Bug 22924 - JSC::JIT::privateCompilePutByIdTransition crash on gmail
Summary: JSC::JIT::privateCompilePutByIdTransition crash on gmail
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P2 Normal
Assignee: Nobody
URL: http://gmail.com
Keywords:
Depends on:
Blocks:
 
Reported: 2008-12-18 15:28 PST by Andrew Wellington
Modified: 2008-12-22 23:15 PST (History)
2 users (show)

See Also:

Attachments
Crash report (30.43 KB, text/plain)
2008-12-18 15:29 PST, Andrew Wellington 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Wellington 2008-12-18 15:28:34 PST 
Reproducible in r39370 Nightly.

STEPS TO REPRODUCE
1. Login to Gmail at http://gmail.com/
2. Immediately upon mailbox list appearing start scrolling the page up and down with scrollwheel.

RESULT
Crash. Crash report to be attached.
Comment 1 Andrew Wellington 2008-12-18 15:29:17 PST 
Created attachment 26130 [details]
Crash report
Comment 2 d235j.1 2008-12-19 10:10:36 PST 
I can confirm this.
Comment 3 Gavin Barraclough 2008-12-22 23:15:06 PST 
I couldn't repro this bug on X, but I think this dupes a Windows bug fixed by:

    https://bugs.webkit.org/show_bug.cgi?id=22974

Since I can't repro I'll assume this is fixed in the same change, please reopen if you continue to experience the problem after r39450.

Cheers,
G.