Bug 5379 – KJS::Collector::collect() crash

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: JavaScriptCore

[Jon]

Past few days I've gotten this crash three times. I can't reproduce it, but the last one happened while 
MacObserver was loading and I was scrolling around. 

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   <<00000000>> 	0x00000000 0 + 0
1   com.apple.JavaScriptCore 	0x0010a050 KJS::Collector::collect() + 216 (icplusplus.c:28)
2   com.apple.JavaScriptCore 	0x0010a2c4 KJS::Collector::allocate(unsigned long) + 60 (icplusplus.c:
28)
3   com.apple.JavaScriptCore 	0x0012fa04 KJS::jsString(KJS::UString const&) + 56 (icplusplus.c:28)
4   com.apple.JavaScriptCore 	0x0011a780 KJS::StringNode::evaluate(KJS::ExecState*) + 20 
(icplusplus.c:28)
5   com.apple.JavaScriptCore 	0x0011b454 KJS::ArgumentListNode::evaluateList(KJS::ExecState*) + 80 
(icplusplus.c:28)
6   com.apple.JavaScriptCore 	0x0011b500 KJS::ArgumentsNode::evaluateList(KJS::ExecState*) + 44 
(icplusplus.c:28)
7   com.apple.JavaScriptCore 	0x0011d018 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 340 
(icplusplus.c:28)
8   com.apple.JavaScriptCore 	0x0011aeb8 KJS::EqualNode::evaluate(KJS::ExecState*) + 56 
(icplusplus.c:28)
9   com.apple.JavaScriptCore 	0x0011ca58 KJS::BinaryLogicalNode::evaluate(KJS::ExecState*) + 56 
(icplusplus.c:28)
10  com.apple.JavaScriptCore 	0x0011ca58 KJS::BinaryLogicalNode::evaluate(KJS::ExecState*) + 56 
(icplusplus.c:28)
11  com.apple.JavaScriptCore 	0x0011e9dc KJS::IfNode::execute(KJS::ExecState*) + 104 (icplusplus.c:
28)
12  com.apple.JavaScriptCore 	0x0011f96c KJS::SourceElementsNode::execute(KJS::ExecState*) + 188 
(icplusplus.c:28)
13  com.apple.JavaScriptCore 	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
14  com.apple.JavaScriptCore 	0x001201cc KJS::ForNode::execute(KJS::ExecState*) + 416 (icplusplus.c:
28)
15  com.apple.JavaScriptCore 	0x0011fa14 KJS::SourceElementsNode::execute(KJS::ExecState*) + 356 
(icplusplus.c:28)
16  com.apple.JavaScriptCore 	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
17  com.apple.JavaScriptCore 	0x0011122c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 56 
(icplusplus.c:28)
18  com.apple.JavaScriptCore 	0x00111544 KJS::FunctionImp::callAsFunction(KJS::ExecState*, 
KJS::ObjectImp*, KJS::List const&) + 424 (icplusplus.c:28)
19  com.apple.JavaScriptCore 	0x00125d94 KJS::ObjectImp::call(KJS::ExecState*, KJS::ObjectImp*, 
KJS::List const&) + 96 (icplusplus.c:28)
20  com.apple.JavaScriptCore 	0x00120fb0 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 
452 (icplusplus.c:28)
21  com.apple.JavaScriptCore 	0x0011f66c KJS::VarDeclNode::evaluate(KJS::ExecState*) + 84 
(icplusplus.c:28)
22  com.apple.JavaScriptCore 	0x00121480 KJS::VarDeclListNode::evaluate(KJS::ExecState*) + 68 
(icplusplus.c:28)
23  com.apple.JavaScriptCore 	0x00121394 KJS::VarStatementNode::execute(KJS::ExecState*) + 104 
(icplusplus.c:28)
24  com.apple.JavaScriptCore 	0x0011f96c KJS::SourceElementsNode::execute(KJS::ExecState*) + 188 
