[Webkit-unassigned] [Bug 222453] New: REGRESSION(r273225) [GLIB] imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/evaluation-order-4-tla.html is crashing in release builds

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=222453

            Bug ID: 222453
           Summary: REGRESSION(r273225) [GLIB]
                    imported/w3c/web-platform-tests/html/semantics/scripti
                    ng-1/the-script-element/module/evaluation-order-4-tla.
                    html is crashing in release builds
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: lmoura at igalia.com

Created attachment 421602

  --> https://bugs.webkit.org/attachment.cgi?id=421602&action=review

GTK release local crash log

imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/evaluation-order-4-tla.html

Debug builds passing.

Trace:

Thread 1 (Thread 0x7f9cb2c989c0 (LWP 157)):
#0  0x00007f9cb8886558 in JSC::mapProtoFuncSet(JSC::JSGlobalObject*, JSC::CallFrame*) () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#1  0x00007f9c71fff1d8 in  ()
#2  0x00007ffed90c73a0 in  ()
#3  0x00007f9cb79c2323 in llint_op_call () at /app/webkit/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18
#4  0x0000000000000000 in  ()

Printf'ing, the crash seems to occur in the map->set(..) call inside mapProtoFuncSet.

Full trace attached.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210226/5b8a8ee4/attachment.htm>