RESOLVED WORKSFORME 111799
Web Inspector: REGRESSION (r140445-r140666): Crash in JSC::CodeBlock::lineNumberForBytecodeOffset 
https://bugs.webkit.org/show_bug.cgi?id=111799
Summary Web Inspector: REGRESSION (r140445-r140666): Crash in JSC::CodeBlock::lineNum...
Kevin M. Dean
Reported 2013-03-07 17:34:26 PST
This is using the Webkit Web Inspector. Go to the link, open the Inspector, then right-click on the text in the middle of the page as if you were going to select Inspect Element on an item. It then crashes before the contextual menu appears. Crashlog variation #1: Process: WebProcess [1458] Path: /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Identifier: com.apple.WebProcess Version: 537+ (537.33+) Code Type: X86-64 (Native) Parent Process: ??? [1] User ID: 501 Date/Time: 2013-03-05 14:31:36.964 -0500 OS Version: Mac OS X 10.8.2 (12C60) Report Version: 10 Interval Since Last Report: 1023359 sec Crashes Since Last Report: -64 Per-App Interval Since Last Report: 146438 sec Per-App Crashes Since Last Report: 1 Anonymous UUID: C466B893-E23D-5DDB-311F-3C6DD0BACE7A Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef VM Regions Near 0xbbadbeef: --> __TEXT 000000010f765000-000000010f766000 [ 4K] r-x/rwx SM=COW /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Application Specific Information: Bundle controller class: BrowserBundleController Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010fbede20 JSC::CodeBlock::lineNumberForBytecodeOffset(unsigned int) + 48 1 com.apple.JavaScriptCore 0x000000010fcd799b JSC::Interpreter::getStackTrace(JSC::JSGlobalData*, WTF::Vector<JSC::StackFrame, 0ul>&) + 155 2 com.apple.WebCore 0x0000000110b6ef6f WebCore::createScriptCallStack(unsigned long, bool) + 127 3 com.apple.WebCore 0x00000001105ae4db WebCore::InspectorResourceAgent::buildInitiatorObject(WebCore::Document*) + 43 4 com.apple.WebCore 0x00000001105ae0cc WebCore::InspectorResourceAgent::willSendRequest(unsigned long, WebCore::DocumentLoader*, WebCore::ResourceRequest&, WebCore::ResourceResponse const&) + 924 5 com.apple.WebCore 0x0000000110b5177c WebCore::ResourceLoadNotifier::dispatchWillSendRequest(WebCore::DocumentLoader*, unsigned long, WebCore::ResourceRequest&, WebCore::ResourceResponse const&) + 284 6 com.apple.WebCore 0x0000000110b504ba WebCore::ResourceLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&) + 154 7 com.apple.WebCore 0x0000000110c5eacb WebCore::SubresourceLoader::willSendRequest(WebCore::ResourceRequest&, WebCore::ResourceResponse const&) + 267 8 com.apple.WebCore 0x0000000110b4fe70 WebCore::ResourceLoader::init(WebCore::ResourceRequest const&) + 304 9 com.apple.WebCore 0x0000000110c5e981 WebCore::SubresourceLoader::init(WebCore::ResourceRequest const&) + 17 10 com.apple.WebCore 0x0000000110c5e81d WebCore::SubresourceLoader::create(WebCore::Frame*, WebCore::CachedResource*, WebCore::ResourceRequest const&, WebCore::ResourceLoaderOptions const&) + 205 11 com.apple.WebCore 0x0000000110b520d1 WebCore::ResourceLoadScheduler::scheduleSubresourceLoad(WebCore::Frame*, WebCore::CachedResource*, WebCore::ResourceRequest const&, WebCore::ResourceLoadPriority, WebCore::ResourceLoaderOptions const&) + 49 12 com.apple.WebCore 0x00000001100b0310 WebCore::CachedResource::load(WebCore::CachedResourceLoader*, WebCore::ResourceLoaderOptions