[Webkit-unassigned] [Bug 90728] REGRESSION(r118555): Assertion failure in JSC::DFG::AssemblyHelpers::decodedCodeMapFor on MathJax v2.0 sample

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=90728


Daniel Drake <dsd at laptop.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dsd at laptop.org




--- Comment #4 from Daniel Drake <dsd at laptop.org>  2012-12-01 07:26:11 PST ---
Reproduced this crash on Fedora 18 (x86), webkitgtk-1.10.1.

It happens while loading various pages such as http://tirania.org/blog/archive/2012/Oct-22.html and http://www.bbc.co.uk/weather/sg6

Program received signal SIGSEGV, Segmentation fault.
0xb611d7c9 in JSC::DFG::AssemblyHelpers::decodedCodeMapFor ()
   from /lib/libjavascriptcoregtk-3.0.so.0
#0  0xb611d7c9 in JSC::DFG::AssemblyHelpers::decodedCodeMapFor ()
   from /lib/libjavascriptcoregtk-3.0.so.0
#1  0xb615965d in JSC::DFG::OSRExitCompiler::compileExit ()
   from /lib/libjavascriptcoregtk-3.0.so.0
#2  0xb615d649 in compileOSRExit () from /lib/libjavascriptcoregtk-3.0.so.0
#3  0xabf19866 in ?? ()
#4  0xb61d7c52 in JSC::Interpreter::executeCall ()
   from /lib/libjavascriptcoregtk-3.0.so.0
#5  0xb62b4993 in JSC::call () from /lib/libjavascriptcoregtk-3.0.so.0
#6  0xbfffe3c4 in ?? ()

A more complete trace can be found in bug #102762.

I've tested Yong's patch (above) and it solves the issue. Any chance of a review?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.