(icplusplus.c:28)
25  com.apple.JavaScriptCore 	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
26  com.apple.JavaScriptCore 	0x0011122c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 56 
(icplusplus.c:28)
27  com.apple.JavaScriptCore 	0x00111544 KJS::FunctionImp::callAsFunction(KJS::ExecState*, 
KJS::ObjectImp*, KJS::List const&) + 424 (icplusplus.c:28)
28  com.apple.JavaScriptCore 	0x00125d94 KJS::ObjectImp::call(KJS::ExecState*, KJS::ObjectImp*, 
KJS::List const&) + 96 (icplusplus.c:28)
29  com.apple.WebCore        	0x0049f5f4 KJS::JSAbstractEventListener::handleEvent(DOM::EventImpl*, 
bool) + 476 (icplusplus.c:28)
30  com.apple.WebCore        	0x00531020 DOM::DocumentImpl::defaultEventHandler
(DOM::EventImpl*) + 112 (icplusplus.c:28)
31  com.apple.WebCore        	0x0053c39c DOM::NodeImpl::dispatchGenericEvent(DOM::EventImpl*, 
int&) + 564 (icplusplus.c:28)
32  com.apple.WebCore        	0x0053c66c DOM::NodeImpl::dispatchEvent(DOM::EventImpl*, int&, 
bool) + 148 (icplusplus.c:28)
33  com.apple.WebCore        	0x0053dc40 DOM::NodeImpl::dispatchHTMLEvent(DOM::AtomicString 
const&, bool, bool) + 88 (icplusplus.c:28)
34  com.apple.WebKit         	0x0033d0b4 -[WebHTMLView(WebPrivate) _frameOrBoundsChanged] + 
328 (icplusplus.c:28)
35  com.apple.Foundation     	0x928da0f8 _nsnote_callback + 180
36  com.apple.CoreFoundation 	0x907844b8 __CFXNotificationPost + 368
37  com.apple.CoreFoundation 	0x9077c594 _CFXNotificationPostNotification + 684
38  com.apple.Foundation     	0x928c4500 -[NSNotificationCenter 
postNotificationName:object:userInfo:] + 92
39  com.apple.AppKit         	0x9369c25c -[NSView _postBoundsChangeNotification] + 112
40  com.apple.AppKit         	0x93729014 -[NSView translateOriginToPoint:] + 184
41  com.apple.AppKit         	0x937bb0a4 -[NSClipView _immediateScrollToPoint:] + 1044
42  com.apple.AppKit         	0x937bab08 -[NSScrollView scrollClipView:toPoint:] + 252
43  com.apple.AppKit         	0x93729364 -[NSClipView _scrollTo:animate:] + 744
44  com.apple.AppKit         	0x937ba8e4 -[NSScrollView _doScroller:hitPart:multiplier:] + 788
45  com.apple.AppKit         	0x93a4f3a0 -[NSScrollView scrollWheel:] + 328
46  com.apple.AppKit         	0x9374ed34 forwardMethod + 92
47  com.apple.AppKit         	0x93ac6c44 -[NSView scrollWheel:] + 248
48  com.apple.WebKit         	0x0032d02c -[WebClipView scrollWheel:] + 192 (icplusplus.c:28)
49  com.apple.WebKit         	0x00341f48 -[WebHTMLView scrollWheel:] + 116 (icplusplus.c:28)
50  com.apple.AppKit         	0x936dcd70 -[NSWindow sendEvent:] + 6424
51  com.apple.Safari         	0x0001d130 0x1000 + 114992
52  com.apple.AppKit         	0x936856f4 -[NSApplication sendEvent:] + 4172
53  com.apple.Safari         	0x0001a108 0x1000 + 102664
54  com.apple.AppKit         	0x9367cb30 -[NSApplication run] + 508
55  com.apple.AppKit         	0x9376d618 NSApplicationMain + 452
56  com.apple.Safari         	0x000023dc 0x1000 + 5084
57  com.apple.Safari         	0x00056a9c 0x1000 + 350876

