Select this site and it will crash in seconds http://www.foxnews.com/specialreport/index.html I am using Webkit build r38386
Confirmed with r38440: ASSERTION FAILED: Not enough jumps linked in slow case codegen. (iter + 1) == m_slowCases.end() || firstTo != (iter + 1)->to (/Users/matt/Code/WebKit/JavaScriptCore/VM/CTI.cpp:2995 void JSC::CTI::privateCompileSlowCases()) Thread 0 Crashed: 0 com.apple.JavaScriptCore 0x0057293e JSC::CTI::privateCompileSlowCases() + 15856 (CTI.cpp:2995) 1 com.apple.JavaScriptCore 0x0057aa77 JSC::CTI::privateCompile() + 315 (CTI.cpp:3035) 2 com.apple.JavaScriptCore 0x00542ce7 JSC::CTI::compile(JSC::JSGlobalData*, JSC::CodeBlock*) + 45 (CTI.h:289) 3 com.apple.JavaScriptCore 0x00529479 JSC::BytecodeInterpreter::cti_op_call_JSFunction(void*, ...) + 211 (Machine.cpp:4693) 4 com.apple.JavaScriptCore 0x00524126 jscGeneratedNativeCode + 0 (Machine.cpp:4261) 5 com.apple.JavaScriptCore 0x0052af5d JSC::BytecodeInterpreter::execute(JSC::FunctionBodyNode*, JSC::ExecState*, JSC::JSFunction*, JSC::JSObject*, JSC::ArgList const&, JSC::ScopeChainNode*, JSC::JSValue**) + 789 (Machine.cpp:1008) 6 com.apple.JavaScriptCore 0x004805bb JSC::JSFunction::call(JSC::ExecState*, JSC::JSValue*, JSC::ArgList const&) + 139 (JSFunction.cpp:83) 7 com.apple.JavaScriptCore 0x0048066c JSC::call(JSC::ExecState*, JSC::JSValue*, JSC::CallType, JSC::CallData const&, JSC::JSValue*, JSC::ArgList const&) + 170 (CallData.cpp:39) 8 com.apple.JavaScriptCore 0x0048e48a __ZN3JSCL22functionProtoFuncApplyEPNS_9ExecStateEPNS_8JSObjectEPNS_7JSValueERKNS_7ArgListE + 684 (FunctionPrototype.cpp:113) 9 com.apple.JavaScriptCore 0x00529188 JSC::BytecodeInterpreter::cti_op_call_NotJSFunction(void*, ...) + 454 (Machine.cpp:4813) 10 com.apple.JavaScriptCore 0x00524126 jscGeneratedNativeCode + 0 (Machine.cpp:4261) 11 com.apple.JavaScriptCore 0x0052af5d JSC::BytecodeInterpreter::execute(JSC::FunctionBodyNode*, JSC::ExecState*, JSC::JSFunction*, JSC::JSObject*, JSC::ArgList const&, JSC::ScopeChainNode*, JSC::JSValue**) + 789 (Machine.cpp:1008) 12 com.apple.JavaScriptCore 0x004805bb JSC::JSFunction::call(JSC::ExecState*, JSC::JSValue*, JSC::ArgList const&) + 139 (JSFunction.cpp:83) 13 com.apple.JavaScriptCore 0x0048066c JSC::call(JSC::ExecState*, JSC::JSValue*, JSC::CallType, JSC::CallData const&, JSC::JSValue*, JSC::ArgList const&) + 170 (CallData.cpp:39) 14 com.apple.WebCore 0x039934e9 WebCore::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 793 (JSEventListener.cpp:110)
*** Bug 22291 has been marked as a duplicate of this bug. ***
I am not sure if these two are really duplicates, because it may be for two different opcodes, but thanks a lot for finding this. I'll assign this to myself.
(In reply to comment #3) > I am not sure if these two are really duplicates, because it may be for two > different opcodes, but thanks a lot for finding this. > The stack traces for both bugs are identical once they enter JSCore (frame 13 and up).
(In reply to comment #4) > The stack traces for both bugs are identical once they enter JSCore (frame 13 > and up). > Actually, I should be more specific: the stacks aren't just identical, but also have the exact same line numbers in my debug build.
(In reply to comment #5) > (In reply to comment #4) > > The stack traces for both bugs are identical once they enter JSCore (frame 13 > > and up). > > > > Actually, I should be more specific: the stacks aren't just identical, but also > have the exact same line numbers in my debug build. That one assertion that is failing is responsible for checking quite a bit of code. It is the same class of bug, but a fix for one case may not fix the other, so I just made a note here to double check the other bug that got marked as a duplicate.
Created attachment 25202 [details] Reduction Here is a reduction. It also works in the jsc shell.
This page still crashes with build r38492 http://www.foxnews.com/specialreport/index.html Animation on site does not work either http://radar.weather.gov/Conus/full_loop.php
I have a fix for this, but I might not be able to land it for a while because my MacBook Pro just died. :(
Created attachment 25242 [details] Crash log...
Created attachment 25253 [details] crash log This crash occurred with nightly build r38586
Thanks for the crash logs, but no additional crash logs are needed.
This bug (along with all of the duplicates mentioned here) was fixed in r38590.