86203 – REGRESSION (r116659?): Assertion failures in JSC marking

Bug 86203 - REGRESSION (r116659?): Assertion failures in JSC marking

Summary: REGRESSION (r116659?): Assertion failures in JSC marking

Status:	RESOLVED FIXED

Alias:	None

Product:	WebKit
Classification:	Unclassified
Component:	JavaScriptCore (show other bugs)
Version:	528+ (Nightly build)
Hardware:	Unspecified Unspecified

Importance:	P1 Normal
Assignee:	Michael Saboff

URL:
Keywords:

Depends on:
Blocks:

Reported:	2012-05-11 05:51 PDT by Antti Koivisto
Modified:	2012-05-11 21:53 PDT (History)
CC List:	5 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Antti Koivisto 2012-05-11 05:51:45 PDT

It looks like we started getting lots of marking related crashes after r116659. 

http://build.webkit.org/results/Lion%20Debug%20(Tests)/r116675%20(6428)/sputnik/Unicode/Unicode_510/S7.6_A3.1-crash-log.txt
http://build.webkit.org/results/Lion%20Debug%20(Tests)/r116675%20(6428)/inspector/debugger/script-formatter-console-crash-log.txt
http://build.webkit.org/results/Lion%20Debug%20(Tests)/r116677%20(6430)/inspector/styles/show-user-agent-styles-crash-log.txt

Comment 1 Geoffrey Garen 2012-05-11 15:27:56 PDT

Seems like the best thing here is to roll out the patch and rework it. I'd suggest returning to the model where all strings are hash-const'd, to make bugs less elusive.

Comment 2 Michael Saboff 2012-05-11 21:52:37 PDT

Rolled out r116659: <http://trac.webkit.org/changeset/116659> in r116822 <http://trac.webkit.org/changeset/116822>.