Bug 127547 - Crash in JSC::UnwindFunctor::operator()(JSC::StackVisitor&)
Summary: Crash in JSC::UnwindFunctor::operator()(JSC::StackVisitor&)
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (Intel) OS X 10.9
: P2 Normal
Assignee: Nobody
URL: http://ultrarunnerpodcast.com/oz-pear...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-01-23 23:04 PST by Dimitris Apostolou
Modified: 2016-01-06 19:30 PST (History)
1 user (show)

See Also:

Attachments
Crash log (56.69 KB, application/octet-stream)
2014-01-23 23:04 PST, Dimitris Apostolou 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Dimitris Apostolou 2014-01-23 23:04:07 PST 
Created attachment 222081 [details]
Crash log

r162657

Reproducibility: always

Steps:
http://ultrarunnerpodcast.com/oz-pearlman-interview/

What happened:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x000000010e2140f9 JSC::UnwindFunctor::operator()(JSC::StackVisitor&) + 265
1   com.apple.JavaScriptCore      	0x000000010e211dcb JSC::Interpreter::unwind(JSC::ExecState*&, JSC::JSValue&) + 523
2   com.apple.JavaScriptCore      	0x000000010e238efd JSC::genericUnwind(JSC::VM*, JSC::ExecState*, JSC::JSValue) + 45
3   com.apple.JavaScriptCore      	0x000000010e31f0d5 llint_slow_path_handle_exception + 53
4   com.apple.JavaScriptCore      	0x000000010e323716 llint_throw_from_slow_path_trampoline + 15
5   com.apple.JavaScriptCore      	0x000000010e320c0d callToJavaScript + 194
6   com.apple.JavaScriptCore      	0x000000010e237aa0 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*, JSC::Register*) + 48
7   com.apple.JavaScriptCore      	0x000000010e2132b8 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 680
8   com.apple.JavaScriptCore      	0x000000010e0c135e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62
9   com.apple.JavaScriptCore      	0x000000010e28c991 JSC::boundFunctionCall(JSC::ExecState*) + 577
10  com.apple.JavaScriptCore      	0x000000010e320cfa callToNativeFunction + 200
11  ???                           	0x000000011070ffd0 0 + 4570808272
12  com.apple.JavaScriptCore      	0x000000010e213302 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 754
13  com.apple.JavaScriptCore      	0x000000010e0c135e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62
14  com.apple.WebCore             	0x000000010ed0a437 WebCore::JSMutationCallback::call(WTF::Vector<WTF::RefPtr<WebCore::MutationRecord>, 0ul, WTF::CrashOnOverflow> const&, WebCore::MutationObserver*) + 567
15  com.apple.WebCore             	0x000000010eef5276 WebCore::MutationObserver::deliver() + 406
16  com.apple.WebCore             	0x000000010eef56f7 WebCore::MutationObserver::deliverAllMutations() + 951
17  com.apple.WebCore             	0x000000010ec489e7 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 919
18  com.apple.WebCore             	0x000000010e90046e WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul, WTF::CrashOnOverflow>&) + 750
19  com.apple.WebCore             	0x000000010e900015 WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 181
20  com.apple.WebCore             	0x000000010e8eae27 WebCore::EventContext::handleLocalEvents(WebCore::Event&) const + 87
21  com.apple.WebCore             	0x000000010e8eba8a WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::Event>) + 954
22  com.apple.WebCore             	0x000000010ef05ead WebCore::Node::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) + 29
23  com.apple.WebCore             	0x000000010e82a23b WebCore::Document::finishedParsing() + 123
24  com.apple.WebCore             	0x000000010e9f76f6 WebCore::HTMLDocumentParser::prepareToStopParsing() + 166
25  com.apple.WebCore             	0x000000010e9f7b31 WebCore::HTMLDocumentParser::resumeParsingAfterYield() + 129
26  com.apple.WebCore             	0x000000010f27fa8f WebCore::ThreadTimers::sharedTimerFiredInternal() + 175
27  com.apple.WebCore             	0x000000010f134ada WebCore::timerFired(__CFRunLoopTimer*, void*) + 58
28  com.apple.CoreFoundation      	0x00007fff8b8f4564 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
29  com.apple.CoreFoundation      	0x00007fff8b8f409f __CFRunLoopDoTimer + 1151
30  com.apple.CoreFoundation      	0x00007fff8b9655aa __CFRunLoopDoTimers + 298
31  com.apple.CoreFoundation      	0x00007fff8b8af8e5 __CFRunLoopRun + 1525
32  com.apple.CoreFoundation      	0x00007fff8b8af0b5 CFRunLoopRunSpecific + 309
33  com.apple.HIToolbox           	0x00007fff921caa0d RunCurrentEventLoopInMode + 226
34  com.apple.HIToolbox           	0x00007fff921ca7b7 ReceiveNextEventCommon + 479
35  com.apple.HIToolbox           	0x00007fff921ca5bc _BlockUntilNextEventMatchingListInModeWithFilter + 65
36  com.apple.AppKit              	0x00007fff8ca8f4ce _DPSNextEvent + 1434
37  com.apple.AppKit              	0x00007fff8ca8eb1b -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122
38  com.apple.AppKit              	0x00007fff8ca82c1c -[NSApplication run] + 553
39  com.apple.AppKit              	0x00007fff8ca6da03 NSApplicationMain + 940
40  com.apple.XPCService          	0x00007fff91f0ac0f _xpc_main + 385
41  libxpc.dylib                  	0x00007fff88e82bde xpc_main + 399
42  com.apple.WebKit.WebContent.Development	0x000000010ab616a0 main + 16
43  libdyld.dylib                 	0x00007fff8da285fd start + 1

Expected result:
Webkit does not crash.
Comment 1 Mark Wang 2015-12-13 17:58:27 PST 
This issue also can be reproduced on our STB platform. Does someone have a workaround patch?
Comment 2 Mark Wang 2016-01-06 19:30:34 PST 
This issue is the duplicated issue of https://bugs.webkit.org/show_bug.cgi?id=131530, so it can be closed.