Bug 20391 - REGRESSION (r35417-r35531): Crash in Machine.cpp:1838 when leaving GAFYD GMail
Summary: REGRESSION (r35417-r35531): Crash in Machine.cpp:1838 when leaving GAFYD GMail
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (Intel) OS X 10.5
: P1 Normal
Assignee: Cameron Zwarich (cpst)
URL:
Keywords: InRadar, Regression
Depends on:
Blocks:
 
Reported: 2008-08-14 22:52 PDT by Ian 'Hixie' Hickson
Modified: 2008-08-22 21:05 PDT (History)
5 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ian 'Hixie' Hickson 2008-08-14 22:52:38 PDT 
STEPS TO REPRODUCE
1. Log in to Google Apps For Your Domain GMail
2. Reload, navigate away, or otherwise cause the page to unload.

ACTUAL RESULTS
Crash.

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000004

Stack trace: http://pastebin.com/f51ea9e1d

<bdash> Machine.cpp:1838 is where the crash is happening
Comment 1 Geoffrey Garen 2008-08-14 22:55:55 PDT 
Very similar to https://bugs.webkit.org/show_bug.cgi?id=20386.
Comment 2 Ian 'Hixie' Hickson 2008-08-14 22:56:08 PDT 
Doesn't crash in r35417
Does crash in r35531
Comment 3 Mark Rowe (bdash) 2008-08-14 23:15:46 PDT 
Line 1838 is:

        r[dst] = scope->registerAt(index);

The disassembly indicates that the crash is due to "scope" being 0.
Comment 4 Mark Rowe (bdash) 2008-08-15 04:37:13 PDT 
<rdar://problem/6152195>
Comment 5 Cameron Zwarich (cpst) 2008-08-16 14:30:57 PDT 
This is a reproducible crash, so it should be P1. I am also assigning it to myself.
Comment 6 Cameron Zwarich (cpst) 2008-08-17 04:00:50 PDT 
Since this seems so similar to bug 20386, it seems like the regression is caused by r35445, but I have no way of testing myself. I'll try to fix bug 20386, and see if the fix also works for this bug.
Comment 7 Oliver Hunt 2008-08-17 16:43:35 PDT 
bug 20386 is now fixed (r35812) so this may be fixed. Hixie can you check?
Comment 8 Cameron Zwarich (cpst) 2008-08-22 21:05:20 PDT 
Ian said that this was indeed fixed.