Bug 36468 - Webkit 1.1.90 - crash in javascript
Summary: Webkit 1.1.90 - crash in javascript
Status: RESOLVED INVALID
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Linux
: P2 Critical
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-03-22 17:11 PDT by Maciej Piechotka
Modified: 2011-07-20 19:22 PDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Maciej Piechotka 2010-03-22 17:11:44 PDT
When pressing on bullet list in ask question on http://stackoverflow.com/ epiphany crashes:


Program received signal SIGSEGV, Segmentation fault.
match (subjectPtr=<value optimized out>, instructionPtr=<value optimized out>, 
    offsetTop=<value optimized out>, md=...)
    at JavaScriptCore/pcre/pcre_exec.cpp:1512
1512	JavaScriptCore/pcre/pcre_exec.cpp: No such file or directory.
	in JavaScriptCore/pcre/pcre_exec.cpp

Thread 10 (Thread 0x7f96b7e24710 (LWP 2252)):
#0  pthread_cond_timedwait ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_timedwait.S:211
No locals.
#1  0x00007f96d6c0f4f2 in g_cond_timed_wait_posix_impl (cond=0x26e7d14, 
    entered_mutex=0x189, abs_time=<value optimized out>) at gthread-posix.c:242
        result = <value optimized out>
        end_time = {tv_sec = 1269302827, tv_nsec = 728578000}
        timed_out = <value optimized out>
        __PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#2  0x00007f96d692b321 in g_async_queue_pop_intern_unlocked (queue=0x1d713d0, 
    try=0, end_time=0x7f96b7e23df0) at gasyncqueue.c:365
        retval = <value optimized out>
        __PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#3  0x00007f96d697f585 in g_thread_pool_wait_for_new_task (
    data=<value optimized out>) at gthreadpool.c:270
        end_time = {tv_sec = 1269302827, tv_usec = 728578}
#4  g_thread_pool_thread_proxy (data=<value optimized out>)
    at gthreadpool.c:304
        task = 0x1d78000
        pool = 0x1d71370
#5  0x00007f96d697d606 in g_thread_create_proxy (data=0x2f77600)
    at gthread.c:1893
        __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#6  0x00007f96d61c2894 in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
        __res = <value optimized out>
        pd = 0x7f96b7e24710
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140285306881808, 
    -9025420555637452213, 140737084254784, 140285306881808, 140285913309184, 
    3, 9048343077367353931, 9048558392193094219}, mask_was_saved = 0}}, priv = 
    {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
              canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#7  0x00007f96d5f33f9d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#8  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 6 (Thread 0x7f96c713a710 (LWP 5742)):
#0  pthread_cond_wait ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
No locals.
#1  0x00007f96dad40b14 in WTF::TCMalloc_PageHeap::scavengerThread (this=
    0x7f96db608020) at JavaScriptCore/wtf/FastMalloc.cpp:2378
No locals.
#2  0x00007f96dad40b39 in WTF::TCMalloc_PageHeap::runScavengerThread (context=
    0x7f96db6160f4) at JavaScriptCore/wtf/FastMalloc.cpp:1497
No locals.
#3  0x00007f96d61c2894 in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
        __res = <value optimized out>
        pd = 0x7f96c713a710
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140285561775888, 
    -9025420555637452213, 140285814034368, 0, 140285913309184, 3, 
    9048521057590874699, 9048558392193094219}, mask_was_saved = 0}}, priv = {
            pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
              canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#4  0x00007f96d5f33f9d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#5  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 5 (Thread 0x7f96c6839710 (LWP 5907)):
#0  pthread_cond_wait ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
No locals.
#1  0x00007f96daa06ca8 in WebCore::IconDatabase::syncThreadMainLoop (this=
    0x7f96c6852a00) at WebCore/loader/icon/IconDatabase.cpp:1412
        didAnyWork = <value optimized out>
#2  0x00007f96daa06e88 in WebCore::IconDatabase::iconDatabaseSyncThread (this=
    0x7f96c6852a00) at WebCore/loader/icon/IconDatabase.cpp:1030
        journalFilename = {m_impl = {<WTF::FastAllocBase> = 
    {<No data fields>}, m_ptr = 0x7f96c685af00}}
#3  0x00007f96d61c2894 in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
        __res = <value optimized out>
        pd = 0x7f96c6839710
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140285552334608, 
    -9025420555637452213, 140285814034368, 0, 140285913309184, 3, 
    9048522019126678091, 9048558392193094219}, mask_was_saved = 0}}, priv = {
            pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
              canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#4  0x00007f96d5f33f9d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#5  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 4 (Thread 0x7f96c5e32710 (LWP 6870)):
#0  pthread_cond_wait ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
No locals.
