[Webkit-unassigned] [Bug 105561] media/track/track-webvtt-tc002-bom.html crashes in WebCore::removeAllChildrenInContainer()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=105561


Simon Fraser (smfr) <simon.fraser at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |simon.fraser at apple.com




--- Comment #1 from Simon Fraser (smfr) <simon.fraser at apple.com>  2012-12-20 11:54:28 PST ---
Sometimes the crash looks like:

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: 0x000000000000000d, 0x0000000000000000

VM Regions Near 0:
--> 
    __TEXT                 000000010f358000-000000010f3b8000 [  384K] r-x/rwx SM=COW  /Volumes/VOLUME/*

Application Specific Information:
CRASHING TEST: media/track/track-webvtt-tc000-empty.html
objc[70098]: garbage collection is OFF

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore          0x000000010f741842 llint_op_mov + 0
1   com.apple.WebCore                 0x000000010fed398b WebCore::Document::removedLastRef() + 539 (OwnPtr.h:72)
2   com.apple.WebCore                 0x000000011001390a WebCore::Event::~Event() + 74 (RefPtr.h:56)
3   com.apple.WebCore                 0x000000011001389e WebCore::Event::~Event() + 14 (RefCounted.h:197)
4   com.apple.WebCore                 0x00000001103544a1 WebCore::JSEventOwner::finalize(JSC::Handle<JSC::Unknown>, void*) + 65 (JSEvent.h:62)
5   com.apple.JavaScriptCore          0x000000010f74b64c JSC::WeakBlock::sweep() + 108 (WeakImpl.h:84)
6   com.apple.JavaScriptCore          0x000000010f74b9b8 JSC::WeakSet::sweep() + 40 (DoublyLinkedList.h:118)
7   com.apple.JavaScriptCore          0x000000010f681d18 JSC::MarkedBlock::sweep(JSC::MarkedBlock::SweepMode) + 24 (MarkedBlock.cpp:112)
8   com.apple.JavaScriptCore          0x000000010f76370c JSC::IncrementalSweeper::doSweep(double) + 108 (IncrementalSweeper.cpp:125)
9   com.apple.JavaScriptCore          0x000000010f767963 JSC::HeapTimer::timerDidFire(__CFRunLoopTimer*, void*) + 179 (TimeoutChecker.h:57)
10  com.apple.CoreFoundation          0x00007fff86767934 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
11  com.apple.CoreFoundation          0x00007fff86767486 __CFRunLoopDoTimer + 534
12  com.apple.CoreFoundation          0x00007fff86747e11 __CFRunLoopRun + 1617
13  com.apple.CoreFoundation          0x00007fff86747486 CFRunLoopRunSpecific + 230
14  com.apple.Foundation              0x00007fff83611f7b -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 267
15  DumpRenderTree                    0x000000010f365455 _ZL7runTestRKNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEE + 1624 (DumpRenderTree.mm:1378)
16  DumpRenderTree                    0x000000010f364be0 dumpRenderTree(int, char const**) + 1855 (DumpRenderTree.mm:842)
17  DumpRenderTree                    0x000000010f3657be main + 86 (DumpRenderTree.mm:927)

http://build.webkit.org/results/Apple%20Lion%20Release%20WK1%20(Tests)/r138261%20(7528)/media/track/track-webvtt-tc000-empty-crash-log.txt

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.