Bug 90711

Summary:	fast/canvas/webgl/gl-vertexattribpointer.html is crashing
Product:	WebKit	Reporter:	Filip Pizlo <fpizlo>
Component:	JavaScriptCore	Assignee:	Filip Pizlo <fpizlo>
Status:	RESOLVED WORKSFORME
Severity:	Normal	CC:	fpizlo, rniwa
Priority:	P2	Keywords:	InRadar, LayoutTestFailure
Version:	528+ (Nightly build)
Hardware:	All
OS:	All

Filip Pizlo

Reported 2012-07-06 16:47:31 PDT

0 com.apple.JavaScriptCore 0x0000000101961948 void JSC::validateCell<JSC::Structure*>(JSC::Structure*) + 136 (WriteBarrier.h:50) 1 com.apple.JavaScriptCore 0x00000001019617cf JSC::WriteBarrierBase<JSC::Structure>::operator->() const + 111 (WriteBarrier.h:118) 2 com.apple.JavaScriptCore 0x000000010196f67c JSC::JSCell::isString() const + 28 (Structure.h:491) 3 com.apple.JavaScriptCore 0x000000010196fecc JSC::JSValue::isString() const + 60 (JSCell.h:211) 4 com.apple.JavaScriptCore 0x0000000101a6a61f JSC::JSValue::equalSlowCaseInline(JSC::ExecState*, JSC::JSValue, JSC::JSValue) + 127 (Operations.h:127) 5 com.apple.JavaScriptCore 0x0000000101b3feb3 cti_op_eq + 131 (JITStubs.cpp:2868) 6 com.apple.JavaScriptCore 0x0000000101b434d0 0x101957000 + 2016464 7 com.apple.JavaScriptCore 0x0000000101b0ad34 JSC::JITCode::execute(JSC::RegisterFile*, JSC::ExecState*, JSC::JSGlobalData*) + 84 (JITCode.h:133) 8 com.apple.JavaScriptCore 0x0000000101b0708f JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::ScopeChainNode*, JSC::JSObject*) + 4863 (Interpreter.cpp:1231) 9 com.apple.JavaScriptCore 0x00000001019f158c JSC::evaluate(JSC::ExecState*, JSC::ScopeChainNode*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 492 (Completion.cpp:75) 10 com.apple.WebCore 0x000000010398873a WebCore::JSMainThreadExecState::evaluate(JSC::ExecState*, JSC::ScopeChainNode*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 90 (JSMainThreadExecState.h:77) 11 com.apple.WebCore 0x00000001040fc092 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld*) + 370 (ScriptController.cpp:145) 12 com.apple.WebCore 0x00000001040fc1c4 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 68 (ScriptController.cpp:162) 13 com.apple.WebCore 0x0000000104112503 WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 723 (ScriptElement.cpp:300) 14 com.apple.WebCore 0x000000010411134d WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) + 1693 (ScriptElement.cpp:240) 15 com.apple.WebCore 0x0000000103543043 WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&) + 419 (HTMLScriptRunner.cpp:298) 16 com.apple.WebCore 0x0000000103542dfc WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr<WebCore::Element>, WTF::TextPosition const&) + 156 (HTMLScriptRunner.cpp:172) 17 com.apple.WebCore 0x00000001034b92a5 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 277 (HTMLDocumentParser.cpp:207) 18 com.apple.WebCore 0x00000001034b938b WebCore::HTMLDocumentParser::canTakeNextToken(WebCore::HTMLDocumentParser::SynchronousMode, WebCore::PumpSession&) + 171 (HTMLDocumentParser.cpp:225) 19 com.apple.WebCore 0x00000001034b8c54 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 420 (HTMLDocumentParser.cpp:263) 20 com.apple.WebCore 0x00000001034b88b5 WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) + 197 (HTMLDocumentParser.cpp:178) 21 com.apple.WebCore 0x00000001034b9c5e WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution() + 238 (HTMLDocumentParser.cpp:475) 22 com.apple.WebCore 0x00000001034ba07f WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource*) + 479 (HTMLDocumentParser.cpp:520) 23 com.apple.WebCore 0x00000001034ba0df non-virtual thunk to WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource*) + 47 24 com.apple.WebCore 0x0000000102e3b77d WebCore::CachedResource::checkNotify() + 109 (CachedResource.cpp:245) 25 com.apple.WebCore 0x0000000102e53cab WebCore::CachedScript::data(WTF::PassRefPtr<WebCore::SharedBuffer>, bool) + 187 (CachedScript.cpp:105) 26 com.apple.WebCore 0x00000001042a526c WebCore::SubresourceLoader::didFinishLoading(double) + 524 (SubresourceLoader.cpp:278) 27 com.apple.WebCore 0x00000001040b99b5 WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*, double) + 53 (ResourceLoader.cpp:437) 28 com.apple.WebCore 0x00000001040b654b -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:] + 187 (ResourceHandleMac.mm:861) 29 com.apple.Foundation 0x00007fff8acf5662 ___NSURLConnectionDidFinishLoading_block_invoke_1 + 122 30 com.apple.Foundation 0x00007fff8acf55e2 _NSURLConnectionDidFinishLoading + 81 31 com.apple.CFNetwork 0x00007fff8859b4fe URLConnectionClient::_clientDidFinishLoading(URLConnectionClient::ClientConnectionEventQueue*) + 296 32 com.apple.CFNetwork 0x00007fff8864b91e URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo<XClientEvent, XClientEventParams>*, long) + 862 33 com.apple.CFNetwork 0x00007fff8864bb0a URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo<XClientEvent, XClientEventParams>*, long) + 1354 34 com.apple.CFNetwork 0x00007fff88576389 URLConnectionClient::processEvents() + 185 35 com.apple.CFNetwork 0x00007fff8857622e MultiplexerSource::perform() + 212 36 com.apple.CoreFoundation 0x00007fff892a66e1 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 37 com.apple.CoreFoundation 0x00007fff892a5f4d __CFRunLoopDoSources0 + 253 38 com.apple.CoreFoundation 0x00007fff892ccd39 __CFRunLoopRun + 905 39 com.apple.CoreFoundation 0x00007fff892cc676 CFRunLoopRunSpecific + 230 40 com.apple.Foundation 0x00007fff8ac98f9f -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 267 41 DumpRenderTree 0x0000000101747069 _ZL7runTestRKNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEE + 5657 (DumpRenderTree.mm:1364) 42 DumpRenderTree 0x00000001017459aa _ZL20runTestingServerLoopv + 282 (DumpRenderTree.mm:830) 43 DumpRenderTree 0x000000010174523a dumpRenderTree(int, char const**) + 394 (DumpRenderTree.mm:877) 44 DumpRenderTree 0x00000001017478a9 main + 105 (DumpRenderTree.mm:914) 45 DumpRenderTree 0x00000001017300c4 start + 52

Attachments
Add attachment proposed patch, testcase, etc.

Filip Pizlo

Comment 1 2012-07-06 16:47:40 PDT

I will skip it for now.

Filip Pizlo

Comment 2 2012-07-06 16:50:28 PDT

<rdar://problem/11823241>

Ryosuke Niwa

Comment 3 2013-05-22 18:01:45 PDT

Not crashing anymore.

Note You need to log in before you can comment on or make changes to this bug.