#1  0x00007f96bc671661 in queue_processor (data=<value optimized out>)
    at /var/tmp/paludis/dev-java-icedtea-6.1.7.1/work/icedtea6-1.7.1/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc:724
        processor = 0x27cb940
        message_parts = 0x0
        command = warning: can't find linker symbol for virtual table for `std::basic_string<char, std::char_traits<char>, std::allocator<char> >' value
warning:   found `std::string::_Rep::_S_empty_rep_storage' instead
{static npos = 18446744073709551615, _M_dataplus = warning: can't find linker symbol for virtual table for `std::basic_string<char, std::char_traits<char>, std::allocator<char> >::_Alloc_hider' value
warning:   found `std::string::_Rep::_S_empty_rep_storage' instead

{<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = 
    {<No data fields>}, <No data fields>}, _M_p = 0x7f96d0ee9158 ""}}
        wait_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, 
            __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, 
              __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}
#2  0x00007f96d61c2894 in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
        __res = <value optimized out>
        pd = 0x7f96c5e32710
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140285541820176, 
    -9025420555637452213, 140285814034368, 0, 140285913309184, 3, 
    9048514593665094219, 9048558392193094219}, mask_was_saved = 0}}, priv = {
            pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
              canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#3  0x00007f96d5f33f9d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#4  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 3 (Thread 0x7f96bffff710 (LWP 6871)):
#0  pthread_cond_wait ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
No locals.
#1  0x00007f96bc671661 in queue_processor (data=<value optimized out>)
    at /var/tmp/paludis/dev-java-icedtea-6.1.7.1/work/icedtea6-1.7.1/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc:724
        processor = 0x27cb940
        message_parts = 0x0
        command = warning: can't find linker symbol for virtual table for `std::basic_string<char, std::char_traits<char>, std::allocator<char> >' value
warning:   found `std::string::_Rep::_S_empty_rep_storage' instead
{static npos = 18446744073709551615, _M_dataplus = warning: can't find linker symbol for virtual table for `std::basic_string<char, std::char_traits<char>, std::allocator<char> >::_Alloc_hider' value
warning:   found `std::string::_Rep::_S_empty_rep_storage' instead

{<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = 
    {<No data fields>}, <No data fields>}, _M_p = 0x7f96d0ee9158 ""}}
        wait_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, 
            __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, 
              __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}
#2  0x00007f96d61c2894 in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
        __res = <value optimized out>
        pd = 0x7f96bffff710
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140285443045136, 
    -9025420555637452213, 140285814034368, 0, 140285913309184, 3, 
    9048360765653291595, 9048558392193094219}, mask_was_saved = 0}}, priv = {
            pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
              canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#3  0x00007f96d5f33f9d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#4  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 2 (Thread 0x7f96beffd710 (LWP 6872)):
#0  pthread_cond_wait ()
    at ../nptl/sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:162
No locals.
#1  0x00007f96bc671661 in queue_processor (data=<value optimized out>)
    at /var/tmp/paludis/dev-java-icedtea-6.1.7.1/work/icedtea6-1.7.1/plugin/icedteanp/IcedTeaPluginRequestProcessor.cc:724
        processor = 0x27cb940
        message_parts = 0x0
        command = warning: can't find linker symbol for virtual table for `std::basic_string<char, std::char_traits<char>, std::allocator<char> >' value
warning:   found `std::string::_Rep::_S_empty_rep_storage' instead
{static npos = 18446744073709551615, _M_dataplus = warning: can't find linker symbol for virtual table for `std::basic_string<char, std::char_traits<char>, std::allocator<char> >::_Alloc_hider' value
warning:   found `std::string::_Rep::_S_empty_rep_storage' instead

{<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = 
    {<No data fields>}, <No data fields>}, _M_p = 0x7f96d0ee9158 ""}}
        wait_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, 
            __nusers = 0, __kind = 0, __spins = 0, __list = {__prev = 0x0, 
              __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}
#2  0x00007f96d61c2894 in start_thread (arg=<value optimized out>)
    at pthread_create.c:297
        __res = <value optimized out>
        pd = 0x7f96beffd710
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140285426259728, 
    -9025420555637452213, 140285814034368, 0, 140285913309184, 3, 
    9048362965750288971, 9048558392193094219}, mask_was_saved = 0}}, priv = {
            pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, 
              canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#3  0x00007f96d5f33f9d in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#4  0x0000000000000000 in ?? ()
No symbol table info available.

