Bug 71227 - REGRESSION (r97118): Reproducible crash in JSCell::toPrimitive when adding
Summary: REGRESSION (r97118): Reproducible crash in JSCell::toPrimitive when adding
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P1 Normal
Assignee: Nobody
URL: http://webmop.de/app/context.html
Keywords: InRadar, Regression
Depends on:
Blocks:
 
Reported: 2011-10-31 10:47 PDT by Alexey Proskuryakov
Modified: 2011-10-31 14:04 PDT (History)
2 users (show)

See Also:


Attachments
the patch (2.03 KB, patch)
2011-10-31 14:00 PDT, Filip Pizlo
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2011-10-31 10:47:21 PDT
Steps to reproduce: open http://webmop.de/app/context.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x000000010afc5c34 JSC::JSCell::toPrimitive(JSC::ExecState*, JSC::PreferredPrimitiveType) const + 4
1   com.apple.JavaScriptCore      	0x000000010af022cd JSC::jsAddSlowCase(JSC::ExecState*, JSC::JSValue, JSC::JSValue) + 941
2   com.apple.JavaScriptCore      	0x000000010ae966e9 cti_op_add + 121
3   ???                           	0x00004cbbf7f54454 0 + 84370202641492
4   com.apple.JavaScriptCore      	0x000000010ae37128 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1112
5   com.apple.JavaScriptCore      	0x000000010ae36cbd JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 45

<rdar://problem/10306791>
Comment 1 Filip Pizlo 2011-10-31 14:00:47 PDT
Created attachment 113084 [details]
the patch
Comment 2 Filip Pizlo 2011-10-31 14:04:03 PDT
Landed in http://trac.webkit.org/changeset/98878