Bug 47573 - REGRESSION: r69429-r69611: Crash in JSC::Interpreter::privateExecute
: REGRESSION: r69429-r69611: Crash in JSC::Interpreter::privateExecute
Status: RESOLVED FIXED
: WebKit
JavaScriptCore
: 528+ (Nightly build)
: Macintosh PowerPC Mac OS X 10.5
: P1 Critical
Assigned To:
: http://www.ouc.com/
: InRadar, Regression
:
:
  Show dependency treegraph
 
Reported: 2010-10-12 23:12 PST by
Modified: 2010-10-29 11:56 PST (History)


Attachments
Patch (6.58 KB, patch)
2010-10-29 11:35 PST, Oliver Hunt
barraclough: review+
Review Patch | Details | Formatted Diff | Diff


Note

You need to log in before you can comment on or make changes to this bug.


Description From 2010-10-12 23:12:05 PST
When I try to load the above URL, it crashes before completely loading.


Process:         Safari [1895]
Path:            /Applications/WebKit.app/Contents/MacOS/WebKit
Identifier:      org.webkit.nightly.WebKit
Version:         r69611 (69611)
Code Type:       PPC (Native)
Parent Process:  launchd [108]

Date/Time:       2010-10-13 01:57:05.622 -0400
OS Version:      Mac OS X 10.5.8 (9L30)
Report Version:  6
Anonymous UUID:  F41C1802-6457-4B49-A738-107FEBA3B7F7

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x000000000000002c
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.JavaScriptCore          0x007cd344 JSC::Interpreter::privateExecute(JSC::Interpreter::ExecutionFlag, JSC::RegisterFile*, JSC::ExecState*, JSC::JSValue*) + 63204
1   com.apple.JavaScriptCore          0x007d2e48 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, JSC::JSValue*) + 1640
2   com.apple.JavaScriptCore          0x00777d9c JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 76
3   com.apple.WebCore                 0x0202c0b8 WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext*) + 584
4   com.apple.WebCore                 0x0202c920 WebCore::ScheduledAction::execute(WebCore::Document*) + 208
5   com.apple.WebCore                 0x0176b59c WebCore::DOMTimer::fired() + 380
6   com.apple.WebCore                 0x02173f00 WebCore::ThreadTimers::sharedTimerFiredInternal() + 128
7   com.apple.WebCore                 0x02072528 __ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv + 72
8   com.apple.CoreFoundation          0x90693818 CFRunLoopRunSpecific + 2968
9   com.apple.HIToolbox               0x9325bb14 RunCurrentEventLoopInMode + 264
10  com.apple.HIToolbox               0x9325b938 ReceiveNextEventCommon + 412
11  com.apple.HIToolbox               0x9325b778 BlockUntilNextEventMatchingListInMode + 84
12  com.apple.AppKit                  0x9721e244 _DPSNextEvent + 596
13  com.apple.AppKit                  0x9721dbfc -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 112
14  com.apple.Safari                  0x00019044 0x1000 + 98372
15  com.apple.AppKit                  0x9721789c -[NSApplication run] + 744
16  com.apple.AppKit                  0x971e8298 NSApplicationMain + 440
17  com.apple.Safari                  0x0000b648 0x1000 + 42568
------- Comment #1 From 2010-10-12 23:22:54 PST -------
On the OUC page, there is a missing javascript that may be contributing to the issue.

http://www.ouc.com/js/MP_JavaScriptCode.js

but previous versions didn't crash because of the missing file.
------- Comment #2 From 2010-10-13 12:01:23 PST -------
I couldn't reproduce on Intel.
------- Comment #3 From 2010-10-13 13:55:39 PST -------
Another link that crashes in the same way.

http://finance.yahoo.com/news/Gaps-logo-back-to-blue-after-apf-3578440916.html?x=0
------- Comment #4 From 2010-10-13 13:57:44 PST -------
<rdar://problem/8547598>
------- Comment #5 From 2010-10-17 11:40:28 PST -------
I can confirm these two pages also crash in WebKit for MorphOS/PowerPC
------- Comment #6 From 2010-10-17 12:37:27 PST -------
It's also definitely not limited to these pages. I have had the same crashed on a variety of difference sites. So much so, that I had to revert back to the non-crashing Nightly.
------- Comment #7 From 2010-10-22 10:16:00 PST -------
Still crashing with r70284.
------- Comment #8 From 2010-10-26 14:42:32 PST -------
Possibly related to another issue that I'm seeing between the same webkit nightly releases at Bug 48377 .
------- Comment #9 From 2010-10-27 18:55:05 PST -------
Clearly this is an interpreter crash, i'll try to look at it tomorrow.
------- Comment #10 From 2010-10-27 18:56:08 PST -------
Thanks.
------- Comment #11 From 2010-10-29 11:00:26 PST -------
I have this fixed I just need to verify that the tests pass in the jit as well as the interpreter.
------- Comment #12 From 2010-10-29 11:35:48 PST -------
Created an attachment (id=72356) [details]
Patch
------- Comment #13 From 2010-10-29 11:56:13 PST -------
Committed r70910: <http://trac.webkit.org/changeset/70910>
------- Comment #14 From 2010-10-29 11:56:36 PST -------
Sorry for the delay, this should be fixed in the next nightly.