Thread 1 (Thread 0x7f96dc021780 (LWP 5455)):
#0  match (subjectPtr=<value optimized out>, 
    instructionPtr=<value optimized out>, offsetTop=<value optimized out>, md=
    ...) at JavaScriptCore/pcre/pcre_exec.cpp:1512
        i = 1
        isMatch = false
        minimize = false
        min = 1
        remainingMatchCount = 999990
        othercase = <value optimized out>
        stack = {frames = {{<WTF::FastAllocBase> = {<No data fields>}, 
              returnLocation = 0x7f96dac51a98, previousFrame = 0x7fffe7e9dd70, 
              args = {subjectPtr = 0x1, instructionPtr = 0x7f96b92cf12c "@D", 
                offsetTop = 2, bracketChain = 0x7fffe7e9d600}, locals = {
                data = 0x7fffe7e9dcd0 "\310\002", startOfRepeatingBracket = 
    0x7f96b92cf12d "D", subjectPtrAtStartOfInstruction = 0x39, 
                instructionPtrAtStartOfOnce = 
    0x7f96dac027c8 "A\203\374\a\177\nA\203\375\a\017\216\220", 
                repeatOthercase = -404105152, ctype = 32767, fc = -404103984, 
                fi = 32767, length = 5, max = 0, number = -404105016, offset = 
    32767, saveOffset1 = 90, saveOffset2 = 32662, saveOffset3 = -624360549, 
                bracketChainNode = {previousBracket = 0x0, bracketStart = 
    0x1}}}, {<WTF::FastAllocBase> = {<No data fields>}, returnLocation = 
    0x7f96dac51818, previousFrame = 0x7fffe7e9d580, args = {subjectPtr = 0x1, 
                instructionPtr = 0x7f96b92cf133 ":", offsetTop = 2, 
                bracketChain = 0x7fffe7e9d690}, locals = {data = 0x0, 
                startOfRepeatingBracket = 0x7fffe7e9d658 ";", 
                subjectPtrAtStartOfInstruction = 0x10, 
                instructionPtrAtStartOfOnce = 
    0x440000003b <Address 0x440000003b out of bounds>, repeatOthercase = 77, 
                ctype = 0, fc = 0, fi = 0, length = 0, max = 0, number = 1, 
                offset = 2, saveOffset1 = -1, saveOffset2 = -1, saveOffset3 = 
    -1, bracketChainNode = {previousBracket = 0x7fffe7e9d600, bracketStart = 
    0x1}}}, {<WTF::FastAllocBase> = {<No data fields>}, returnLocation = 
    0x7f96dac51ab0, previousFrame = 0x7fffe7e9d610, args = {subjectPtr = 
    0xffffffffffffffff, instructionPtr = 0x7f96b92cf140 "E", offsetTop = 4, 
                bracketChain = 0x7fffe7e9d690}, locals = {data = 
    0x1 <Address 0x1 out of bounds>, startOfRepeatingBracket = 0x0, 
                subjectPtrAtStartOfInstruction = 0x1, 
                instructionPtrAtStartOfOnce = 0x7f96b92cf12d "D", 
                repeatOthercase = 128, ctype = 0, fc = 32, fi = 32767, 
                length = 1, max = 3, number = 1, offset = 2, saveOffset1 = 16, 
                saveOffset2 = 0, saveOffset3 = -404103984, bracketChainNode = {
                  previousBracket = 0x7fffe7e9d690, bracketStart = 0x1}}}, 
    {<WTF::FastAllocBase> = {<No data fields>}, returnLocation = 
    0x7f96dac51a48, previousFrame = 0x7fffe7e9d6a0, args = {subjectPtr = 
    0xffffffffffffffff, instructionPtr = 0x7f96b92cf165 ":", offsetTop = 4, 
                bracketChain = 0x7fffe7e9d690}, locals = {data = 
    0x7fffe7e9db30 "\020", startOfRepeatingBracket = 0x7fffe7e9db30 "\020", 
                subjectPtrAtStartOfInstruction = 0x39, 
                instructionPtrAtStartOfOnce = 0x1 <Address 0x1 out of bounds>, 
                repeatOthercase = -404105312, ctype = 32767, fc = -404104992, 
