[Webkit-unassigned] [Bug 25680] New: REGRESSION(r43432): Many JavaScriptCore tests crash in 64-bit
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Sun May 10 19:07:36 PDT 2009
https://bugs.webkit.org/show_bug.cgi?id=25680
Summary: REGRESSION(r43432): Many JavaScriptCore tests crash in
64-bit
Product: WebKit
Version: 528+ (Nightly build)
Platform: Macintosh
OS/Version: Mac OS X 10.5
Status: NEW
Severity: Normal
Priority: P1
Component: JavaScriptCore
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: mrowe at apple.com
CC: mjs at apple.com
In r43431 there are no JavaScriptCore test failures in 64-bit. In r43432 there
are 111 regressions, all of which appear to be crashes.
Backtrace at point of crash looks a little bit like the following:
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x0000000100091928 in WTF::RefPtr<JSC::UString::Rep>::get (this=0x0) at
RefPtr.h:54
54 T* get() const { return m_ptr; }
(gdb) bt
#0 0x0000000100091928 in WTF::RefPtr<JSC::UString::Rep>::get (this=0x0) at
RefPtr.h:54
#1 0x0000000100091a27 in WTF::operator==<JSC::UString::Rep,
JSC::UString::BaseString> (a=@0x0, b=0x100a05120) at RefPtr.h:161
#2 0x0000000100091a57 in JSC::UString::isNull (this=0x0) at UString.h:292
#3 0x0000000100091a71 in JSC::Identifier::isNull (this=0x0) at Identifier.h:58
#4 0x00000001000b5a87 in JSC::Structure::get (this=0x10210f710,
propertyName=@0x0) at Structure.h:179
#5 0x00000001000b5c6d in JSC::JSObject::getDirectLocation (this=0x1009f6680,
propertyName=@0x0) at JSObject.h:140
#6 0x00000001000b5cc0 in JSC::JSObject::inlineGetOwnPropertySlot
(this=0x1009f6680, exec=0x100b10048, propertyName=@0x0, slot=@0x5b084c87) at
JSObject.h:297
#7 0x00000001000b5dc9 in JSC::JSObject::getOwnPropertySlot (this=0x1009f6680,
exec=0x100b10048, propertyName=@0x0, slot=@0x5b084c87) at JSObject.h:343
#8 0x000000010009ebc6 in JSC::JSValue::toPrimitive (this=0x7fff5fbff150,
exec=0x100b10048, preferredType=JSC::NoPreference) at JSCell.h:241
#9 0x00000001001224d5 in JSC::JITStubs::cti_op_to_primitive
(args=0x7fff5fbff180) at JavaScriptCore/jit/JITStubs.cpp:2230
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
More information about the webkit-unassigned
mailing list