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   <<00000000>> 	0x00000000 0 + 0
1   com.apple.JavaScriptCore       	0x0010a050 KJS::Collector::collect() + 216 (icplusplus.c:28)
2   com.apple.JavaScriptCore       	0x0010a2c4 KJS::Collector::allocate(unsigned long) + 60 
(icplusplus.c:28)
3   com.apple.JavaScriptCore       	0x0012fa04 KJS::jsString(KJS::UString const&) + 56 (icplusplus.c:
28)
4   com.apple.JavaScriptCore       	0x001263d0 KJS::add(KJS::ExecState*, KJS::ValueImp*, 
KJS::ValueImp*, char) + 212 (icplusplus.c:28)
5   com.apple.JavaScriptCore       	0x0011b154 KJS::AddNode::evaluate(KJS::ExecState*) + 56 
(icplusplus.c:28)
6   com.apple.JavaScriptCore       	0x0011b154 KJS::AddNode::evaluate(KJS::ExecState*) + 56 
(icplusplus.c:28)
7   com.apple.JavaScriptCore       	0x0011b154 KJS::AddNode::evaluate(KJS::ExecState*) + 56 
(icplusplus.c:28)
8   com.apple.JavaScriptCore       	0x00120740 KJS::AssignResolveNode::evaluate(KJS::ExecState*) + 
312 (icplusplus.c:28)
9   com.apple.JavaScriptCore       	0x0011eb54 KJS::ExprStatementNode::execute(KJS::ExecState*) + 
104 (icplusplus.c:28)
10  com.apple.JavaScriptCore       	0x001201cc KJS::ForNode::execute(KJS::ExecState*) + 416 
(icplusplus.c:28)
11  com.apple.JavaScriptCore       	0x0011fa14 KJS::SourceElementsNode::execute(KJS::ExecState*) + 
356 (icplusplus.c:28)
12  com.apple.JavaScriptCore       	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
13  com.apple.JavaScriptCore       	0x0011122c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 
56 (icplusplus.c:28)
14  com.apple.JavaScriptCore       	0x00111544 KJS::FunctionImp::callAsFunction(KJS::ExecState*, 
KJS::ObjectImp*, KJS::List const&) + 424 (icplusplus.c:28)
15  com.apple.JavaScriptCore       	0x00125d94 KJS::ObjectImp::call(KJS::ExecState*, KJS::ObjectImp*, 
KJS::List const&) + 96 (icplusplus.c:28)
16  com.apple.JavaScriptCore       	0x00120fb0 KJS::FunctionCallResolveNode::evaluate
(KJS::ExecState*) + 452 (icplusplus.c:28)
17  com.apple.JavaScriptCore       	0x0011b194 KJS::AddNode::evaluate(KJS::ExecState*) + 120 
(icplusplus.c:28)
18  com.apple.JavaScriptCore       	0x00120740 KJS::AssignResolveNode::evaluate(KJS::ExecState*) + 
312 (icplusplus.c:28)
19  com.apple.JavaScriptCore       	0x0011eb54 KJS::ExprStatementNode::execute(KJS::ExecState*) + 
104 (icplusplus.c:28)
20  com.apple.JavaScriptCore       	0x0011fa14 KJS::SourceElementsNode::execute(KJS::ExecState*) + 
356 (icplusplus.c:28)
21  com.apple.JavaScriptCore       	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
22  com.apple.JavaScriptCore       	0x0011122c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 