                fi = 32767, length = -404105288, max = 32767, number = 2, 
                offset = 4, saveOffset1 = -1, saveOffset2 = -1, saveOffset3 = 
    -1, bracketChainNode = {previousBracket = 0x10, bracketStart = 
    0x6d00000046}}}, {<WTF::FastAllocBase> = {<No data fields>}, 
              returnLocation = 0x7f96dac51ab0, previousFrame = 0x7fffe7e9d730, 
              args = {subjectPtr = 0xffffffffffffffff, instructionPtr = 
    0x7f96b92cf16b "\020.;", offsetTop = 4, bracketChain = 0x7fffe7e9d840}, 
              locals = {data = 0x7f96b92cf145 "", startOfRepeatingBracket = 
    0x7f96dad45b7b "H\205\300\017\204\"\004", subjectPtrAtStartOfInstruction = 
    0x0, instructionPtrAtStartOfOnce = 0x7f96b9046f68 "\300YJ\264\226\177", 
                repeatOthercase = 0, ctype = 4, fc = 0, fi = 0, length = 16, 
                max = 2147483647, number = -404103984, offset = 32767, 
                saveOffset1 = 4, saveOffset2 = 0, saveOffset3 = -624941112, 
                bracketChainNode = {previousBracket = 0x7fffe7e9d690, 
                  bracketStart = 0xffffffffffffffff}}}, 
    {<WTF::FastAllocBase> = {<No data fields>}, returnLocation = 0xc7, 
              previousFrame = 0x7f96dac02f10, args = {subjectPtr = 
    0x7fff00000095, instructionPtr = 0x7f96bf118300 "", offsetTop = 
    -404103984, bracketChain = 0x7f96bf118300}, locals = {data = 
    0x7fffe7e9dae0 "`\366U\266\226\177", startOfRepeatingBracket = 
    0x7f96dac96482 "H\213\223", subjectPtrAtStartOfInstruction = 0xffffffff, 
                instructionPtrAtStartOfOnce = 
    0x7f96dad4002f "P\020H\213\223\260\200", repeatOthercase = -404105008, 
                ctype = 32767, fc = 114, fi = -1, length = -1083747456, max = 
    32662, number = 1, offset = 2, saveOffset1 = 2, saveOffset2 = 0, 
                saveOffset3 = 0, bracketChainNode = {previousBracket = 
    0x7fffe7e9d8e0, bracketStart = 0x10}}}, {<WTF::FastAllocBase> = 
    {<No data fields>}, returnLocation = 0x5a00000072, previousFrame = 
    0x7fffe7e9db7c, args = {subjectPtr = 0x7fffe7e9dbf0, instructionPtr = 0x0, 
                offsetTop = -404104432, bracketChain = 0x7f96dac83556}, 
              locals = {data = 0x39 <Address 0x39 out of bounds>, 
                startOfRepeatingBracket = 
    0x7f96dac027c8 "A\203\374\a\177\nA\203\375\a\017\216\220", 
                subjectPtrAtStartOfInstruction = 0x7f0000000072, 
                instructionPtrAtStartOfOnce = 0x7fffe7e9dcd0 "\310\002", 
                repeatOthercase = 48, ctype = 0, fc = -404102736, fi = 32767, 
                length = 131, max = 0, number = -624941112, offset = 32662, 
                saveOffset1 = -1089371392, saveOffset2 = 32662, saveOffset3 = 
    -404102736, bracketChainNode = {previousBracket = 0x39, bracketStart = 
    0x7fffe7e9e1b0}}}, {<WTF::FastAllocBase> = {<No data fields>}, 
              returnLocation = 0x39, previousFrame = 0x7f96dac02d22, args = {
                subjectPtr = 0x7fff000000e8, instructionPtr = 
    0x7fffe7e9e1b0 "UH\211\345SVH\203\354@\203\306\002\071\326\017", 
                offsetTop = -404102736, bracketChain = 0x7f96bf2d0b80}, 
              locals = {data = 0x1 <Address 0x1 out of bounds>, 
                startOfRepeatingBracket = 
    0x7fffe7e9e1b0 "UH\211\345SVH\203\354@\203\306\002\071\326\017", 
                subjectPtrAtStartOfInstruction = 0x83, 
