Bug 47573 – REGRESSION: r69429-r69611: Crash in JSC::Interpreter::privateExecute

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Kevin M. Dean]

When I try to load the above URL, it crashes before completely loading.


Process:         Safari [1895]
Path:            /Applications/WebKit.app/Contents/MacOS/WebKit
Identifier:      org.webkit.nightly.WebKit
Version:         r69611 (69611)
Code Type:       PPC (Native)
Parent Process:  launchd [108]

Date/Time:       2010-10-13 01:57:05.622 -0400
OS Version:      Mac OS X 10.5.8 (9L30)
Report Version:  6
Anonymous UUID:  F41C1802-6457-4B49-A738-107FEBA3B7F7

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x000000000000002c
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.JavaScriptCore      	0x007cd344 JSC::Interpreter::privateExecute(JSC::Interpreter::ExecutionFlag, JSC::RegisterFile*, JSC::ExecState*, JSC::JSValue*) + 63204
1   com.apple.JavaScriptCore      	0x007d2e48 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, JSC::JSValue*) + 1640
2   com.apple.JavaScriptCore      	0x00777d9c JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 76
3   com.apple.WebCore             	0x0202c0b8 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext*) + 584
4   com.apple.WebCore             	0x0202c920 WebCore::ScheduledAction::execute(WebCore::Document*) + 208
5   com.apple.WebCore             	0x0176b59c WebCore::DOMTimer::fired() + 380
6   com.apple.WebCore             	0x02173f00 WebCore::ThreadTimers::sharedTimerFiredInternal() + 128
7   com.apple.WebCore             	0x02072528 __ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv + 72
8   com.apple.CoreFoundation      	0x90693818 CFRunLoopRunSpecific + 2968
9   com.apple.HIToolbox           	0x9325bb14 RunCurrentEventLoopInMode + 264
10  com.apple.HIToolbox           	0x9325b938 ReceiveNextEventCommon + 412
11  com.apple.HIToolbox           	0x9325b778 BlockUntilNextEventMatchingListInMode + 84
12  com.apple.AppKit              	0x9721e244 _DPSNextEvent + 596
13  com.apple.AppKit              	0x9721dbfc -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 112
14  com.apple.Safari              	0x00019044 0x1000 + 98372
15  com.apple.AppKit              	0x9721789c -[NSApplication run] + 744
16  com.apple.AppKit              	0x971e8298 NSApplicationMain + 440
17  com.apple.Safari              	0x0000b648 0x1000 + 42568

[Kevin M. Dean]

On the OUC page, there is a missing javascript that may be contributing to the issue.

http://www.ouc.com/js/MP_JavaScriptCode.js

but previous versions didn't crash because of the missing file.

[Alexey Proskuryakov]

I couldn't reproduce on Intel.

[Kevin M. Dean]

Another link that crashes in the same way.

http://finance.yahoo.com/news/Gaps-logo-back-to-blue-after-apf-3578440916.html?x=0

[Geoffrey Garen]

<rdar://problem/8547598>

I can confirm these two pages also crash in WebKit for MorphOS/PowerPC

[Kevin M. Dean]

It's also definitely not limited to these pages. I have had the same crashed on a variety of difference sites. So much so, that I had to revert back to the non-crashing Nightly.

[Kevin M. Dean]

Still crashing with r70284.

[Kevin M. Dean]

Possibly related to another issue that I'm seeing between the same webkit nightly releases at Bug 48377 .

[Oliver Hunt]

Clearly this is an interpreter crash, i'll try to look at it tomorrow.

[Kevin M. Dean]

Thanks.

[Oliver Hunt]

I have this fixed I just need to verify that the tests pass in the jit as well as the interpreter.

[Oliver Hunt]

Created attachment 72356 [details]
Patch

[Oliver Hunt]

Committed r70910: <http://trac.webkit.org/changeset/70910>

[Oliver Hunt]

Sorry for the delay, this should be fixed in the next nightly.