56 (icplusplus.c:28)
23  com.apple.JavaScriptCore       	0x00111544 KJS::FunctionImp::callAsFunction(KJS::ExecState*, 
KJS::ObjectImp*, KJS::List const&) + 424 (icplusplus.c:28)
24  com.apple.JavaScriptCore       	0x00125d94 KJS::ObjectImp::call(KJS::ExecState*, KJS::ObjectImp*, 
KJS::List const&) + 96 (icplusplus.c:28)
25  com.apple.JavaScriptCore       	0x00120fb0 KJS::FunctionCallResolveNode::evaluate
(KJS::ExecState*) + 452 (icplusplus.c:28)
26  com.apple.JavaScriptCore       	0x0011f2a0 KJS::ReturnNode::execute(KJS::ExecState*) + 224 
(icplusplus.c:28)
27  com.apple.JavaScriptCore       	0x0011fa14 KJS::SourceElementsNode::execute(KJS::ExecState*) + 
356 (icplusplus.c:28)
28  com.apple.JavaScriptCore       	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
29  com.apple.JavaScriptCore       	0x0011122c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 
56 (icplusplus.c:28)
30  com.apple.JavaScriptCore       	0x00111544 KJS::FunctionImp::callAsFunction(KJS::ExecState*, 
KJS::ObjectImp*, KJS::List const&) + 424 (icplusplus.c:28)
31  com.apple.JavaScriptCore       	0x00125d94 KJS::ObjectImp::call(KJS::ExecState*, KJS::ObjectImp*, 
KJS::List const&) + 96 (icplusplus.c:28)
32  com.apple.JavaScriptCore       	0x00120fb0 KJS::FunctionCallResolveNode::evaluate
(KJS::ExecState*) + 452 (icplusplus.c:28)
33  com.apple.JavaScriptCore       	0x001206d4 KJS::AssignResolveNode::evaluate(KJS::ExecState*) + 
204 (icplusplus.c:28)
34  com.apple.JavaScriptCore       	0x0011eb54 KJS::ExprStatementNode::execute(KJS::ExecState*) + 
104 (icplusplus.c:28)
35  com.apple.JavaScriptCore       	0x0011fa14 KJS::SourceElementsNode::execute(KJS::ExecState*) + 
356 (icplusplus.c:28)
36  com.apple.JavaScriptCore       	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
37  com.apple.JavaScriptCore       	0x00115f90 KJS::InterpreterImp::evaluate(KJS::UString const&, 
KJS::ValueImp*, KJS::UString const&, int) + 660 (icplusplus.c:28)
38  com.apple.JavaScriptCore       	0x001180b0 KJS::Interpreter::evaluate(KJS::UString const&, int, 
KJS::UString const&, KJS::ValueImp*) + 64 (icplusplus.c:28)
39  com.apple.WebCore              	0x004b3944 KJSProxyImpl::evaluate(QString, int, QString const&, 
DOM::NodeImpl*) + 184 (icplusplus.c:28)
40  com.apple.WebCore              	0x0046fb34 KHTMLPart::executeScript(QString, int, 
DOM::NodeImpl*, QString const&) + 152 (icplusplus.c:28)
41  com.apple.WebCore              	0x004ee900 khtml::HTMLTokenizer::scriptExecution(QString 
const&, QString, int) + 220 (icplusplus.c:28)
