Bug 15731 - REGRESSION(r27176): Reproducible crash while trying to order dinner makes bdash sad
Summary: REGRESSION(r27176): Reproducible crash while trying to order dinner makes bda...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 523.x (Safari 3)
Hardware: Mac OS X 10.5
: P1 Major
Assignee: Maciej Stachowiak
URL:
Keywords: HasReduction, Regression
Depends on:
Blocks:
 
Reported: 2007-10-28 02:28 PDT by Mark Rowe (bdash)
Modified: 2007-10-28 18:42 PDT (History)
1 user (show)

See Also:

Attachments
Crash log (29.70 KB, text/plain)
2007-10-28 02:29 PDT, Mark Rowe (bdash) 		no flags Details
Reduction from Comment #7 (107 bytes, text/html)
2007-10-28 16:45 PDT, David Kilzer (:ddkilzer) 		no flags Details
let bdash have dinner (5.77 KB, patch)
2007-10-28 18:31 PDT, Maciej Stachowiak 		mrowe: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Rowe (bdash) 2007-10-28 02:28:15 PDT 
Steps to reproduce:
1. Visit http://www.menulog.com.au/search.php?submit2=T&searchMode=takeaway&cartType=delivery&majorRegionId=28&postcode=2010
2. Click the "Order" button alongside one of the restaurants that prepares yummy food.
3. Click "Order Delivery".
4. Click on "Surry Hills - 2010" so that the food can be delivered to me.

Expected results:
Tasty food delivered to my door.

Actual results:
Crash after step 5.

Notes:
This worked as recently as last Wednesday.
Comment 1 Mark Rowe (bdash) 2007-10-28 02:29:19 PDT 
Created attachment 16911 [details]
Crash log
Comment 2 Mark Rowe (bdash) 2007-10-28 02:30:21 PDT 
Top of the crash log for easy reference:

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000000
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.WebCore             	0x01e7838c KJS::Window::pauseTimeouts() + 248 (kjs_window.cpp:1564)
1   com.apple.WebCore             	0x020a15af WebCore::CachedPage::CachedPage(WebCore::Page*) + 615 (CachedPage.cpp:101)
2   com.apple.WebCore             	0x020a1668 WebCore::CachedPage::CachedPage(WebCore::Page*) + 24 (CachedPage.cpp:110)
3   com.apple.WebCore             	0x020a169b WebCore::CachedPage::create(WebCore::Page*) + 49 (CachedPage.cpp:72)
Comment 3 Mark Rowe (bdash) 2007-10-28 02:32:44 PDT 
> Actual results:
> Crash after step 5.

This should have said step 4.
Comment 4 Eric Seidel (no email) 2007-10-28 02:34:24 PDT 
Doesn't crash for me in a debug build.
Comment 5 Mark Rowe (bdash) 2007-10-28 02:35:31 PDT 
Hrm, in step 2 try the second restaurant in the list, "Foodgame".  Some others appear to not crash.
Comment 6 Mark Rowe (bdash) 2007-10-28 05:09:18 PDT 
"git bisect" has narrowed this down to Maciej's HashTable change in http://trac.webkit.org/projects/webkit/changeset/27176.  Previous revisions do not crash.
Comment 7 John Moe 2007-10-28 13:11:00 PDT 
Reduction:
<script>
setTimeout('',1000);
clearTimeout(0);
clearTimeout(0);
window.location = 'about:blank';
</script>

In pauseTimeouts, d->m_timeouts.size() is returning a negative number.
Comment 8 David Kilzer (:ddkilzer) 2007-10-28 16:45:39 PDT 
Created attachment 16924 [details]
Reduction from Comment #7
Comment 9 David Kilzer (:ddkilzer) 2007-10-28 16:46:17 PDT 
(In reply to comment #7)
> Reduction: [...[
> 
> In pauseTimeouts, d->m_timeouts.size() is returning a negative number.

Thanks, John!
Comment 10 Maciej Stachowiak 2007-10-28 18:31:14 PDT 
Created attachment 16929 [details]
let bdash have dinner
Comment 11 Mark Rowe (bdash) 2007-10-28 18:35:38 PDT 
Comment on attachment 16929 [details]
let bdash have dinner

r=me