[Webkit-unassigned] [Bug 49976] New: [Qt] Fix crashes in debug mode

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=49976

           Summary: [Qt] Fix crashes in debug mode
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Keywords: Qt, QtTriaged
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: ossy at webkit.org


Created an attachment (id=74668)
 --> (https://bugs.webkit.org/attachment.cgi?id=74668&action=review)
GDB backtrace

On trunk 8 tests crash in debug mode: (r72592)
dom/html/level1/core/hc_attrappendchild3.html
dom/xhtml/level2/html/table07.xhtml
dom/xhtml/level2/html/table22.xhtml
fast/js/sputnik/Conformance/15_Native_Objects/15.3_Function/15.3.3/S15.3.3_A2_T2.html
fast/js/sputnik/Conformance/15_Native_Objects/15.4_Array/15.4.4/15.4.4.9_Array_prototype_shift/S15.4.4.9_A1.1_T1.html
fast/js/sputnik/Conformance/15_Native_Objects/15.7_Number/15.7.3/15.7.3.5_Number.NEGATIVE_INFINITY/S15.7.3.5_A1.html
fast/js/sputnik/Conformance/15_Native_Objects/15.10_RegExp/15.10.2/15.10.2.12_CharacterClassEscape/S15.10.2.12_A6_T2.html
ietestcenter/Javascript/15.4.4.15-5-8.html

These tests don't crash if we run only one test, but we can reproduce the crashes.

for example I tried with the following tests:
dom/xhtml/level2/html/object11.xhtml
dom/xhtml/level2/html/object12.xhtml
dom/xhtml/level2/html/object13.xhtml
dom/xhtml/level2/html/object14.xhtml
dom/xhtml/level2/html/object15.xhtml
dom/xhtml/level2/html/table01.xhtml
dom/xhtml/level2/html/table02.xhtml
dom/xhtml/level2/html/table03.xhtml
dom/xhtml/level2/html/table04.xhtml
dom/xhtml/level2/html/table06.xhtml
dom/xhtml/level2/html/table07.xhtml

GDB backtrace is attached.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.