Bug 40858 - Reproducible crash in com.apple.JavaScriptCore 0x005d7164 JSC::JSObject::defaultValue(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 1764
Summary: Reproducible crash in com.apple.JavaScriptCore 0x005d7164 JSC::JSObject::def...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (PowerPC) OS X 10.4
: P1 Critical
Assignee: Nobody
URL: http://translate.google.com/translate...
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2010-06-18 14:14 PDT by lars.sonchocky-helldorf
Modified: 2010-06-21 12:33 PDT (History)
10 users (show)

See Also:


Attachments
crash log for #40858 (25.80 KB, text/plain)
2010-06-18 14:17 PDT, lars.sonchocky-helldorf
no flags Details
Patch (7.02 KB, patch)
2010-06-19 18:42 PDT, Oliver Hunt
no flags Details | Formatted Diff | Diff
Patch (7.05 KB, patch)
2010-06-19 18:57 PDT, Oliver Hunt
no flags Details | Formatted Diff | Diff
Patch (7.08 KB, patch)
2010-06-20 11:15 PDT, Oliver Hunt
ggaren: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description lars.sonchocky-helldorf 2010-06-18 14:14:53 PDT
I get a reproducible crash when visiting http://translate.google.com/translate?js=y&prev=_t&hl=en&ie=UTF-8&layout=1&eotf=1&u=http%3A%2F%2Fjablickar.cz%2Fcesky-uzivatel-testuje-iphone-4-ukazky-fotografii-a-videa-z-iphone-4-v-clanku%2F&sl=auto&tl=en with the current WebKit Nightly (Safari Version 4.1 (4533.16, r61351) on Mac OS X 10.4.11 PowerPC G4)

Date/Time:      2010-06-18 23:08:14.813 +0200
OS Version:     10.4.11 (Build 8S165)
Report Version: 4

Command: Safari
Path:    /Applications/Safari.app/Contents/MacOS/Safari
Parent:  WindowServer [60]

Version: r61351 (61351)

PID:    3409
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000008

Thread 0 Crashed:
0   com.apple.JavaScriptCore 	0x005d7164 JSC::JSObject::defaultValue(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 1764
1   com.apple.JavaScriptCore 	0x0050a85c JSC::JSObject::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 44
2   com.apple.JavaScriptCore 	0x005d605c JSC::JSObject::toString(JSC::ExecState*) const + 60
3   com.apple.JavaScriptCore 	0x0065258c JSC::stringProtoFuncSubstring(JSC::ExecState*) + 284
4   com.apple.JavaScriptCore 	0x0059df04 JSC::Interpreter::privateExecute(JSC::Interpreter::ExecutionFlag, JSC::RegisterFile*, JSC::ExecState*, JSC::JSValue*) + 59252
5   com.apple.JavaScriptCore 	0x005a4f70 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::ScopeChainNode*, JSC::JSObject*, JSC::JSValue*) + 800
6   com.apple.JavaScriptCore 	0x00543ef8 JSC::evaluate(JSC::ExecState*, JSC::ScopeChain&, JSC::SourceCode const&, JSC::JSValue) + 488

See attached crash log
Comment 1 lars.sonchocky-helldorf 2010-06-18 14:17:38 PDT
Created attachment 59157 [details]
crash log for #40858

crash log for the bug
Comment 2 Alexey Proskuryakov 2010-06-18 14:26:47 PDT
With a local debug build of r61268, I'm getting an assertion failure:

ASSERTION FAILED: this[RegisterFile::ScopeChain].Register::scopeChain()
(/Users/ap/Safari/OpenSource/JavaScriptCore/interpreter/CallFrame.h:45 JSC::ScopeChainNode* JSC::ExecState::scopeChain() const)
Comment 3 Alexey Proskuryakov 2010-06-18 14:27:25 PDT
<rdar://problem/8108986>
Comment 4 Alexey Proskuryakov 2010-06-19 13:22:34 PDT
Same crash on Intel in bug 40874.
Comment 5 Oliver Hunt 2010-06-19 17:23:36 PDT
I know what this bug is and am working on it.
Comment 6 Oliver Hunt 2010-06-19 18:42:26 PDT
Created attachment 59194 [details]
Patch
Comment 7 WebKit Review Bot 2010-06-19 18:44:12 PDT
Attachment 59194 [details] did not pass style-queue:

Failed to run "['WebKitTools/Scripts/check-webkit-style', '--no-squash']" exit_code: 1
JavaScriptCore/interpreter/Interpreter.cpp:3650:  vm_throw is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]
JavaScriptCore/interpreter/Interpreter.cpp:3802:  vm_throw is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]
JavaScriptCore/interpreter/Interpreter.cpp:4124:  vm_throw is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]
Total errors found: 3 in 5 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 8 Eric Seidel (no email) 2010-06-19 18:52:37 PDT
Attachment 59194 [details] did not build on mac:
Build output: http://webkit-commit-queue.appspot.com/results/3301444
Comment 9 Early Warning System Bot 2010-06-19 18:55:54 PDT
Attachment 59194 [details] did not build on qt:
Build output: http://webkit-commit-queue.appspot.com/results/3316437
Comment 10 Oliver Hunt 2010-06-19 18:57:25 PDT
Created attachment 59195 [details]
Patch
Comment 11 WebKit Review Bot 2010-06-19 19:00:45 PDT
Attachment 59195 [details] did not pass style-queue:

Failed to run "['WebKitTools/Scripts/check-webkit-style', '--no-squash']" exit_code: 1
JavaScriptCore/interpreter/Interpreter.cpp:3650:  vm_throw is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]
JavaScriptCore/interpreter/Interpreter.cpp:3802:  vm_throw is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]
JavaScriptCore/interpreter/Interpreter.cpp:4124:  vm_throw is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]
Total errors found: 3 in 5 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 12 WebKit Review Bot 2010-06-19 19:29:21 PDT
Attachment 59194 [details] did not build on gtk:
Build output: http://webkit-commit-queue.appspot.com/results/3308438
Comment 13 WebKit Review Bot 2010-06-19 20:14:21 PDT
Attachment 59194 [details] did not build on win:
Build output: http://webkit-commit-queue.appspot.com/results/3282403
Comment 14 Zoltan Herczeg 2010-06-20 01:06:33 PDT
Am I see right that the new "RegisterFile* CallFrame::registerFile()" only used for debug purposes? Shouldn't we put NDEBUG protection around it? Or do you plan to use it in other places?
Comment 15 Oliver Hunt 2010-06-20 11:15:40 PDT
Created attachment 59201 [details]
Patch
Comment 16 WebKit Review Bot 2010-06-20 11:18:43 PDT
Attachment 59201 [details] did not pass style-queue:

Failed to run "['WebKitTools/Scripts/check-webkit-style', '--no-squash']" exit_code: 1
JavaScriptCore/interpreter/Interpreter.cpp:3650:  vm_throw is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]
JavaScriptCore/interpreter/Interpreter.cpp:3802:  vm_throw is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]
JavaScriptCore/interpreter/Interpreter.cpp:4124:  vm_throw is incorrectly named. Don't use underscores in your identifier names.  [readability/naming] [4]
Total errors found: 3 in 5 files


If any of these errors are false positives, please file a bug against check-webkit-style.
Comment 17 Geoffrey Garen 2010-06-21 09:53:45 PDT
Comment on attachment 59201 [details]
Patch

+            CHECK_FOR_EXCEPTION();
+            return 0;

You want VM_THROW_EXCEPTION() instead.

r=me
Comment 18 Oliver Hunt 2010-06-21 10:43:20 PDT
Committed r61553: <http://trac.webkit.org/changeset/61553>
Comment 19 Geoffrey Garen 2010-06-21 11:15:49 PDT
*** Bug 40874 has been marked as a duplicate of this bug. ***