42  com.apple.WebCore              	0x004eeb60 khtml::HTMLTokenizer::notifyFinished
(khtml::CachedObject*) + 312 (icplusplus.c:28)
43  com.apple.WebCore              	0x004efc80 khtml::HTMLTokenizer::scriptHandler() + 568 
(icplusplus.c:28)
44  com.apple.WebCore              	0x004f02fc khtml::HTMLTokenizer::parseSpecial
(khtml::TokenizerString&) + 84 (icplusplus.c:28)
45  com.apple.WebCore              	0x004f172c khtml::HTMLTokenizer::parseTag
(khtml::TokenizerString&) + 4036 (icplusplus.c:28)
46  com.apple.WebCore              	0x004f1bbc khtml::HTMLTokenizer::write(khtml::TokenizerString 
const&, bool) + 748 (icplusplus.c:28)
47  com.apple.WebCore              	0x0046fefc KHTMLPart::write(char const*, int) + 628 (icplusplus.c:
28)
48  com.apple.WebKit               	0x0033055c -[WebDataSource(WebPrivate) _commitLoadWithData:] 
+ 96 (icplusplus.c:28)
49  com.apple.WebKit               	0x0034efe0 -[WebMainResourceLoader addData:] + 88 
(icplusplus.c:28)
50  com.apple.WebKit               	0x0032c498 -[WebLoader didReceiveData:lengthReceived:] + 68 
(icplusplus.c:28)
51  com.apple.WebKit               	0x0034f9dc -[WebMainResourceLoader 
didReceiveData:lengthReceived:] + 140 (icplusplus.c:28)
52  com.apple.WebKit               	0x0032c9d8 -[WebLoader 
connection:didReceiveData:lengthReceived:] + 64 (icplusplus.c:28)
53  com.apple.Foundation           	0x9290cb44 -[NSURLConnection(NSURLConnectionInternal) 
_sendDidReceiveDataCallback] + 564
54  com.apple.Foundation           	0x9290afe4 -[NSURLConnection(NSURLConnectionInternal) 
_sendCallbacks] + 488
55  com.apple.Foundation           	0x9290ad80 _sendCallbacks + 156
56  com.apple.CoreFoundation       	0x9075da5c __CFRunLoopDoSources0 + 384
57  com.apple.CoreFoundation       	0x9075cf8c __CFRunLoopRun + 452
58  com.apple.CoreFoundation       	0x9075ca0c CFRunLoopRunSpecific + 268
59  com.apple.HIToolbox            	0x93182260 RunCurrentEventLoopInMode + 264
60  com.apple.HIToolbox            	0x931818f4 ReceiveNextEventCommon + 380
61  com.apple.HIToolbox            	0x93181760 BlockUntilNextEventMatchingListInMode + 96
62  com.apple.AppKit               	0x93680904 _DPSNextEvent + 384
63  com.apple.AppKit               	0x936805c8 -[NSApplication 
nextEventMatchingMask:untilDate:inMode:dequeue:] + 116
64  com.apple.Safari               	0x00006c70 0x1000 + 23664
65  com.apple.AppKit               	0x9367cb0c -[NSApplication run] + 472
66  com.apple.AppKit               	0x9376d618 NSApplicationMain + 452
67  com.apple.Safari               	0x000023dc 0x1000 + 5084
68  com.apple.Safari               	0x00056a9c 0x1000 + 350876