                instructionPtrAtStartOfOnce = 
    0x7f96dac027c8 "A\203\374\a\177\nA\203\375\a\017\216\220", 
                repeatOthercase = -404104448, ctype = 32767, fc = -404102736, 
                fi = 32767, length = 46, max = 0, number = -404102736, 
                offset = 32767, saveOffset1 = 46, saveOffset2 = 0, 
                saveOffset3 = -1189387352, bracketChainNode = {
                  previousBracket = 0x7fffe7e9e1b0, bracketStart = 
    0x7fffe7e9db80}}}, {<WTF::FastAllocBase> = {<No data fields>}, 
              returnLocation = 0x1, previousFrame = 0x0, args = {subjectPtr = 
    0xffffffff, instructionPtr = 0x7f96dac8f3d9 "H\203{8", offsetTop = 0, 
                bracketChain = 0x7fff00000000}, locals = {data = 
    0x83 <Address 0x83 out of bounds>, startOfRepeatingBracket = 
    0x7fffe7e9daa0 "", subjectPtrAtStartOfInstruction = 0x0, 
                instructionPtrAtStartOfOnce = 
    0x7fffe7e9e1b0 "UH\211\345SVH\203\354@\203\306\002\071\326\017", 
                repeatOthercase = -404102736, ctype = 32767, fc = 7, fi = 0, 
                length = 3, max = 0, number = 201, offset = 0, saveOffset1 = 
    -1238586368, saveOffset2 = 32662, saveOffset3 = -625018146, 
                bracketChainNode = {previousBracket = 0x7fffe7e9dae0, 
                  bracketStart = 0x7fffe7e9e1b0}}}, {<WTF::FastAllocBase> = 
    {<No data fields>}, returnLocation = 0x85, previousFrame = 0x7fffe7e9e1b0, 
              args = {subjectPtr = 0x0, instructionPtr = 0x0, offsetTop = 0, 
                bracketChain = 0x7f2ee7e9e1b0}, locals = {data = 
    0x1 <Address 0x1 out of bounds>, startOfRepeatingBracket = 
    0x7fffe7e9dd90 "\004\336\351\347\377\177", 
                subjectPtrAtStartOfInstruction = 0x7fffe7e9e1b0, 
                instructionPtrAtStartOfOnce = 0x7fffe7e9db80 "", 
                repeatOthercase = -1235880352, ctype = 32662, fc = -404103792, 
                fi = 32767, length = -404102736, max = 32767, number = 
    -624351150, offset = 32662, saveOffset1 = -404104432, saveOffset2 = 32767, 
                saveOffset3 = 16, bracketChainNode = {previousBracket = 
    0x7f9600000095, bracketStart = 0x7f96dac80b09}}}, {<WTF::FastAllocBase> = 
    {<No data fields>}, returnLocation = 0x0, previousFrame = 0x7fffe7e9db38, 
              args = {subjectPtr = 0x10, instructionPtr = 
    0x7fff000000e8 <Address 0x7fff000000e8 out of bounds>, offsetTop = 
    -404103648, bracketChain = 0x7fffe7e9db98}, locals = {data = 
    0x7d <Address 0x7d out of bounds>, startOfRepeatingBracket = 
    0x1b6b121c8 <Address 0x1b6b121c8 out of bounds>, 
                subjectPtrAtStartOfInstruction = 0x0, 
                instructionPtrAtStartOfOnce = 0x7fffe7e9db78 "\025", 
                repeatOthercase = 16, ctype = 0, fc = 21, fi = 32662, length = 
    0, max = 0, number = -404104296, offset = 32767, saveOffset1 = 16, 
                saveOffset2 = 0, saveOffset3 = 295, bracketChainNode = {
                  previousBracket = 0x7fff00000101, bracketStart = 
    0x7fffe7e9de10}}}, {<WTF::FastAllocBase> = {<No data fields>}, 
              returnLocation = 0x7f96b6b121b8, previousFrame = 0x7f96b6b121c8, 
              args = {subjectPtr = 0x0, instructionPtr = 
    0x7f96dac7f93c "\353\242f\220A\213D$\004\211D$\034A9D$\b\017\206\322\002", 
                offsetTop = -404103696, bracketChain = 0x7fffe7e9e1b0}, 
