[Webkit-unassigned] [Bug 16919] New: Crash in FunctionCallDotNode::evaluate @ partlyhuman.com

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=16919

           Summary: Crash in FunctionCallDotNode::evaluate @ partlyhuman.com
           Product: WebKit
           Version: 525+ (Nightly build)
          Platform: Macintosh
        OS/Version: Mac OS X 10.4
            Status: NEW
          Keywords: InRadar
          Severity: Critical
          Priority: P1
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: ggaren at apple.com
                CC: mjs at apple.com, cwzwarich at uwaterloo.ca


<rdar://problem/5694080>

Visit http://www.partlyhuman.com/blog/roger/aliased-text-mac-eclipse
--> crash

Regressed at r29425, the ActivationImp change.

Thread 0 Crashed:
0   com.apple.JavaScriptCore            0x0030c0a9
KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 281
1   com.apple.JavaScriptCore            0x00364639
KJS::AssignLocalVarNode::evaluate(KJS::ExecState*) + 25
2   com.apple.JavaScriptCore            0x0030e649
KJS::ExprStatementNode::execute(KJS::ExecState*) + 25
3   com.apple.JavaScriptCore            0x0030b870
KJS::BlockNode::execute(KJS::ExecState*) + 64
4   com.apple.JavaScriptCore            0x0035c65e
KJS::IfElseNode::execute(KJS::ExecState*) + 78
5   com.apple.JavaScriptCore            0x0030b870
KJS::BlockNode::execute(KJS::ExecState*) + 64
6   com.apple.JavaScriptCore            0x003119e6
KJS::ForNode::execute(KJS::ExecState*) + 102
7   com.apple.JavaScriptCore            0x0035c92a
KJS::CaseBlockNode::executeBlock(KJS::ExecState*, KJS::JSValue*) + 586
8   com.apple.JavaScriptCore            0x003257bf
KJS::SwitchNode::execute(KJS::ExecState*) + 79
9   com.apple.JavaScriptCore            0x003815e1
KJS::FunctionBodyNode::execute(KJS::ExecState*) + 433
10  com.apple.JavaScriptCore            0x0030e7a9
KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List
const&) + 73
11  com.apple.JavaScriptCore            0x00312b70
KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 896
12  com.apple.JavaScriptCore            0x0036071b
KJS::ArgumentListNode::evaluateList(KJS::ExecState*, KJS::List&) + 43
13  com.apple.JavaScriptCore            0x0030c13b
KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 427
14  com.apple.JavaScriptCore            0x00364639
KJS::AssignLocalVarNode::evaluate(KJS::ExecState*) + 25
15  com.apple.JavaScriptCore            0x0030e649
KJS::ExprStatementNode::execute(KJS::ExecState*) + 25
16  com.apple.JavaScriptCore            0x0030b870
KJS::BlockNode::execute(KJS::ExecState*) + 64
17  com.apple.JavaScriptCore            0x003119e6
KJS::ForNode::execute(KJS::ExecState*) + 102
18  com.apple.JavaScriptCore            0x003815e1
KJS::FunctionBodyNode::execute(KJS::ExecState*) + 433
19  com.apple.JavaScriptCore            0x0030e7a9
KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List
const&) + 73
20  com.apple.JavaScriptCore            0x00312b70
KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 896
21  com.apple.JavaScriptCore            0x00364639
KJS::AssignLocalVarNode::evaluate(KJS::ExecState*) + 25
22  com.apple.JavaScriptCore            0x0030ba29
KJS::VarStatementNode::execute(KJS::ExecState*) + 25
23  com.apple.JavaScriptCore            0x003815e1
KJS::FunctionBodyNode::execute(KJS::ExecState*) + 433
24  com.apple.JavaScriptCore            0x0030e7a9
KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List
const&) + 73
25  com.apple.JavaScriptCore            0x0034b1dc
KJS::functionProtoFuncApply(KJS::ExecState*, KJS::JSObject*, KJS::List const&)
+ 588
26  com.apple.JavaScriptCore            0x0030c2b6
KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 806
27  com.apple.JavaScriptCore            0x0030e649
KJS::ExprStatementNode::execute(KJS::ExecState*) + 25
28  com.apple.JavaScriptCore            0x0030b870
KJS::BlockNode::execute(KJS::ExecState*) + 64
29  com.apple.JavaScriptCore            0x003119e6
KJS::ForNode::execute(KJS::ExecState*) + 102
30  com.apple.JavaScriptCore            0x003815e1
KJS::FunctionBodyNode::execute(KJS::ExecState*) + 433
31  com.apple.JavaScriptCore            0x0030e7a9
KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List
const&) + 73
32  com.apple.JavaScriptCore            0x00321237
KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 135
33  com.apple.WebCore                   0x00a93eb9
WebCore::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 1401
34  com.apple.WebCore                   0x00a0a906
WebCore::Document::handleWindowEvent(WebCore::Event*, bool) + 166
35  com.apple.WebCore                   0x00a0a670
WebCore::EventTargetNode::dispatchWindowEvent(WebCore::AtomicString const&,
bool, bool) + 192
36  com.apple.WebCore                   0x009fb236
WebCore::Document::implicitClose() + 262
37  com.apple.WebCore                   0x009bcd9a
WebCore::FrameLoader::checkCompleted() + 170
38  com.apple.WebCore                   0x00a278c2
WebCore::Loader::didFinishLoading(WebCore::SubresourceLoader*) + 290
39  com.apple.WebCore                   0x00a255a1
WebCore::SubresourceLoader::didFinishLoading() + 49
40  com.apple.WebCore                   0x00a23888
-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:] + 72
41  com.apple.Foundation                0x94a9d907
-[NSURLConnection(NSURLConnectionReallyInternal) sendDidFinishLoading] + 87
42  com.apple.Foundation                0x94a9d894
_NSURLConnectionDidFinishLoading + 68
43  com.apple.CFNetwork                 0x958c97eb sendDidFinishLoadingCallback
+ 148
44  com.apple.CFNetwork                 0x958c6918
_CFURLConnectionSendCallbacks + 1994
45  com.apple.CFNetwork                 0x958c60d1 muxerSourcePerform + 283
46  com.apple.CoreFoundation            0x9260f62e CFRunLoopRunSpecific + 3166
47  com.apple.CoreFoundation            0x9260fd18 CFRunLoopRunInMode + 88
48  com.apple.HIToolbox                 0x94cd9780 RunCurrentEventLoopInMode +
283
49  com.apple.HIToolbox                 0x94cd9599 ReceiveNextEventCommon + 374
50  com.apple.HIToolbox                 0x94cd940d
BlockUntilNextEventMatchingListInMode + 106
51  com.apple.AppKit                    0x95c69771 _DPSNextEvent + 657
52  com.apple.AppKit                    0x95c69026 -[NSApplication
nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
53  com.apple.Safari                    0x0000e7ae 0x1000 + 55214
54  com.apple.AppKit                    0x95c6205d -[NSApplication run] + 795
55  com.apple.AppKit                    0x95c2f2a2 NSApplicationMain + 574
56  com.apple.Safari                    0x00007b96 0x1000 + 27542


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.