const&) + 1168 13 com.apple.WebCore 0x00000001100b4be5 WebCore::CachedResourceLoader::requestResource(WebCore::CachedResource::Type, WebCore::CachedResourceRequest&) + 1125 14 com.apple.WebCore 0x00000001100b4478 WebCore::CachedResourceLoader::requestImage(WebCore::CachedResourceRequest&) + 376 15 com.apple.WebCore 0x00000001101568f7 WebCore::CSSImageValue::cachedImage(WebCore::CachedResourceLoader*) + 391 16 com.apple.WebCore 0x0000000110c4b7d2 WebCore::StyleResolver::loadPendingImage(WebCore::StylePendingImage*) + 66 17 com.apple.WebCore 0x0000000110c4bba7 WebCore::StyleResolver::loadPendingImages() + 759 18 com.apple.WebCore 0x0000000110c3ea7b WebCore::StyleResolver::applyMatchedProperties(WebCore::StyleResolver::MatchResult const&, WebCore::Element const*) + 1019 19 com.apple.WebCore 0x0000000110c3b008 WebCore::StyleResolver::styleForElement(WebCore::Element*, WebCore::RenderStyle*, WebCore::StyleSharingBehavior, WebCore::RuleMatchingBehavior, WebCore::RenderRegion*) + 1288 20 com.apple.WebCore 0x00000001101f347a WebCore::Document::styleForElementIgnoringPendingStylesheets(WebCore::Element*) + 170 21 com.apple.WebCore 0x000000011033a0f8 WebCore::Element::computedStyle(WebCore::PseudoId) + 200 22 com.apple.WebCore 0x000000011011e314 WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue(WebCore::CSSPropertyID, WebCore::EUpdateLayout) const + 788 23 com.apple.WebCore 0x0000000110133d56 WebCore::CSSComputedStyleDeclaration::getPropertyCSSValueInternal(WebCore::CSSPropertyID) + 22 24 com.apple.WebCore 0x000000011061df5c WebCore::cssPropertyGetter(JSC::ExecState*, WebCore::JSCSSStyleDeclaration*, unsigned int) + 44 25 com.apple.JavaScriptCore 0x000000010fc40ff5 operationGetByVal + 1077 26 ??? 0x00003992720e6eb7 0 + 63301141556919 27 com.apple.JavaScriptCore 0x000000010fcda1a3 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 611 28 com.apple.JavaScriptCore 0x000000010fbe0ab5 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 69 29 com.apple.WebCore 0x00000001105ec1ce WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 30 com.apple.WebCore 0x00000001106ad988 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 968 31 com.apple.WebCore 0x000000011035c41c WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul>&) + 332 32 com.apple.WebCore 0x000000011035c052 WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 402 33 com.apple.WebCore 0x000000011097463b WebCore::Node::handleLocalEvents(WebCore::Event*) + 59 34 com.apple.WebCore 0x0000000110344587 WebCore::EventContext::handleLocalEvents(WebCore::Event*) const + 87 35 com.apple.WebCore 0x0000000110345464 WebCore::EventDispatcher::dispatch() + 868 36 com.apple.WebCore 0x0000000110960759 WebCore::MouseEventDispatchMediator::dispatchEvent(WebCore::EventDispatcher*) const + 153 37 com.apple.WebCore 0x000000011034478f WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::EventDispatchMediator>) + 127 38 com.apple.WebCore 0x0000000110974fd5 WebCore::Node::dispatchMouseEvent(WebCore::PlatformMouseEvent const&, WTF::AtomicString const&, int, WebCore::Node*) + 133 39 com.apple.WebCore 0x000000011034b7e5 WebCore::EventHandler::dispatchMouseEvent(WTF::AtomicString const&, WebCore::Node*, bool, int, WebCore::PlatformMouseEvent const&, bool) + 101 40 com.apple.WebCore 0x000000011034fb8a