Bug 25680 - REGRESSION(r43432): Many JavaScriptCore tests crash in 64-bit
Summary: REGRESSION(r43432): Many JavaScriptCore tests crash in 64-bit
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P1 Normal
Assignee: Maciej Stachowiak
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2009-05-10 19:07 PDT by Mark Rowe (bdash)
Modified: 2009-05-11 00:21 PDT (History)
1 user (show)

See Also:


Attachments
the fix (4.29 KB, patch)
2009-05-10 23:04 PDT, Maciej Stachowiak
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Rowe (bdash) 2009-05-10 19:07:35 PDT
In r43431 there are no JavaScriptCore test failures in 64-bit.  In r43432 there are 111 regressions, all of which appear to be crashes.

Backtrace at point of crash looks a little bit like the following:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x0000000100091928 in WTF::RefPtr<JSC::UString::Rep>::get (this=0x0) at RefPtr.h:54
54	        T* get() const { return m_ptr; }
(gdb) bt
#0  0x0000000100091928 in WTF::RefPtr<JSC::UString::Rep>::get (this=0x0) at RefPtr.h:54
#1  0x0000000100091a27 in WTF::operator==<JSC::UString::Rep, JSC::UString::BaseString> (a=@0x0, b=0x100a05120) at RefPtr.h:161
#2  0x0000000100091a57 in JSC::UString::isNull (this=0x0) at UString.h:292
#3  0x0000000100091a71 in JSC::Identifier::isNull (this=0x0) at Identifier.h:58
#4  0x00000001000b5a87 in JSC::Structure::get (this=0x10210f710, propertyName=@0x0) at Structure.h:179
#5  0x00000001000b5c6d in JSC::JSObject::getDirectLocation (this=0x1009f6680, propertyName=@0x0) at JSObject.h:140
#6  0x00000001000b5cc0 in JSC::JSObject::inlineGetOwnPropertySlot (this=0x1009f6680, exec=0x100b10048, propertyName=@0x0, slot=@0x5b084c87) at JSObject.h:297
#7  0x00000001000b5dc9 in JSC::JSObject::getOwnPropertySlot (this=0x1009f6680, exec=0x100b10048, propertyName=@0x0, slot=@0x5b084c87) at JSObject.h:343
#8  0x000000010009ebc6 in JSC::JSValue::toPrimitive (this=0x7fff5fbff150, exec=0x100b10048, preferredType=JSC::NoPreference) at JSCell.h:241
#9  0x00000001001224d5 in JSC::JITStubs::cti_op_to_primitive (args=0x7fff5fbff180) at JavaScriptCore/jit/JITStubs.cpp:2230
Comment 1 Mark Rowe (bdash) 2009-05-10 19:09:05 PDT
<rdar://problem/6873682>
Comment 2 Maciej Stachowiak 2009-05-10 23:04:46 PDT
Created attachment 30174 [details]
the fix
Comment 3 Geoffrey Garen 2009-05-10 23:05:53 PDT
Comment on attachment 30174 [details]
the fix

r=me