              locals = {data = 0x83 <Address 0x83 out of bounds>, 
                startOfRepeatingBracket = 
    0x7f96dac027c8 "A\203\374\a\177\nA\203\375\a\017\216\220", 
                subjectPtrAtStartOfInstruction = 0x10, 
                instructionPtrAtStartOfOnce = 
    0x5c <Address 0x5c out of bounds>, repeatOthercase = 74, ctype = 0, fc = 
    49, fi = 0, length = 93, max = 0, number = -624631115, offset = 32662, 
                saveOffset1 = -404103768, saveOffset2 = 32767, saveOffset3 = 
    1, bracketChainNode = {previousBracket = 0x7fffe7e9e07c, bracketStart = 
    0x7f96b91b6af2}}}, {<WTF::FastAllocBase> = {<No data fields>}, 
              returnLocation = 0x7fffe7e9e070, previousFrame = 0x140, args = {
                subjectPtr = 0x7fffe7e9e14c, instructionPtr = 
    0x100000000 <Address 0x100000000 out of bounds>, offsetTop = -404102896, 
                bracketChain = 0xdad4668b}, locals = {data = 
    0x7fffe7e9e068 "\360j\033\271\226\177", startOfRepeatingBracket = 
    0x2dad47369 <Address 0x2dad47369 out of bounds>, 
                subjectPtrAtStartOfInstruction = 0x19, 
                instructionPtrAtStartOfOnce = 0x7f96b92cf169 "'\004\020.;", 
                repeatOthercase = -1189385486, ctype = 32662, fc = 0, fi = 0, 
                length = -2, max = 0, number = -624627445, offset = 32662, 
                saveOffset1 = 13, saveOffset2 = 0, saveOffset3 = -404102736, 
                bracketChainNode = {previousBracket = 0xd, bracketStart = 
    0x7f96dac02d22}}}, {<WTF::FastAllocBase> = {<No data fields>}, 
              returnLocation = 0x7fff000002c8, previousFrame = 0x7fffe7e9e1b0, 
              args = {subjectPtr = 0x7fffe7e9e1b0, instructionPtr = 
    0x7f96bf2d0700 "\200\a-\277\226\177", offsetTop = 1, bracketChain = 
    0x7fff00000001}, locals = {data = 
    0x22e00000083 <Address 0x22e00000083 out of bounds>, 
                startOfRepeatingBracket = 0x7fffe7e9ddb0 "", 
                subjectPtrAtStartOfInstruction = 0xe7e9de70, 
                instructionPtrAtStartOfOnce = 
    0x7fff0000002e <Address 0x7fff0000002e out of bounds>, repeatOthercase = 
    32, ctype = 0, fc = -404102836, fi = 32767, length = -404102848, max = 
    32767, number = -624939742, offset = 32512, saveOffset1 = -404103472, 
                saveOffset2 = 32767, saveOffset3 = -404103672, 
                bracketChainNode = {previousBracket = 0x7fffe7e9dec8, 
                  bracketStart = 0x7f96b91b6700}}}, {<WTF::FastAllocBase> = 
    {<No data fields>}, returnLocation = 0x7fffe7e9ddd0, previousFrame = 
    0x7fffe7e9dde0, args = {subjectPtr = 0x7f96b92cf190, instructionPtr = 
    0x7f9600000001 <Address 0x7f9600000001 out of bounds>, offsetTop = 
    -404103728, bracketChain = 0x7fffe7e9de0c}, locals = {data = 
    0x7fffe7e9de04 "", startOfRepeatingBracket = 0x7fffe7e9dda8 "\277\002", 
                subjectPtrAtStartOfInstruction = 0x10, 
                instructionPtrAtStartOfOnce = 
    0x2bf <Address 0x2bf out of bounds>, repeatOthercase = 0, ctype = 16384, 
                fc = 0, fi = 0, length = 0, max = 0, number = 0, offset = 0, 
                saveOffset1 = -404103122, saveOffset2 = 32767, saveOffset3 = 
    -404102736, bracketChainNode = {previousBracket = 0x7f96b91b6ae6, 
                  bracketStart = 0x7f96b92cf169}}}, {<WTF::FastAllocBase> = 
