Bug 97328 – REGRESSION (r128400): Opening Google Web Fonts page hangs or crashes

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

Since WebKit-SVN-r128500 up to actual r129183 I cannot open the google fontsite http://www.google.com/webfonts in SnowLeopard.
From r128500 on I got a blank page and a spinnig beachball until force quit.
Since r128854 the page content is shown (blinking 5 times) and then an error message ist shown (Seite kann nicht geladen werden).
It worked up to r128168.
Similar problem existed in r127699, was fixed in r127810.

[Alexey Proskuryakov]

I can reproduce on 10.8. I'm getting either a hang or a crash, seemingly randomly:

r128267 works
r128393 works
r128397 works
r128399 works
r128400 hang
r128403 crash
r128413 hang
r128434 crash
r128479 hang
r128602 crash

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x00000001024b4a1b JSC::JSObject::putByIndexBeyondVectorLengthWithArrayStorage(JSC::ExecState*, unsigned int, JSC::JSValue, bool, JSC::ArrayStorage*) + 635
1   com.apple.JavaScriptCore      	0x00000001024b1467 JSC::JSObject::putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned int, JSC::JSValue, bool) + 215
2   com.apple.JavaScriptCore      	0x000000010241ace2 operationPutByValBeyondArrayBoundsNonStrict + 82
3   ???                           	0x0000592ac968966a 0 + 98040302573162
4   com.apple.JavaScriptCore      	0x000000010248475a JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 3482

[Alexey Proskuryakov]

<rdar://problem/12346666>

[Filip Pizlo]

Created attachment 165222 [details]
the patch

[Mark Hahnenberg]

Comment on attachment 165222 [details]
the patch

r=me

[Filip Pizlo]

Landed in http://trac.webkit.org/changeset/129272

Confirmed. Fixed in r129297. Thank You.