The JSC::Bindings::Instance::createRuntimeObject(JSC::ExecState*) + 199 (BridgeJSC.cpp:91) crash has only been seen manifesting in the following 2 tests and builds (not an exhaustive list): - editing/pasteboard/paste-TIFF.html (build 1670, 1720, 2141, 2171, 2194, 2195, 2247, 2250) - platform/mac/editing/pasteboard/dataTransfer-set-data-file-url.html (build 2057, 2130, 2205, 2211) The crash is intermittent. I verified that the crash manifest on each of these tests individually by running each test alone and repeatedly. Skipping these tests until this issue is resolved.
Created attachment 160787 [details] Gardening.
Regarding the JSC::Bindings::Instance::createRuntimeObject(JSC::ExecState*) crash, I have to run the test repeatedly in order for the failure to manifest. This was possible with the WK1 test. On the WK2 test, the same repetition approach was not successful at manifesting the issue. This suggests that the crash could be due to either a JS JIT or GC issue that requires a warm up period. On the WK2 test run, the VM is torn down and restarted on each test. Hence, it never got a chance to warm up to the state that can manifest the issue.
The bug tracking this issue is https://bugs.webkit.org/show_bug.cgi?id=93878.
Comment on attachment 160787 [details] Gardening. Clearing flags on attachment: 160787 Committed r126801: <http://trac.webkit.org/changeset/126801>
All reviewed patches have been landed. Closing bug.