    {<No data fields>}, returnLocation = 0x39, previousFrame = 0x7f96dac027c8, 
              args = {subjectPtr = 0xffffffff, instructionPtr = 
    0x7fffe7e9e1b0 "UH\211\345SVH\203\354@\203\306\002\071\326\017", 
                offsetTop = 5, bracketChain = 0x1ffffffff}, locals = {data = 
    0x7f96bf1113f0 "\001", startOfRepeatingBracket = 0x7f96b92cf165 ":", 
                subjectPtrAtStartOfInstruction = 0x7f96b91b6af2, 
                instructionPtrAtStartOfOnce = 
    0xfffffffe <Address 0xfffffffe out of bounds>, repeatOthercase = -1, 
                ctype = 0, fc = -404103464, fi = 32767, length = -404103460, 
                max = 32767, number = -624620770, offset = 32662, 
                saveOffset1 = -404103460, saveOffset2 = 32767, saveOffset3 = 
    -404103464, bracketChainNode = {previousBracket = 0x7fffe7e9e110, 
                  bracketStart = 0x7fffe7e9de88}}}}, framesEnd = 
    0x7fffe7e9de80, currentFrame = 0x7fffe7e9d7c0, size = 5}
#1  0x00007f96dac5472e in jsRegExpExecute (re=<value optimized out>, 
    subject=<value optimized out>, length=<value optimized out>, 
    start_offset=<value optimized out>, offsets=<value optimized out>, 
    offsetCount=<value optimized out>)
    at JavaScriptCore/pcre/pcre_exec.cpp:2072
        returnCode = <value optimized out>
        usingTemporaryOffsets = false
        reqByteIsCaseless = false
        reqBytePtr = 0xffffffffffffffff
        matchBlock = {offsetVector = 0x7f96b6b5e9d0, offsetEnd = 9, 
          offsetMax = 6, offsetOverflow = false, startSubject = 0x1, 
          endSubject = 0x1, endMatchPtr = 0x7fff00000001, endOffsetTop = 72, 
          multiline = false, ignoreCase = false}
        firstByteIsCaseless = false
        reqByte2 = <value optimized out>
        ocount = <value optimized out>
        resetCount = <value optimized out>
        firstByte = <value optimized out>
        reqByte = -1
        startMatch = 0x1
#2  0x00007f96dad28ef1 in executeRegex (this=0x7f96b6b121f8, s=..., 
    startOffset=0, ovector=0x7f96b6b5e9b8)
    at ./JavaScriptCore/yarr/RegexJIT.h:87
        fallback = 0xffffffffffffffff
#3  JSC::RegExp::match (this=0x7f96b6b121f8, s=..., startOffset=0, ovector=
    0x7f96b6b5e9b8) at JavaScriptCore/runtime/RegExp.cpp:137
        offsetVectorSize = <value optimized out>
        offsetVector = 0x7f96b6b5e9d0
        nonReturnedOvector = {<WTF::FastAllocBase> = {<No data fields>}, 
          m_size = 0, m_buffer = {<WTF::VectorBufferBase<int>> = 
    {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = 
    {<No data fields>}, <No data fields>}, m_buffer = 0x7fffe7e9dfe8, 
              m_capacity = 32}, static m_inlineBufferSize = <optimized out>, 
            m_inlineBuffer = {buffer = 
    "\020\000\000\000\000\000\000\000@\340\351\347\377\177\000\000|\340\351\347\377\177\000\000t\340\351\347\377\177\000\000\001\000\000\000\002\000\000\000\320\340\351\347\377\177\000\000\000\000\000\000\377\177\000\000\000\000\000\000\001", '\000' <repeats 27 times>, " \000\000\000\000\000\000\000{[\324ږ\177\000\000\360j\033\271\226\177\000\000q\361,\271\226\177\000\000\260j\033\271\226\177\000"}}}
        result = <value optimized out>
#4  0x00007f96dad3a15a in JSC::RegExpConstructor::performMatch (
    exec=<value optimized out>, thisValue=..., args=<value optimized out>)
    at JavaScriptCore/runtime/RegExpConstructor.h:114
No locals.
