[Webkit-unassigned] [Bug 167280] New: Calling eval in function will crash on iOS

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=167280

            Bug ID: 167280
           Summary: Calling eval in function will crash on iOS
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Local Build
          Hardware: iPhone / iPad
                OS: iOS 10
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: hszhsh at icloud.com

It is only occurred on iOS with the release build of the jsc library. It's ok when linked with debug version of jsc, and it's ok when called in the global scope.

The stack of the crash is as follows.

#0    0x0000000100d63c24 in llint_entry ()
#1    0x0000000100d649ec in llint_entry ()
#2    0x0000000100d65fa8 in llint_entry ()
#3    0x0000000100d5f6b8 in llintPCRangeStart ()
#4    0x0000000100c09fb8 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) at JITCode.cpp:81
#5    0x0000000100bdcde4 in JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) at /Users/hoolai/WebKit-GIT/Source/JavaScriptCore/interpreter/Interpreter.cpp:871
#6    0x00000001008f1114 in JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) at Completion.cpp:110
#7    0x0000000100c4cb98 in ::JSEvaluateScript(JSContextRef, JSStringRef, JSObjectRef, JSStringRef, int, JSValueRef *) at JSBase.cpp:69

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170121/5c2c45d3/attachment-0001.html>