Bug 19107 - SquirrelFish: Crash marking array
Summary: SquirrelFish: Crash marking array
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Macintosh OS X 10.5
: P1 Critical
Assignee: Nobody
Depends on:
Reported: 2008-05-17 00:43 PDT by Oliver Hunt
Modified: 2010-03-18 13:25 PDT (History)
5 users (show)

See Also:

WebArchive of crashing page. (877.83 KB, application/octet-stream)
2008-05-17 00:45 PDT, Oliver Hunt
no flags Details
Stack trace (14.89 KB, text/plain)
2008-05-19 22:02 PDT, Cameron Zwarich (cpst)
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2008-05-17 00:43:44 PDT
Reload the attached webarchive repeatedly and eventually we crash in gc :-/
Comment 1 Oliver Hunt 2008-05-17 00:45:44 PDT
Created attachment 21211 [details]
WebArchive of crashing page.
Comment 2 Oliver Hunt 2008-05-17 00:46:03 PDT
(remove autocompleted blocker keyword. again.)
Comment 3 Cameron Zwarich (cpst) 2008-05-17 22:49:59 PDT
I'll take this one on for the time being.
Comment 4 Geoffrey Garen 2008-05-19 21:27:42 PDT
Why isn't this a blocker?
Comment 5 Cameron Zwarich (cpst) 2008-05-19 22:02:03 PDT
Created attachment 21248 [details]
Stack trace

If I set it to collect every allocation, it won't crash on the first load. If I wait to let it finish loading and reload, it will repeatably crash with this stack trace.
Comment 6 Cameron Zwarich (cpst) 2008-06-06 22:26:41 PDT
This still crashes on reload when set to always GC, but not in JavaScriptCore, so I'm unassigning it.
Comment 7 Alexey Proskuryakov 2008-07-28 03:10:06 PDT
I cannot reproduce the crash with r35406, even with COLLECT_ON_EVERY_ALLOCATION set to 1. However, I'm getting many errors on the console, some of them not on every reload.

ERROR: called Frame::paint with nil renderer
(/Users/ap/Safari/OpenSource/WebCore/page/Frame.cpp:1369 void WebCore::Frame::paint(WebCore::GraphicsContext*, const WebCore::IntRect&))
http://kona.kontera.com/javascript/lib/KonaLibBaseRM.js?00000000180:1: JS ERROR: TypeError: Result of expression 'E6aPm' [null] is not an object.
http://kona.kontera.com/javascript/lib/KonaLibBaseRM.js?00000000180:1: JS ERROR: TypeError: Result of expression 'E6aPm' [null] is not an object.
http://kona2.kontera.com/KonaGet.js?u=1217239662475&p=16871&k=B.attniIvleshteovteetyeneeeytdsoytlgnhynlecuaoghecitinyqdlvnyooi.sttuvttotuausyt.torrgudletkaMOZILLA&al=1&l=http%3A//www.bspcn.com/2007/10/06/how-to-answer-23-of-the-most-common-interview-questions/&t=How+to+answer+23+of+the+most+common+interview+questions+%7C+The+Best+Article+Every+day&m2=The+Best+Article+Every+day+Bspcn.Com+Home+About+Contact+Archives+Random+Post+Get+Firefox+Download+Pi&rId=16871_1217239662475_032214998826384544&i=14&n=0&dc_aff_id=&cl=0&mp=0&rm=1&mod=451&rt=0&st=1&add=FlashVer_Shockwave%20Flash%209.0%20r124|user_|session_:1: JS ERROR: SyntaxError: Parse error