[Webkit-unassigned] [Bug 143859] A odd crash

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=143859

--- Comment #4 from Peng Xinchao <xinchao.peng at samsung.com> ---

After running these  JS Source code for  20 minute , Webprocess will coredump :
<script>   
 setInterval(function() {

    var d = new Date();
    var time = d.getHours().addNulls() + ":" + d.getMinutes().addNulls();            

    var $osd = $('#osd');
    $osd.show();
    $osd.find(".channel_time").text(time);
    setTimeout(function() {
        $osd.hide();
    }, 5000);

    }, 10000);
Number.prototype.addNulls = function () {
    if (this < 10) {
    return "0" + this;
    }
    return this.toString();
   }
</script>
I find two issue :
1: If disable DFG_JIT , the crash don't happen .
2. If "var time = d.getHours().addNulls() + ":" + d.getMinutes().addNulls();" is changed to "var time = d.getHours() + ":" + d.getMinutes();"
The crash don't happen
It looks like  process happen crash when addNulls  is called

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150418/698097da/attachment.html>