Bug 48954 - Website consistently crashing TOT in JIT::execute() on news.com.au
Summary: Website consistently crashing TOT in JIT::execute() on news.com.au
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (Intel) OS X 10.6
: P1 Normal
Assignee: Nobody
URL: http://www.news.com.au/technology/wer...
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2010-11-03 14:17 PDT by August Joki
Modified: 2010-11-05 12:43 PDT (History)
2 users (show)

See Also:


Attachments
Patch (3.65 KB, patch)
2010-11-05 12:38 PDT, Oliver Hunt
barraclough: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description August Joki 2010-11-03 14:17:38 PDT
Visiting this site causes the nightly to consistently crash.
Comment 1 Simon Fraser (smfr) 2010-11-03 14:18:44 PDT
Crashes in JIT::execute()
Comment 2 Simon Fraser (smfr) 2010-11-03 14:19:04 PDT
<rdar://problem/8627522>
Comment 3 Oliver Hunt 2010-11-03 22:37:52 PDT
Something is assuming that |this| is an object/cell when in strict mode that is not necessarily true.  Basic searches in the jit don't seem to indicate an obvious place that would be responsible for this.
Comment 4 Oliver Hunt 2010-11-05 12:38:44 PDT
Created attachment 73100 [details]
Patch
Comment 5 Oliver Hunt 2010-11-05 12:43:06 PDT
Committed r71444: <http://trac.webkit.org/changeset/71444>