[Webkit-unassigned] [Bug 31998] New: REGRESSION (r49564): Crash in updateGlobalHistory when running Javascript iBench test

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=31998

           Summary: REGRESSION (r49564): Crash in updateGlobalHistory when
                    running Javascript iBench test
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Other
        OS/Version: Mac OS X 10.5
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit Misc.
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: aroben at apple.com



Adam Roben (aroben) <aroben at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #44039|                            |review?
               Flag|                            |


Created an attachment (id=44039)
 --> (https://bugs.webkit.org/attachment.cgi?id=44039)
Patch

Looks like there's a double-delete of the BSTRs here. updateGlobalHistory
creates WebCore::BStrings and passes them to WebNavigationData::createInstance,
which tries to adopt the BSTRs that the BStrings wrap. But the BStrings haven't
given up ownership!

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.