I get a reproducible crash when visiting http://translate.google.com/translate?js=y&prev=_t&hl=en&ie=UTF-8&layout=1&eotf=1&u=http%3A%2F%2Fjablickar.cz%2Fcesky-uzivatel-testuje-iphone-4-ukazky-fotografii-a-videa-z-iphone-4-v-clanku%2F&sl=auto&tl=en with the current WebKit Nightly (Safari Version 4.1 (4533.16, r61351) on Mac OS X 10.4.11 PowerPC G4) Date/Time: 2010-06-18 23:08:14.813 +0200 OS Version: 10.4.11 (Build 8S165) Report Version: 4 Command: Safari Path: /Applications/Safari.app/Contents/MacOS/Safari Parent: WindowServer [60] Version: r61351 (61351) PID: 3409 Thread: 0 Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x00000008 Thread 0 Crashed: 0 com.apple.JavaScriptCore 0x005d7164 JSC::JSObject::defaultValue(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 1764 1 com.apple.JavaScriptCore 0x0050a85c JSC::JSObject::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 44 2 com.apple.JavaScriptCore 0x005d605c JSC::JSObject::toString(JSC::ExecState*) const + 60 3 com.apple.JavaScriptCore 0x0065258c JSC::stringProtoFuncSubstring(JSC::ExecState*) + 284 4 com.apple.JavaScriptCore 0x0059df04 JSC::Interpreter::privateExecute(JSC::Interpreter::ExecutionFlag, JSC::RegisterFile*, JSC::ExecState*, JSC::JSValue*) + 59252 5 com.apple.JavaScriptCore 0x005a4f70 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::ScopeChainNode*, JSC::JSObject*, JSC::JSValue*) + 800 6 com.apple.JavaScriptCore 0x00543ef8 JSC::evaluate(JSC::ExecState*, JSC::ScopeChain&, JSC::SourceCode const&, JSC::JSValue) + 488 See attached crash log
Created attachment 59157 [details] crash log for #40858 crash log for the bug
With a local debug build of r61268, I'm getting an assertion failure: ASSERTION FAILED: this[RegisterFile::ScopeChain].Register::scopeChain() (/Users/ap/Safari/OpenSource/JavaScriptCore/interpreter/CallFrame.h:45 JSC::ScopeChainNode* JSC::ExecState::scopeChain() const)
<rdar://problem/8108986>
Same crash on Intel in bug 40874.
I know what this bug is and am working on it.
Created attachment 59194 [details] Patch
Attachment 59194 [details] did not pass style-queue: Failed to run "['WebKitTools/Scripts/check-webkit-style', '--no-squash']" exit_code: 1 JavaScriptCore/interpreter/Interpreter.cpp:3650: vm_throw is incorrectly named. Don't use underscores in your identifier names. [readability/naming] [4] JavaScriptCore/interpreter/Interpreter.cpp:3802: vm_throw is incorrectly named. Don't use underscores in your identifier names. [readability/naming] [4] JavaScriptCore/interpreter/Interpreter.cpp:4124: vm_throw is incorrectly named. Don't use underscores in your identifier names. [readability/naming] [4] Total errors found: 3 in 5 files If any of these errors are false positives, please file a bug against check-webkit-style.
Attachment 59194 [details] did not build on mac: Build output: http://webkit-commit-queue.appspot.com/results/3301444
Attachment 59194 [details] did not build on qt: Build output: http://webkit-commit-queue.appspot.com/results/3316437
Created attachment 59195 [details] Patch
Attachment 59195 [details] did not pass style-queue: Failed to run "['WebKitTools/Scripts/check-webkit-style', '--no-squash']" exit_code: 1 JavaScriptCore/interpreter/Interpreter.cpp:3650: vm_throw is incorrectly named. Don't use underscores in your identifier names. [readability/naming] [4] JavaScriptCore/interpreter/Interpreter.cpp:3802: vm_throw is incorrectly named. Don't use underscores in your identifier names. [readability/naming] [4] JavaScriptCore/interpreter/Interpreter.cpp:4124: vm_throw is incorrectly named. Don't use underscores in your identifier names. [readability/naming] [4] Total errors found: 3 in 5 files If any of these errors are false positives, please file a bug against check-webkit-style.
Attachment 59194 [details] did not build on gtk: Build output: http://webkit-commit-queue.appspot.com/results/3308438
Attachment 59194 [details] did not build on win: Build output: http://webkit-commit-queue.appspot.com/results/3282403
Am I see right that the new "RegisterFile* CallFrame::registerFile()" only used for debug purposes? Shouldn't we put NDEBUG protection around it? Or do you plan to use it in other places?
Created attachment 59201 [details] Patch
Attachment 59201 [details] did not pass style-queue: Failed to run "['WebKitTools/Scripts/check-webkit-style', '--no-squash']" exit_code: 1 JavaScriptCore/interpreter/Interpreter.cpp:3650: vm_throw is incorrectly named. Don't use underscores in your identifier names. [readability/naming] [4] JavaScriptCore/interpreter/Interpreter.cpp:3802: vm_throw is incorrectly named. Don't use underscores in your identifier names. [readability/naming] [4] JavaScriptCore/interpreter/Interpreter.cpp:4124: vm_throw is incorrectly named. Don't use underscores in your identifier names. [readability/naming] [4] Total errors found: 3 in 5 files If any of these errors are false positives, please file a bug against check-webkit-style.
Comment on attachment 59201 [details] Patch + CHECK_FOR_EXCEPTION(); + return 0; You want VM_THROW_EXCEPTION() instead. r=me
Committed r61553: <http://trac.webkit.org/changeset/61553>
*** Bug 40874 has been marked as a duplicate of this bug. ***
http://trac.webkit.org/changeset/61553 might have broken Tiger Intel Release The following changes are on the blame list: http://trac.webkit.org/changeset/61553 http://trac.webkit.org/changeset/61554 http://trac.webkit.org/changeset/61555 http://trac.webkit.org/changeset/61556 http://trac.webkit.org/changeset/61557