#5  stringProtoFuncReplace (exec=<value optimized out>, thisValue=..., 
    args=<value optimized out>)
    at JavaScriptCore/runtime/StringPrototype.cpp:391
        matchIndex = -404102840
        matchLen = <value optimized out>
        ovector = 0x7f96b6b121f8
        regExpConstructor = 0x7f96c40644c0
        startPosition = 1
        reg = 0x7f96b6b121f8
        global = false
        lastIndex = 0
        sourceRanges = {<WTF::FastAllocBase> = {<No data fields>}, m_size = 0, 
          m_buffer = {<WTF::VectorBufferBase<JSC::StringRange>> = 
    {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = 
    {<No data fields>}, <No data fields>}, m_buffer = 0x7fffe7e9e288, 
              m_capacity = 16}, static m_inlineBufferSize = <optimized out>, 
            m_inlineBuffer = {buffer = 
    "0\017\214\t\000\000\000\203\370\071\017\216\005\000\000\000\351\000\000\000\000\203\303\001\203\306\001\304!\000\000\000\260j\033\271\226\177\000\000\000@E\266\226\177\000\000`\003\000\000\071\003\000\000\360\342\351\347\377\177", '\000' <repeats 26 times>, "\001\207\000\000\000\000I\273\n\000\000\000\000\000\000\000\000\000]\000\002\000\000\000\000\000\000\000\000\000M\211\200Sg\277\226\177\000"}}}
        replacements = {<WTF::FastAllocBase> = {<No data fields>}, m_size = 0, 
          m_buffer = {<WTF::VectorBufferBase<JSC::UString>> = 
    {<WTFNoncopyable::Noncopyable> = {<WTF::FastAllocBase> = 
    {<No data fields>}, <No data fields>}, m_buffer = 0x7fffe7e9e1e8, 
              m_capacity = 16}, static m_inlineBufferSize = <optimized out>, 
            m_inlineBuffer = {buffer = 
    "\203\373\003\017\205\326\377\377\377\351\023\000\000\000H\213\\$ \205\333\017\204\000\000\000\000\203\353\001\203\356\001H\211\\$ H\211\360\203\300\376\211A\020\017\267Dw\374\203\370*\017\204\027\000\000\000\203\370+\017\204\016\000\000\000\203\370-\017\204\005\000\000\000\351\024\000\000\000I\273\000\000\000\000\000\000\000\000L\211\\$(\351\000\000\000\000\203\306\001\071\326\017\207\000\000\000\000\017\267Dw\372\203\370\060\017\214\t\000"}}}
        source = @0x7f96c44c0118
        patternString = {static NotFound = <optimized out>, m_rep = 
    {<WTF::FastAllocBase> = {<No data fields>}, m_ptr = 0x7f96c68f9a00}, 
          static s_nullRep = 0x7f96c683b3c0, static s_nullUString = 
    0x7f96c683c0f8}
        replacement = {m_ptr = 0x7f96b44a5dc0}
        replacementString = {static NotFound = <optimized out>, m_rep = 
    {<WTF::FastAllocBase> = {<No data fields>}, m_ptr = 0x7f96c683b3c0}, 
          static s_nullRep = 0x7f96c683b3c0, static s_nullUString = 
    0x7f96c683c0f8}
        callData = {native = {function = 0x7f96bf089a10}, js = {
            functionExecutable = 0x7f96bf089a10, scopeChain = 0x7f96b9046660}}
        matchPos = <value optimized out>
        sourceVal = 0x7f96c44c0100
        pattern = {m_ptr = 0x7f96b44a5d80}
        callType = JSC::CallTypeJS
        ovector = {-623715808, 32662}
#6  0x00007f96c562e1b4 in ?? ()
No symbol table info available.
#7  0x00007f96c4516290 in ?? ()
No symbol table info available.
#8  0x0000000000000002 in ?? ()
No symbol table info available.
#9  0x0000000000000000 in ?? ()
No symbol table info available.
Comment 1 Alexey Proskuryakov 2010-03-23 08:37:00 PDT
Same as bug 33761?
Comment 2 Maciej Piechotka 2010-03-23 18:53:45 PDT
(In reply to comment #1)
> Same as bug 33761?

I cannot find any common points in stacktrace.
Comment 3 Gavin Barraclough 2011-07-20 19:22:53 PDT
PCRE has since been removed from JSC, so we won't have any more crashes here.  If this is still a live issue, please reopen & attach a fresh stack trace.