[Webkit-unassigned] [Bug 75731] New: REGRESSION(r104210): Crash inside DynamicSubtreeNodeList::length

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=75731

           Summary: REGRESSION(r104210): Crash inside
                    DynamicSubtreeNodeList::length
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rniwa at webkit.org
                CC: koivisto at iki.fi, kling at webkit.org


Apparently Chromium has been getting crash reports with crash traces like:

0x011a72ee     [chrome.dll     - dynamicnodelist.cpp:80    WebCore::DynamicSubtreeNodeList::length()
0x011a725d     [chrome.dll     - v8nodelistcustom.cpp:53    WebCore::V8NodeList::namedPropertyGetter(v8::Local<v8::String>,v8::AccessorInfo const &)
0x011d3696     [chrome.dll     - stub-cache.cc:1004    v8::internal::LoadPropertyWithInterceptorOnly(v8::internal::Arguments,v8::internal::Isolate *)
0x011d3622     [chrome.dll     - renderboxmodelobject.cpp:1280    WebCore::BorderEdge::BorderEdge()
0x011a71a6     [chrome.dll     - assembler-ia32.cc:940    v8::internal::Assembler::idiv(v8::internal::Register)
0x0110d03b     [chrome.dll     - regexp-macro-assembler.cc:152    v8::internal::NativeRegExpMacroAssembler::Match(v8::internal::Handle<v8::internal::Code>,v8::internal::Handle<v8::internal::String>,int *,int,int,v8::internal::Isolate *)

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.