WebCore::EventHandler::sendContextMenuEvent(WebCore::PlatformMouseEvent const&) + 378 41 com.apple.WebKit2 0x000000010f8800bf WebKit::handleMouseEvent(WebKit::WebMouseEvent const&, WebKit::WebPage*, bool) + 368 42 com.apple.WebKit2 0x000000010f87ff21 WebKit::WebPage::mouseEvent(WebKit::WebMouseEvent const&) + 127 43 com.apple.WebKit2 0x000000010f891ab8 void CoreIPC::handleMessage<Messages::WebPage::MouseEvent, WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&)>(CoreIPC::MessageDecoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&)) + 83 44 com.apple.WebKit2 0x000000010f7d3d55 CoreIPC::MessageReceiverMap::dispatchMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&) + 137 45 com.apple.WebKit2 0x000000010f8cb158 WebKit::WebProcess::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&) + 34 46 com.apple.WebKit2 0x000000010f7ad8eb CoreIPC::Connection::dispatchMessage(WTF::PassOwnPtr<CoreIPC::MessageDecoder>) + 105 47 com.apple.WebKit2 0x000000010f7af06c CoreIPC::Connection::dispatchOneMessage() + 96 48 com.apple.WebCore 0x0000000110b65ff9 WebCore::RunLoop::performWork() + 153 49 com.apple.WebCore 0x0000000110b66695 WebCore::RunLoop::performWork(void*) + 53 50 com.apple.CoreFoundation 0x00007fff93125101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 51 com.apple.CoreFoundation 0x00007fff93124a25 __CFRunLoopDoSources0 + 245 52 com.apple.CoreFoundation 0x00007fff93147dc5 __CFRunLoopRun + 789 53 com.apple.CoreFoundation 0x00007fff931476b2 CFRunLoopRunSpecific + 290 54 com.apple.HIToolbox 0x00007fff887bc0a4 RunCurrentEventLoopInMode + 209 55 com.apple.HIToolbox 0x00007fff887bbe42 ReceiveNextEventCommon + 356 56 com.apple.HIToolbox 0x00007fff887bbcd3 BlockUntilNextEventMatchingListInMode + 62 57 com.apple.AppKit 0x00007fff8d474613 _DPSNextEvent + 685 58 com.apple.AppKit 0x00007fff8d473ed2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128 59 com.apple.AppKit 0x00007fff8d46b283 -[NSApplication run] + 517 60 com.apple.WebCore 0x0000000110b66c7d WebCore::RunLoop::run() + 77 61 com.apple.WebKit2 0x000000010f841b1d int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebContentProcessMainDelegate>(int, char**) + 631 62 com.apple.WebProcess 0x000000010f765e43 main + 307 63 libdyld.dylib 0x00007fff881067e1 start + 1 Crashlog variation #2: Process: WebProcess [353] Path: /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Identifier: com.apple.WebProcess Version: 537+ (537.33+) Code Type: X86-64 (Native) Parent Process: ??? [1] User ID: 501 Date/Time: 2013-03-07 14:49:17.918 -0500 OS Version: Mac OS X 10.8.2 (12C60) Report Version: 10 Interval Since Last Report: 173816 sec Crashes Since Last Report: 1 Per-App Interval Since Last Report: 82318 sec Per-App Crashes Since Last Report: 1 Anonymous UUID: C466B893-E23D-5DDB-311F-3C6DD0BACE7A Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef VM Regions Near 0xbbadbeef: --> __TEXT 0000000106a44000-0000000106a45000 [ 4K] r-x/rwx SM=COW /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Application Specific Information: Bundle controller class: BrowserBundleController Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000106ece900 JSC::CodeBlock::lineNumberForBytecodeOffset(unsigned int) + 48 1 com.apple.JavaScriptCore 0x0000000106fb84cb JSC::Interpreter::getStackTrace(JSC::JSGlobalData*, WTF::Vector<JSC::StackFrame, 