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   <<00000000>> 	0x00000000 0 + 0
1   com.apple.JavaScriptCore 	0x0010a050 KJS::Collector::collect() + 216 (icplusplus.c:28)
2   com.apple.JavaScriptCore 	0x0010a2c4 KJS::Collector::allocate(unsigned long) + 60 (icplusplus.c:
28)
3   com.apple.JavaScriptCore 	0x0012fa04 KJS::jsString(KJS::UString const&) + 56 (icplusplus.c:28)
4   com.apple.JavaScriptCore 	0x00129664 KJS::StringInstanceImp::StringInstanceImp[in-charge]
(KJS::ObjectImp*, KJS::UString const&) + 60 (icplusplus.c:28)
5   com.apple.JavaScriptCore 	0x00129dc0 KJS::StringObjectImp::construct(KJS::ExecState*, KJS::List 
const&) + 156 (icplusplus.c:28)
6   com.apple.JavaScriptCore 	0x00114a1c KJS::StringImp::toObject(KJS::ExecState*) const + 80 
(icplusplus.c:28)
7   com.apple.JavaScriptCore 	0x0011cf10 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 76 
(icplusplus.c:28)
8   com.apple.JavaScriptCore 	0x001206d4 KJS::AssignResolveNode::evaluate(KJS::ExecState*) + 204 
(icplusplus.c:28)
9   com.apple.JavaScriptCore 	0x0011eb54 KJS::ExprStatementNode::execute(KJS::ExecState*) + 104 
(icplusplus.c:28)
10  com.apple.JavaScriptCore 	0x0011f96c KJS::SourceElementsNode::execute(KJS::ExecState*) + 188 
(icplusplus.c:28)
11  com.apple.JavaScriptCore 	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
12  com.apple.JavaScriptCore 	0x0011ff3c KJS::WhileNode::execute(KJS::ExecState*) + 448 
(icplusplus.c:28)
13  com.apple.JavaScriptCore 	0x0011fa14 KJS::SourceElementsNode::execute(KJS::ExecState*) + 356 
(icplusplus.c:28)
14  com.apple.JavaScriptCore 	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
15  com.apple.JavaScriptCore 	0x0011122c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 56 
(icplusplus.c:28)
16  com.apple.JavaScriptCore 	0x00111544 KJS::FunctionImp::callAsFunction(KJS::ExecState*, 
KJS::ObjectImp*, KJS::List const&) + 424 (icplusplus.c:28)
17  com.apple.JavaScriptCore 	0x00125d94 KJS::ObjectImp::call(KJS::ExecState*, KJS::ObjectImp*, 
KJS::List const&) + 96 (icplusplus.c:28)
18  com.apple.JavaScriptCore 	0x00120fb0 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 
452 (icplusplus.c:28)
19  com.apple.JavaScriptCore 	0x0011eb54 KJS::ExprStatementNode::execute(KJS::ExecState*) + 104 
(icplusplus.c:28)
20  com.apple.JavaScriptCore 	0x0011fa14 KJS::SourceElementsNode::execute(KJS::ExecState*) + 356 
(icplusplus.c:28)
21  com.apple.JavaScriptCore 	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
22  com.apple.JavaScriptCore 	0x0011122c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 56 
(icplusplus.c:28)
23  com.apple.JavaScriptCore 	0x00111544 KJS::FunctionImp::callAsFunction(KJS::ExecState*, 
KJS::ObjectImp*, KJS::List const&) + 424 (icplusplus.c:28)
24  com.apple.JavaScriptCore 	0x00125d94 KJS::ObjectImp::call(KJS::ExecState*, KJS::ObjectImp*, 
KJS::List const&) + 96 (icplusplus.c:28)
25  com.apple.JavaScriptCore 	0x00120fb0 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 
452 (icplusplus.c:28)
26  com.apple.JavaScriptCore 	0x0011b194 KJS::AddNode::evaluate(KJS::ExecState*) + 120 
(icplusplus.c:28)
27  com.apple.JavaScriptCore 	0x00120740 KJS::AssignResolveNode::evaluate(KJS::ExecState*) + 312 
(icplusplus.c:28)
28  com.apple.JavaScriptCore 	0x0011eb54 KJS::ExprStatementNode::execute(KJS::ExecState*) + 104 
