behavior - it's a modal dialog displayed by the page (uncommon on the Web, but there is such a feature). Crashing is not expected or correct, of course.

[Alexey Proskuryakov]

<rdar://problem/7199915>

[Alexey Proskuryakov]

*** Bug 29642 has been marked as a duplicate of this bug. ***

[Oliver Hunt]

Created attachment 40423 [details]
Fix support for return values provided by show modal dialog.

[Maciej Stachowiak]

Comment on attachment 40423 [details]
Fix support for return values provided by show modal dialog.

r=me

Add an explanation for why it's not possible to make a layout test to the ChangeLog please.

[Oliver Hunt]

Committed r48960

[Oliver Hunt]

*** Bug 29962 has been marked as a duplicate of this bug. ***