Visiting http://www.ge.com/ causes an assertion failure:
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef
Crashed Thread: 0
Thread 0 Crashed:
8 com.apple.WebCore 0x03a12044 WebCore::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 786 (JSEventListener.cpp:109)
9 com.apple.WebCore 0x034db77d WebCore::Document::handleWindowEvent(WebCore::Event*, bool) + 281 (Document.cpp:2699)
10 com.apple.WebCore 0x0354250e WebCore::EventTargetNode::dispatchWindowEvent(WTF::PassRefPtr<WebCore::Event>) + 272 (EventTargetNode.cpp:409)
11 com.apple.WebCore 0x035455e3 WebCore::EventTargetNode::dispatchWindowEvent(WebCore::AtomicString const&, bool, bool) + 175 (EventTargetNode.cpp:416)
12 com.apple.WebCore 0x034e79e4 WebCore::Document::implicitClose() + 736 (Document.cpp:1562)
I can reproduce this with a local debug build of r38826, and I am assigning this to myself.
Created attachment 25565 [details]
Here is a partial reduction. It still loads 2 JS files from GE's site, as well as whatever files they dynamically load. For some reason, it goes wonky but doesn't crash if I just copy the source of those files. I should be able to make a reduction by making local copies of these files and chopping them apart.
It seems that GE does some referrer checking, so you need to download a local copy of that.
I have a reduction:
I suspect that this is a recent regression due to changes in WREC.
I didn't have to look far for this one. This regressed in r38745:
I am unassigning this. Geoff, you are probably a better person to fix this than me.
New reduction: "a".match(/b|[^b]/g)
Created attachment 25699 [details]
Comment on attachment 25699 [details]
The test should be in the "new style" with the .html file in fast/js and the .js file in fast/js/resources. Other than that, r=me.
Committed revision 38929.