(icplusplus.c:28)
29  com.apple.JavaScriptCore 	0x0011fa14 KJS::SourceElementsNode::execute(KJS::ExecState*) + 356 
(icplusplus.c:28)
30  com.apple.JavaScriptCore 	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
31  com.apple.JavaScriptCore 	0x0011122c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 56 
(icplusplus.c:28)
32  com.apple.JavaScriptCore 	0x00111544 KJS::FunctionImp::callAsFunction(KJS::ExecState*, 
KJS::ObjectImp*, KJS::List const&) + 424 (icplusplus.c:28)
33  com.apple.JavaScriptCore 	0x00125d94 KJS::ObjectImp::call(KJS::ExecState*, KJS::ObjectImp*, 
KJS::List const&) + 96 (icplusplus.c:28)
34  com.apple.JavaScriptCore 	0x00120fb0 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 
452 (icplusplus.c:28)
35  com.apple.JavaScriptCore 	0x0011eb54 KJS::ExprStatementNode::execute(KJS::ExecState*) + 104 
(icplusplus.c:28)
36  com.apple.JavaScriptCore 	0x0011fa14 KJS::SourceElementsNode::execute(KJS::ExecState*) + 356 
(icplusplus.c:28)
37  com.apple.JavaScriptCore 	0x0011f898 KJS::BlockNode::execute(KJS::ExecState*) + 132 
(icplusplus.c:28)
38  com.apple.JavaScriptCore 	0x0011122c KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 56 
(icplusplus.c:28)
39  com.apple.JavaScriptCore 	0x00111544 KJS::FunctionImp::callAsFunction(KJS::ExecState*, 
KJS::ObjectImp*, KJS::List const&) + 424 (icplusplus.c:28)
40  com.apple.JavaScriptCore 	0x00125d94 KJS::ObjectImp::call(KJS::ExecState*, KJS::ObjectImp*, 
KJS::List const&) + 96 (icplusplus.c:28)
41  com.apple.WebCore        	0x0049f674 KJS::JSAbstractEventListener::handleEvent(DOM::EventImpl*, 
bool) + 476 (icplusplus.c:28)
42  com.apple.WebCore        	0x0053b534 DOM::NodeImpl::handleLocalEvents(DOM::EventImpl*, 
bool) + 200 (icplusplus.c:28)
43  com.apple.WebCore        	0x0053c314 DOM::NodeImpl::dispatchGenericEvent(DOM::EventImpl*, 
int&) + 416 (icplusplus.c:28)
44  com.apple.WebCore        	0x0053c678 DOM::NodeImpl::dispatchEvent(DOM::EventImpl*, int&, 
bool) + 148 (icplusplus.c:28)
45  com.apple.WebCore        	0x0053d864 DOM::NodeImpl::dispatchMouseEvent(DOM::AtomicString 
const&, int, int, int, int, int, int, bool, bool, bool, bool) + 300 (icplusplus.c:28)
46  com.apple.WebCore        	0x0053dbd0 DOM::NodeImpl::dispatchMouseEvent(QMouseEvent*, 
DOM::AtomicString const&, int) + 448 (icplusplus.c:28)
47  com.apple.WebCore        	0x00473dc0 KHTMLView::dispatchMouseEvent(DOM::AtomicString 
const&, DOM::NodeImpl*, bool, int, QMouseEvent*, bool, int) + 504 (icplusplus.c:28)
48  com.apple.WebCore        	0x00473ff4 KHTMLView::viewportMouseReleaseEvent(QMouseEvent*) + 
356 (icplusplus.c:28)
49  com.apple.WebCore        	0x0042c1c0 KWQKHTMLPart::mouseUp(NSEvent*) + 244 (icplusplus.c:
28)
50  com.apple.WebKit         	0x00343340 -[WebHTMLView mouseUp:] + 168 (icplusplus.c:28)
51  com.apple.AppKit         	0x936dc6d0 -[NSWindow sendEvent:] + 4728
52  com.apple.Safari         	0x0001d130 0x1000 + 114992
53  com.apple.AppKit         	0x936856f4 -[NSApplication sendEvent:] + 4172
54  com.apple.Safari         	0x0001a108 0x1000 + 102664
55  com.apple.AppKit         	0x9367cb30 -[NSApplication run] + 508
56  com.apple.AppKit         	0x9376d618 NSApplicationMain + 452
57  com.apple.Safari         	0x000023dc 0x1000 + 5084
58  com.apple.Safari         	0x00056a9c 0x1000 + 350876