0ul>&) + 155 2 com.apple.WebCore 0x0000000107e52d4f WebCore::createScriptCallStack(unsigned long, bool) + 127 3 com.apple.WebCore 0x0000000107892d6b WebCore::InspectorResourceAgent::buildInitiatorObject(WebCore::Document*) + 43 4 com.apple.WebCore 0x000000010789295c WebCore::InspectorResourceAgent::willSendRequest(unsigned long, WebCore::DocumentLoader*, WebCore::ResourceRequest&, WebCore::ResourceResponse const&) + 924 5 com.apple.WebCore 0x0000000107e3555c WebCore::ResourceLoadNotifier::dispatchWillSendRequest(WebCore::DocumentLoader*, unsigned long, WebCore::ResourceRequest&, WebCore::ResourceResponse const&) + 284 6 com.apple.WebCore 0x0000000107692fe7 WebCore::FrameLoader::requestFromDelegate(WebCore::ResourceRequest&, unsigned long&, WebCore::ResourceError&) + 215 7 com.apple.WebCore 0x00000001076970ee WebCore::FrameLoader::loadedResourceFromMemoryCache(WebCore::CachedResource*) + 670 8 com.apple.WebCore 0x000000010739583b WebCore::CachedResourceLoader::requestResource(WebCore::CachedResource::Type, WebCore::CachedResourceRequest&) + 1019 9 com.apple.WebCore 0x0000000107395138 WebCore::CachedResourceLoader::requestImage(WebCore::CachedResourceRequest&) + 376 10 com.apple.WebCore 0x00000001074376f7 WebCore::CSSImageValue::cachedImage(WebCore::CachedResourceLoader*) + 391 11 com.apple.WebCore 0x0000000107f2ad82 WebCore::StyleResolver::loadPendingImage(WebCore::StylePendingImage*) + 66 12 com.apple.WebCore 0x0000000107f2b157 WebCore::StyleResolver::loadPendingImages() + 759 13 com.apple.WebCore 0x0000000107f1e1ea WebCore::StyleResolver::applyMatchedProperties(WebCore::StyleResolver::MatchResult const&, WebCore::Element const*) + 1018 14 com.apple.WebCore 0x0000000107f1a782 WebCore::StyleResolver::styleForElement(WebCore::Element*, WebCore::RenderStyle*, WebCore::StyleSharingBehavior, WebCore::RuleMatchingBehavior, WebCore::RenderRegion*) + 1282 15 com.apple.WebCore 0x00000001074d4cc7 WebCore::Document::styleForElementIgnoringPendingStylesheets(WebCore::Element*) + 167 16 com.apple.WebCore 0x000000010761b528 WebCore::Element::computedStyle(WebCore::PseudoId) + 200 17 com.apple.WebCore 0x00000001073fefef WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue(WebCore::CSSPropertyID, WebCore::EUpdateLayout) const + 767 18 com.apple.WebCore 0x0000000107414b56 WebCore::CSSComputedStyleDeclaration::getPropertyCSSValueInternal(WebCore::CSSPropertyID) + 22 19 com.apple.WebCore 0x00000001079024fc WebCore::cssPropertyGetter(JSC::ExecState*, WebCore::JSCSSStyleDeclaration*, unsigned int) + 44 20 com.apple.JavaScriptCore 0x0000000106f21696 operationGetByVal + 1078 21 ??? 0x000045655866e077 0 + 76301577150583 22 com.apple.JavaScriptCore 0x0000000106fbacd3 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 611 23 com.apple.JavaScriptCore 0x0000000106ec0c95 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 69 24 com.apple.WebCore 0x00000001078d076e WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 25 com.apple.WebCore 0x0000000107991f28 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 968 26 com.apple.WebCore 0x000000010763d93c WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul>&) + 332 27 com.apple.WebCore 0x000000010763d572 WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 402 28 com.apple.WebCore 