Bug 43039 - [Qt] REGRESSION(r62898): tst_QWebFrame crashing
Summary: [Qt] REGRESSION(r62898): tst_QWebFrame crashing
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Qt (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P1 Normal
Assignee: QtWebKit Unassigned
URL:
Keywords: Qt, QtTriaged, Regression
Depends on:
Blocks:
 
Reported: 2010-07-27 04:05 PDT by Andreas Kling
Modified: 2010-09-02 06:28 PDT (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Kling 2010-07-27 04:05:27 PDT 
Regressed with <http://trac.webkit.org/changeset/62898> (bug 40352)

Invalid read of size 4, address 0x3fdc0 is not stack'd, malloc'd or (recently) free'd

JSC::Heap::allocate(unsigned long) (Collector.h:220)
JSC::ErrorInstance::create(JSC::JSGlobalData*, WTF::NonNullPassRefPtr<JSC::Structure>, JSC::UString const&) (JSCell.h:170)
JSC::createError(JSC::ExecState*, JSC::UString const&) (Error.cpp:48)
JSC::Bindings::QtField::valueFromInstance(JSC::ExecState*, JSC::Bindings::Instance const*) const (qt_instance.cpp:391)
JSC::Bindings::QtInstance::markAggregate(JSC::MarkStack&) (qt_instance.cpp:217)
JSC::Bindings::QtRuntimeObject::markChildren(JSC::MarkStack&) (qt_instance.cpp:57)
JSC::Heap::markProtectedObjects(JSC::MarkStack&) (JSArray.h:202)
JSC::Heap::markRoots() (Collector.cpp:1092)
JSC::Heap::allocate(unsigned long) (Collector.cpp:1225)
JSC::InternalFunction::InternalFunction(JSC::JSGlobalData*, JSC::JSGlobalObject*, WTF::NonNullPassRefPtr<JSC::Structure>, JSC::Identifier const&) (JSCell.h:170)
JSC::NumberConstructor::NumberConstructor(JSC::ExecState*, JSC::JSGlobalObject*, WTF::NonNullPassRefPtr<JSC::Structure>, JSC::NumberPrototype*) (NumberConstructor.cpp:58)
JSC::JSGlobalObject::reset(JSC::JSValue) (JSGlobalObject.cpp:255)
JSC::JSGlobalObject::init(JSC::JSObject*) (JSGlobalObject.cpp:149)
WebCore::JSDOMGlobalObject::JSDOMGlobalObject(WTF::NonNullPassRefPtr<JSC::Structure>, WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData*, JSC::JSObject*) (JSGlobalObject.h:186)
WebCore::JSDOMWindowBase::JSDOMWindowBase(WTF::NonNullPassRefPtr<JSC::Structure>, WTF::PassRefPtr<WebCore::DOMWindow>, WebCore::JSDOMWindowShell*) (JSDOMWindowBase.cpp:56)
WebCore::JSDOMWindow::JSDOMWindow(WTF::NonNullPassRefPtr<JSC::Structure>, WTF::PassRefPtr<WebCore::DOMWindow>, WebCore::JSDOMWindowShell*) (JSDOMWindow.cpp:956)
WebCore::JSDOMWindowShell::setWindow(WTF::PassRefPtr<WebCore::DOMWindow>) (JSDOMWindowShell.cpp:67)
WebCore::ScriptController::clearWindowShell(bool) (ScriptController.cpp:204)
WebCore::Frame::pageDestroyed() (Frame.cpp:1359)
WebCore::FrameLoader::detachFromParent() (FrameLoader.cpp:2654)
QWebPage::~QWebPage() (qwebpage.cpp:1883)
QWebViewPrivate::detachCurrentPage() (qwebview.cpp:372)
QWebViewPrivate::~QWebViewPrivate() (qwebview.cpp:60)
QWebView::~QWebView() (qwebview.cpp:329)
tst_QWebFrame::cleanup() (tst_qwebframe.cpp:736)
tst_QWebFrame::qt_metacall(QMetaObject::Call, int, void**) (tst_qwebframe.moc:662)
QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) (qmetaobject.cpp:237)
QMetaMethod::invoke(QObject*, Qt::ConnectionType, QGenericReturnArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument) const (qmetaobject.cpp:1575)
QTest::invokeMethod(QObject*, char const*) (qmetaobject.h:119)
QTest::qInvokeTestMethod(char const*, char const*) (qtestcase.cpp:1241)
QTest::qExec(QObject*, int, char**) (qtestcase.cpp:1499)
main (tst_qwebframe.cpp:3104)
Comment 1 Andreas Kling 2010-09-02 06:28:19 PDT 
Committed r66667: <http://trac.webkit.org/changeset/66667>