Bug 26055 – [Gtk] Webkit crash in JIT-ed JavaScript

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Chip Black]

On r44174, WebKit crashes on http://dominionofawesome.com/cryptobox/ when the "Encrypt" button is clicked. When I compile WebKit without JIT support, output appears in the Ciphertext box (and obviously it doesn't crash). I've tried to track down the bug, but with or without debugging enabled, every backtrace looks like this:

#0  0xb768ec63 in ctiVMThrowTrampoline () from /usr/lib/libwebkit-1.0.so.2
#1  0xb52c4100 in ?? ()
#2  0xbfd2c07c in ?? ()
#3  0xc5c00000 in ?? ()
#4  0xb768e8ee in ctiVMThrowTrampoline () from /usr/lib/libwebkit-1.0.so.2
#5  0xb3bfb6e0 in ?? ()
#6  0x00000000 in ?? ()

I'm hoping you guys can figure it out, because it's inscrutable to me. :)  I've tested this inside of both uzbl and Midori, and it crashes in both.

[Alexey Proskuryakov]

FWIW, this doesn't crash for me on Mac OS X with a debug build of r44217.

[Jan Alonzo]

Hi Chip, I've tested r44256 (latest as of 29/05/2009) and this seems to work now. WebKitGtk 1.1.8 was also release a few hours ago and it maybe worth to use that version if you're using a release copy of WebKitGtk.

Thanks for the bug.

[Chip Black]

Still failing for me in the same way. :(

[Jan Alonzo]

(In reply to comment #3)
> Still failing for me in the same way. :(
> 

Are you able to attach a backtrace? 

[Chip Black]

The backtrace looks identical to the one above. I have updated my svn and I will try it again to see if anything has changed.

[Jan Alonzo]

(In reply to comment #5)
> The backtrace looks identical to the one above. I have updated my svn and I
> will try it again to see if anything has changed.

Can you please try with WebKitGtk 1.1.11 and using the GtkLauncher? Thanks.

[Chip Black]

Much to my surprise, the problem has gone away. Thanks!

[Jan Alonzo]

The issue is confirmed fixed in WebKitGtk 1.1.11. Closing.