0x0000000107c58bfb WebCore::Node::handleLocalEvents(WebCore::Event*) + 59 29 com.apple.WebCore 0x0000000107625ab7 WebCore::EventContext::handleLocalEvents(WebCore::Event*) const + 87 30 com.apple.WebCore 0x00000001076269a4 WebCore::EventDispatcher::dispatch() + 868 31 com.apple.WebCore 0x0000000107c44f09 WebCore::MouseEventDispatchMediator::dispatchEvent(WebCore::EventDispatcher*) const + 153 32 com.apple.WebCore 0x0000000107625ccf WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::EventDispatchMediator>) + 127 33 com.apple.WebCore 0x0000000107c59595 WebCore::Node::dispatchMouseEvent(WebCore::PlatformMouseEvent const&, WTF::AtomicString const&, int, WebCore::Node*) + 133 34 com.apple.WebCore 0x000000010762cd25 WebCore::EventHandler::dispatchMouseEvent(WTF::AtomicString const&, WebCore::Node*, bool, int, WebCore::PlatformMouseEvent const&, bool) + 101 35 com.apple.WebCore 0x00000001076310ba WebCore::EventHandler::sendContextMenuEvent(WebCore::PlatformMouseEvent const&) + 378 36 com.apple.WebKit2 0x0000000106b5fe0f WebKit::handleMouseEvent(WebKit::WebMouseEvent const&, WebKit::WebPage*, bool) + 368 37 com.apple.WebKit2 0x0000000106b5fc71 WebKit::WebPage::mouseEvent(WebKit::WebMouseEvent const&) + 127 38 com.apple.WebKit2 0x0000000106b71808 void CoreIPC::handleMessage<Messages::WebPage::MouseEvent, WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&)>(CoreIPC::MessageDecoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&)) + 83 39 com.apple.WebKit2 0x0000000106ab3789 CoreIPC::MessageReceiverMap::dispatchMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&) + 137 40 com.apple.WebKit2 0x0000000106baae6c WebKit::WebProcess::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&) + 34 41 com.apple.WebKit2 0x0000000106a8d287 CoreIPC::Connection::dispatchMessage(WTF::PassOwnPtr<CoreIPC::MessageDecoder>) + 105 42 com.apple.WebKit2 0x0000000106a8ea08 CoreIPC::Connection::dispatchOneMessage() + 96 43 com.apple.WebCore 0x0000000107e49dd9 WebCore::RunLoop::performWork() + 153 44 com.apple.WebCore 0x0000000107e4a475 WebCore::RunLoop::performWork(void*) + 53 45 com.apple.CoreFoundation 0x00007fff91caa101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 46 com.apple.CoreFoundation 0x00007fff91ca9a25 __CFRunLoopDoSources0 + 245 47 com.apple.CoreFoundation 0x00007fff91cccdc5 __CFRunLoopRun + 789 48 com.apple.CoreFoundation 0x00007fff91ccc6b2 CFRunLoopRunSpecific + 290 49 com.apple.HIToolbox 0x00007fff873410a4 RunCurrentEventLoopInMode + 209 50 com.apple.HIToolbox 0x00007fff87340e42 ReceiveNextEventCommon + 356 51 com.apple.HIToolbox 0x00007fff87340cd3 BlockUntilNextEventMatchingListInMode + 62 52 com.apple.AppKit 0x00007fff8bff9613 _DPSNextEvent + 685 53 com.apple.AppKit 0x00007fff8bff8ed2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128 54 com.apple.AppKit 0x00007fff8bff0283 -[NSApplication run] + 517 55 com.apple.WebCore 0x0000000107e4aa5d WebCore::RunLoop::run() + 77 56 com.apple.WebKit2 0x0000000106b21945 int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebContentProcessMainDelegate>(int, char**) + 631 57 com.apple.WebProcess 0x0000000106a44e43 main + 307 58 libdyld.dylib 0x00007fff86c8b7e1 start + 1
Attachments
Add attachment proposed patch, testcase, etc.
Note You need to log in before you can comment on or make changes to this bug.