Loading any media page on <http://www.filehurricane.com/> (load the URL and click any item on the homepage) hits an ASSERT coming from <http://trac.webkit.org/browser/trunk/JavaScriptCore/VM/Machine.cpp?rev=35640#L2781> ASSERTION FAILED: i < size() (./wtf/Vector.h:439 T& WTF::Vector<T, inlineCapacity>::at(size_t) [with T = KJS::JSValue*, long unsigned int inlineCapacity = 0ul]) Thread 0 Crashed: 0 com.apple.JavaScriptCore 0x004fe4bf WTF::Vector<KJS::JSValue*, 0ul>::at(unsigned long) + 81 (Vector.h:439) 1 com.apple.JavaScriptCore 0x004fe4fc WTF::Vector<KJS::JSValue*, 0ul>::operator[](unsigned long) + 24 (Vector.h:448) 2 com.apple.JavaScriptCore 0x004faab2 KJS::Machine::privateExecute(KJS::Machine::ExecutionFlag, KJS::ExecState*, KJS::RegisterFile*, KJS::Register*, KJS::ScopeChainNode*, KJS::CodeBlock*, KJS::JSValue**) + 34414 (Machine.cpp:2781) 3 com.apple.JavaScriptCore 0x004fbf22 KJS::Machine::execute(KJS::ProgramNode*, KJS::ExecState*, KJS::ScopeChainNode*, KJS::JSObject*, KJS::JSValue**) + 698 (Machine.cpp:785) 4 com.apple.JavaScriptCore 0x00494bd9 KJS::Interpreter::evaluate(KJS::ExecState*, KJS::ScopeChain&, KJS::UString const&, int, WTF::PassRefPtr<KJS::SourceProvider>, KJS::JSValue*) + 409 (interpreter.cpp:78) 5 com.apple.WebCore 0x037f22a7 WebCore::ScriptController::evaluate(WebCore::String const&, int, WebCore::String const&) + 249 (ScriptController.cpp:112) 6 com.apple.WebCore 0x03383903 WebCore::FrameLoader::executeScript(WebCore::String const&, int, WebCore::String const&) + 153 (FrameLoader.cpp:787) 7 com.apple.WebCore 0x03415476 WebCore::HTMLTokenizer::scriptExecution(WebCore::String const&, WebCore::HTMLTokenizer::State, WebCore::String const&, int) + 300 (HTMLTokenizer.cpp:547) 8 com.apple.WebCore 0x034158c4 WebCore::HTMLTokenizer::notifyFinished(WebCore::CachedResource*) + 600 (HTMLTokenizer.cpp:1994) 9 com.apple.WebCore 0x031c7088 WebCore::CachedScript::checkNotify() + 68 (CachedScript.cpp:92) 10 com.apple.WebCore 0x031c71e9 WebCore::CachedScript::data(WTF::PassRefPtr<WebCore::SharedBuffer>, bool) + 279 (CachedScript.cpp:84)
That's not good. I'll assign this to myself.
1) This doesn't actually crash in a release build (r35641 nightly). 2) I've narrowed it down to the file <http://filehurricane.com/ScriptResource.axd?d=Jk6eFL2oyqXuZsKToyn_TnFngeTB5WBWbchvVHNKADewHLoypStd1H_VInlzL52wsLdiUZDyfvhggbm_oCgaqtGEuqd422VOX7p4jbTGbYo1&t=633449716710937500> - though it's 7500 lines entangled fun.
Created attachment 22717 [details] Reduction Here's a reduction. I'll try to make one that crashes on the console as well, but this is good for a start.
Created attachment 22718 [details] Further reduction This one also works with the JS shell.
Created attachment 22719 [details] Proposed patch
Comment on attachment 22719 [details] Proposed patch r=me, assuming you include the testcase as a layout test
Landed in r35651.