Bug 47573 - REGRESSION: r69429-r69611: Crash in JSC::Interpreter::privateExecute
: REGRESSION: r69429-r69611: Crash in JSC::Interpreter::privateExecute
Status: RESOLVED FIXED
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore
: 528+ (Nightly build)
: Macintosh PowerPC Mac OS X 10.5
: P1 Critical
Assigned To: Nobody
http://www.ouc.com/
: InRadar, Regression
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-10-12 23:12 PDT by Kevin M. Dean
Modified: 2010-10-29 11:56 PDT (History)
3 users (show)

See Also:


Attachments
Patch (6.58 KB, patch)
2010-10-29 11:35 PDT, Oliver Hunt
barraclough: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Kevin M. Dean 2010-10-12 23:12:05 PDT
When I try to load the above URL, it crashes before completely loading.


Process:         Safari [1895]
Path:            /Applications/WebKit.app/Contents/MacOS/WebKit
Identifier:      org.webkit.nightly.WebKit
Version:         r69611 (69611)
Code Type:       PPC (Native)
Parent Process:  launchd [108]

Date/Time:       2010-10-13 01:57:05.622 -0400
OS Version:      Mac OS X 10.5.8 (9L30)
Report Version:  6
Anonymous UUID:  F41C1802-6457-4B49-A738-107FEBA3B7F7

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x000000000000002c
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.JavaScriptCore      	0x007cd344 JSC::Interpreter::privateExecute(JSC::Interpreter::ExecutionFlag, JSC::RegisterFile*, JSC::ExecState*, JSC::JSValue*) + 63204
1   com.apple.JavaScriptCore      	0x007d2e48 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, JSC::JSValue*) + 1640
2   com.apple.JavaScriptCore      	0x00777d9c JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 76
3   com.apple.WebCore             	0x0202c0b8 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext*) + 584
4   com.apple.WebCore             	0x0202c920 WebCore::ScheduledAction::execute(WebCore::Document*) + 208
5   com.apple.WebCore             	0x0176b59c WebCore::DOMTimer::fired() + 380
6   com.apple.WebCore             	0x02173f00 WebCore::ThreadTimers::sharedTimerFiredInternal() + 128
7   com.apple.WebCore             	0x02072528 __ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv + 72
8   com.apple.CoreFoundation      	0x90693818 CFRunLoopRunSpecific + 2968
9   com.apple.HIToolbox           	0x9325bb14 RunCurrentEventLoopInMode + 264
10  com.apple.HIToolbox           	0x9325b938 ReceiveNextEventCommon + 412
11  com.apple.HIToolbox           	0x9325b778 BlockUntilNextEventMatchingListInMode + 84
12  com.apple.AppKit              	0x9721e244 _DPSNextEvent + 596
13  com.apple.AppKit              	0x9721dbfc -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 112
14  com.apple.Safari              	0x00019044 0x1000 + 98372
15  com.apple.AppKit              	0x9721789c -[NSApplication run] + 744
16  com.apple.AppKit              	0x971e8298 NSApplicationMain + 440
17  com.apple.Safari              	0x0000b648 0x1000 + 42568
Comment 1 Kevin M. Dean 2010-10-12 23:22:54 PDT
On the OUC page, there is a missing javascript that may be contributing to the issue.

http://www.ouc.com/js/MP_JavaScriptCode.js

but previous versions didn't crash because of the missing file.
Comment 2 Alexey Proskuryakov 2010-10-13 12:01:23 PDT
I couldn't reproduce on Intel.
Comment 3 Kevin M. Dean 2010-10-13 13:55:39 PDT
Another link that crashes in the same way.

http://finance.yahoo.com/news/Gaps-logo-back-to-blue-after-apf-3578440916.html?x=0
Comment 4 Geoffrey Garen 2010-10-13 13:57:44 PDT
<rdar://problem/8547598>
Comment 5 fabien.coeurjoly 2010-10-17 11:40:28 PDT
I can confirm these two pages also crash in WebKit for MorphOS/PowerPC
Comment 6 Kevin M. Dean 2010-10-17 12:37:27 PDT
It's also definitely not limited to these pages. I have had the same crashed on a variety of difference sites. So much so, that I had to revert back to the non-crashing Nightly.
Comment 7 Kevin M. Dean 2010-10-22 10:16:00 PDT
Still crashing with r70284.
Comment 8 Kevin M. Dean 2010-10-26 14:42:32 PDT
Possibly related to another issue that I'm seeing between the same webkit nightly releases at Bug 48377 .
Comment 9 Oliver Hunt 2010-10-27 18:55:05 PDT
Clearly this is an interpreter crash, i'll try to look at it tomorrow.
Comment 10 Kevin M. Dean 2010-10-27 18:56:08 PDT
Thanks.
Comment 11 Oliver Hunt 2010-10-29 11:00:26 PDT
I have this fixed I just need to verify that the tests pass in the jit as well as the interpreter.
Comment 12 Oliver Hunt 2010-10-29 11:35:48 PDT
Created attachment 72356 [details]
Patch
Comment 13 Oliver Hunt 2010-10-29 11:56:13 PDT
Committed r70910: <http://trac.webkit.org/changeset/70910>
Comment 14 Oliver Hunt 2010-10-29 11:56:36 PDT
Sorry for the delay, this should be fixed in the next nightly.