[Jon]

Another one, this time while at Ars, after clicking a topic link.

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   <<00000000>> 	0x00000000 0 + 0
1   com.apple.JavaScriptCore 	0x0010a0c4 KJS::Collector::collect() + 332 (icplusplus.c:28)
2   com.apple.WebCore        	0x004b8300 KJS::Window::clear(KJS::ExecState*) + 188 (icplusplus.c:28)
3   com.apple.WebCore        	0x0046cf80 KHTMLPart::clear() + 156 (icplusplus.c:28)
4   com.apple.WebCore        	0x0046e854 KHTMLPart::begin(KURL const&, int, int) + 96 (icplusplus.c:
28)
5   com.apple.WebCore        	0x0046b974 KHTMLPart::receivedFirstData() + 124 (icplusplus.c:28)
6   com.apple.WebCore        	0x0042d628 KWQKHTMLPart::setEncoding(QString const&, bool) + 56 
(icplusplus.c:28)
7   com.apple.WebCore        	0x00462bb0 -[WebCoreBridge setEncoding:userChosen:] + 60 
(icplusplus.c:28)
8   com.apple.WebKit         	0x0031d8a4 -[WebBridge receivedData:textEncodingName:] + 100 
(icplusplus.c:28)
9   com.apple.WebKit         	0x0033053c -[WebDataSource(WebPrivate) _commitLoadWithData:] + 
96 (icplusplus.c:28)
10  com.apple.WebKit         	0x0034eff0 -[WebMainResourceLoader addData:] + 88 (icplusplus.c:28)
11  com.apple.WebKit         	0x0032c478 -[WebLoader didReceiveData:lengthReceived:] + 68 
(icplusplus.c:28)
12  com.apple.WebKit         	0x0034f9ec -[WebMainResourceLoader didReceiveData:lengthReceived:] 
+ 140 (icplusplus.c:28)
13  com.apple.WebKit         	0x0032c9b8 -[WebLoader connection:didReceiveData:lengthReceived:] 
+ 64 (icplusplus.c:28)
14  com.apple.Foundation     	0x9290cb44 -[NSURLConnection(NSURLConnectionInternal) 
_sendDidReceiveDataCallback] + 564
15  com.apple.Foundation     	0x9290afe4 -[NSURLConnection(NSURLConnectionInternal) 
_sendCallbacks] + 488
16  com.apple.Foundation     	0x9290ad80 _sendCallbacks + 156
17  com.apple.CoreFoundation 	0x9075da5c __CFRunLoopDoSources0 + 384
18  com.apple.CoreFoundation 	0x9075cf8c __CFRunLoopRun + 452
19  com.apple.CoreFoundation 	0x9075ca0c CFRunLoopRunSpecific + 268
20  com.apple.HIToolbox      	0x931821e0 RunCurrentEventLoopInMode + 264
21  com.apple.HIToolbox      	0x93181874 ReceiveNextEventCommon + 380
22  com.apple.HIToolbox      	0x931816e0 BlockUntilNextEventMatchingListInMode + 96
23  com.apple.AppKit         	0x93680904 _DPSNextEvent + 384
24  com.apple.AppKit         	0x936805c8 -[NSApplication 
nextEventMatchingMask:untilDate:inMode:dequeue:] + 116
25  com.apple.Safari         	0x00006c70 0x1000 + 23664
26  com.apple.AppKit         	0x9367cb0c -[NSApplication run] + 472
27  com.apple.AppKit         	0x9376d618 NSApplicationMain + 452
28  com.apple.Safari         	0x000023dc 0x1000 + 5084
29  com.apple.Safari         	0x00056a9c 0x1000 + 350876

[Joost de Valk (AlthA)]

Reassigning to webkit-unassigned, to make sure more people see this.

[Joost de Valk (AlthA)]

Jon, is this still happening for you?

[Mark Rowe (bdash)]

Jon, are you aple to reproduce this with a more recent build of WebKit?  Instructions on how to reproduce the crash would also be appreciated if possible.

[Jon]

I've only seen this crash once in the last month, so no, I don't have any directions for reproduction. It's been a while since it was a regular occurence, but it does still occur.

[Geoffrey Garen]

Sure looks like bug 9256.

*** This bug has been marked as a duplicate of 9256 ***

[Alexey Proskuryakov]

(In reply to comment #6)
> Sure looks like bug 9256.

Does it?

[Bradley Morrison]

(In reply to comment #7)
> (In reply to comment #6)
> > Sure looks like bug 9256.
> Does it?

Not to me, 9256 was a crash on S60 mobile phones only. Methinks a typo ;-)

[Geoffrey Garen]

Typo.

*** This bug has been marked as a duplicate of 9748 ***