<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Web Inspector: REGRESSION: JSC crashes when pausing at console.assert statement"
href="https://bugs.webkit.org/show_bug.cgi?id=148380">148380</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Web Inspector: REGRESSION: JSC crashes when pausing at console.assert statement
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>WebKit Nightly Build
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Macintosh
</td>
</tr>
<tr>
<th>OS</th>
<td>Mac OS X 10.10
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Major
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>bburg@apple.com
</td>
</tr>
<tr>
<th>CC</th>
<td>fpizlo@apple.com, ggaren@apple.com, joepeck@webkit.org, mark.lam@apple.com, sbarati@apple.com, timothy@apple.com
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=259756" name="attach_259756" title="test case">attachment 259756</a> <a href="attachment.cgi?id=259756&action=edit" title="test case">[details]</a></span>
test case
STEPS TO REPRODUCE:
1. Open the attached test case.
2. Open Web Inspector
3. Open Inspector^2 (Right-click and "Inspecto Element" in the Web Inspector, if the option doesn't exist follow steps here: <a href="http://trac.webkit.org/wiki/WebInspectorDebugging">http://trac.webkit.org/wiki/WebInspectorDebugging</a>)
4. In Debugger tab, enable "Break on [All] Exceptions".
5. Set a breakpoint in Inspector^1 at the line with `console.assert(...)`.
6. Reload the inspected page.
EXPECTED:
* Should pause at console.assert line but not at the breakpoint, because of Step (4).
ACTUAL:
* Crashes with this callstack (100% reproducible on my machine)
--
Exception Type: EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef
VM Regions Near 0xbbadbeef:
-->
__TEXT 0000000106d1c000-0000000106d1e000 [ 8K] r-x/rwx SM=COW /Users/USER/*/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 com.apple.JavaScriptCore 0x000000010d326fbe WTFCrash + 62
1 com.apple.JavaScriptCore 0x000000010cd2b348 JSC::CodeBlock::setOptimizationThresholdBasedOnCompilationResult(JSC::CompilationResult) + 776
2 com.apple.JavaScriptCore 0x000000010d09af9c JSC::JITToDFGDeferredCompilationCallback::compilationDidComplete(JSC::CodeBlock*, JSC::CompilationResult) + 140
3 com.apple.JavaScriptCore 0x000000010cf31691 JSC::DFG::Worklist::completeAllReadyPlansForVM(JSC::VM&, JSC::DFG::CompilationKey) + 257
4 com.apple.JavaScriptCore 0x000000010cf318ce JSC::DFG::Worklist::completeAllPlansForVM(JSC::VM&) + 62
5 com.apple.JavaScriptCore 0x000000010cf32ca8 JSC::DFG::completeAllPlansForVM(JSC::VM&) + 56
6 com.apple.JavaScriptCore 0x000000010cd6852c JSC::Debugger::exception(JSC::ExecState*, JSC::JSValue, bool) + 108
7 com.apple.JavaScriptCore 0x000000010d043475 JSC::Interpreter::unwind(void*&, JSC::ExecState*&, JSC::Exception*) + 325
8 com.apple.JavaScriptCore 0x000000010d06149a JSC::genericUnwind(JSC::VM*, JSC::ExecState*) + 90
9 com.apple.JavaScriptCore 0x000000010d19c41d llint_slow_path_handle_exception + 45
10 com.apple.JavaScriptCore 0x000000010d1a420a llint_entry + 15423
11 com.apple.JavaScriptCore 0x000000010d1a5efd llint_entry + 22834
12 com.apple.JavaScriptCore 0x000000010d1a03bb vmEntryToJavaScript + 326
13 com.apple.JavaScriptCore 0x000000010d05fbe9 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169
14 com.apple.JavaScriptCore 0x000000010d0464da JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 474
15 com.apple.JavaScriptCore 0x000000010cd12a0e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62
16 com.apple.JavaScriptCore 0x000000010d2d31ce JSC::JSJobMicrotask::run(JSC::ExecState*) + 734
17 com.apple.WebCore 0x000000010de24add WebCore::JSGlobalObjectCallback::call() + 189 (JSMainThreadExecState.h:93)
18 com.apple.WebCore 0x000000010d9eaf31 std::__1::__function::__func<WebCore::Document::postTask(WebCore::ScriptExecutionContext::Task)::$_0, std::__1::allocator<WebCore::Document::postTask(WebCore::ScriptExecutionContext::Task)::$_0>, void ()>::operator()() + 113 (memory:2624)
19 com.apple.JavaScriptCore 0x000000010d33f97d WTF::dispatchFunctionsFromMainThread() + 525
20 com.apple.Foundation 0x00007fff8941cdd0 __NSThreadPerformPerform + 293
21 com.apple.CoreFoundation 0x00007fff8ed5da01 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
22 com.apple.CoreFoundation 0x00007fff8ed4fb8d __CFRunLoopDoSources0 + 269
23 com.apple.CoreFoundation 0x00007fff8ed4f1bf __CFRunLoopRun + 927
24 com.apple.CoreFoundation 0x00007fff8ed4ebd8 CFRunLoopRunSpecific + 296
25 com.apple.HIToolbox 0x00007fff890b656f RunCurrentEventLoopInMode + 235
26 com.apple.HIToolbox 0x00007fff890b62ea ReceiveNextEventCommon + 431
27 com.apple.HIToolbox 0x00007fff890b612b _BlockUntilNextEventMatchingListInModeWithFilter + 71
28 com.apple.AppKit 0x00007fff852938ab _DPSNextEvent + 978
29 com.apple.AppKit 0x00007fff85292e58 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 346
30 com.apple.AppKit 0x00007fff85288af3 -[NSApplication run] + 594
31 com.apple.AppKit 0x00007fff85205244 NSApplicationMain + 1832
32 libxpc.dylib 0x00007fff9295f928 _xpc_objc_main + 793
33 libxpc.dylib 0x00007fff92961030 xpc_main + 490
34 com.apple.WebKit.WebContent.Development 0x0000000106d1d675 main + 21 (XPCServiceMain.Development.mm:90)
35 libdyld.dylib 0x00007fff8cff55c9 start + 1</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>