Status: Unconfirmed Owner: ---- Labels: OS-Linux Area-Misc Size-Medium Type-Bug
New issue 19354 by joel.stan: v8 backtrace on facebook.com login page http://code.google.com/p/chromium/issues/detail?id=19354 Chrome Version : r23437 OS + version : Ubuntu Karmic CPU architecture (32-bit / 64-bit): 64-bit OS with 64-bit chromium URLs (if applicable) : http://facebook.com What steps will reproduce the problem? 1. navigate to facebook.com 2. mouse over username or password text input box What is the expected result? Box is selected What happens instead? Renderer crashes # # Fatal error in v8/src/register-allocator.h, line 113 # CHECK(is_register()) failed # ==== Stack trace ============================================ Security context: 0x7f27df09bc59 <JS Object>#0# 2: /* anonymous */(this=0x7f27de8dadc9 <an HTMLDivElement>>#1#,evt=0x7f27de8da9c9 <a MouseEvent>>#2#) 3: onmouseover(this=0x7f27de8dadc9 <an HTMLDivElement>>#1#,evt=0x7f27de8da9c9 <a MouseEvent>>#2#) ==== Details ================================================ [2]: /* anonymous */(this=0x7f27de8dadc9 <an HTMLDivElement>>#1#,evt=0x7f27de8da9c9 <a MouseEvent>>#2#) { // expression stack (top to bottom) [04] : 0x7f27df2ffe49 <String[10]: li.fb_menu> [03] : 0x7f27de8dadc9 <an HTMLDivElement>>#1# [02] : 0x7f27df14f6d9 <an Object>>#3# [01] : 0x7f27df2ecf81 <String[4]: scry> [00] : 0x7f27df2d4fe1 <String[3]: map> --------- s o u r c e c o d e --------- function (evt){if (window.delay_add_class) {DOM.scry(this, "li.fb_menu").map(function(e) {delay_add_class(e, "hovered", 250)});this.onmouseover = null;}?} ----------------------------------------- } [3]: onmouseover(this=0x7f27de8dadc9 <an HTMLDivElement>>#1#,evt=0x7f27de8da9c9 <a MouseEvent>>#2#) { // heap-allocated locals var .arguments = // warning: missing context slot - inconsistent frame? var arguments = // warning: missing context slot - inconsistent frame? // expression stack (top to bottom) [12] : 0x7f27df186551 <JS Function>#4# --------- s o u r c e c o d e --------- function onmouseover(evt) {with (this.ownerDocument ? this.ownerDocument : {}) {with (this.form ? this.form : {}) {with (this) {return (function(evt){if (window.delay_add_class) {DOM.scry(this, "li.fb_menu").map(function(e) {delay_add_class(e, "hovered", 250)});this.onmouseover = null;}?}).call(this, evt);}}}} ----------------------------------------- } ==== Key ============================================ #0# 0x7f27df09bc59: 0x7f27df09bc59 <JS Object> #1# 0x7f27de8dadc9: 0x7f27de8dadc9 <an HTMLDivElement>> #2# 0x7f27de8da9c9: 0x7f27de8da9c9 <a MouseEvent>> #3# 0x7f27df14f6d9: 0x7f27df14f6d9 <an Object>> scry: 0x7f27df0e1df9 <JS Function>#5# find: 0x7f27df0e1dc1 <JS Function>#6# setID: 0x7f27df0e22d1 <JS Function>#7# empty: 0x7f27df0e2541 <JS Function>#8# isNode: 0x7f27df0e2621 <JS Function>#9# create: 0x7f27df0e2279 <JS Function>#10# remove: 0x7f27df0e2509 <JS Function>#11# replace: 0x7f27df0e2421 <JS Function>#12# setText: 0x7f27df0e1ef1 <JS Function>#13# getText: 0x7f27df0e2199 <JS Function>#14# contains: 0x7f27df0e2579 <JS Function>#15# NODE_TYPES: 0x7f27df168211 <an Object>>#16# setContent: 0x7f27df0e23b1 <JS Function>#17# getElement: 0x7f27df0e1d89 <JS Function>#18# tryElement: 0x7f27df0e1d31 <JS Function>#19# getBoxWidth: 0x7f27df0e1e81 <JS Function>#20# _addContent: 0x7f27df0e2659 <JS Function>#21# insertAfter: 0x7f27df0e2341 <JS Function>#22# insertBefore: 0x7f27df0e2379 <JS Function>#23# _nodeAugment: 0x7f27df17f3f1 <JS Function>#24# getBoxHeight: 0x7f27df0e1eb9 <JS Function>#25# getSelection: 0x7f27df0e2241 <JS Function>#26# appendContent: 0x7f27df0e23e9 <JS Function>#27# prependContent: 0x7f27df0e2309 <JS Function>#28# getRootElement: 0x7f27df0e25b1 <JS Function>#29# _getNodeAugment: 0x7f27df0e26b9 <JS Function>#30# getCaretPosition: 0x7f27df0e2459 <JS Function>#31# setCaretPosition: 0x7f27df0e24d1 <JS Function>#32# suppressSelection: 0x7f27df0e25e9 <JS Function>#33# _getSelectionPrivate: 0x7f27df0e21d1 <JS Function>#34# _gettingCaretPosition: 0x7f27df2d0209 <false> getSelectionSupported: 0x7f27df0e2209 <JS Function>#35# #4# 0x7f27df186551: 0x7f27df186551 <JS Function> #5# 0x7f27df0e1df9: 0x7f27df0e1df9 <JS Function> #6# 0x7f27df0e1dc1: 0x7f27df0e1dc1 <JS Function> #7# 0x7f27df0e22d1: 0x7f27df0e22d1 <JS Function> #8# 0x7f27df0e2541: 0x7f27df0e2541 <JS Function> #9# 0x7f27df0e2621: 0x7f27df0e2621 <JS Function> #10# 0x7f27df0e2279: 0x7f27df0e2279 <JS Function> #11# 0x7f27df0e2509: 0x7f27df0e2509 <JS Function> #12# 0x7f27df0e2421: 0x7f27df0e2421 <JS Function> #13# 0x7f27df0e1ef1: 0x7f27df0e1ef1 <JS Function> #14# 0x7f27df0e2199: 0x7f27df0e2199 <JS Function> #15# 0x7f27df0e2579: 0x7f27df0e2579 <JS Function> #16# 0x7f27df168211: 0x7f27df168211 <an Object>> TEXT: 3 ENTITY: 6 ELEMENT: 1 COMMENT: 8 DOCUMENT: 9 ATTRIBUTE: 2 DOCUMENT_TYPE: 10 NOTATION_NODE: 12 CDATA_SECTION: 4 ENTITY_REFERENCE: 5 DOCUMENT_FRAGMENT: 11 PROCESSING_INSTRUCTION: 7 #17# 0x7f27df0e23b1: 0x7f27df0e23b1 <JS Function> #18# 0x7f27df0e1d89: 0x7f27df0e1d89 <JS Function> #19# 0x7f27df0e1d31: 0x7f27df0e1d31 <JS Function> #20# 0x7f27df0e1e81: 0x7f27df0e1e81 <JS Function> #21# 0x7f27df0e2659: 0x7f27df0e2659 <JS Function> #22# 0x7f27df0e2341: 0x7f27df0e2341 <JS Function> #23# 0x7f27df0e2379: 0x7f27df0e2379 <JS Function> #24# 0x7f27df17f3f1: 0x7f27df17f3f1 <JS Function> toString: 0x7f27df17f429 <JS Function>#36# #25# 0x7f27df0e1eb9: 0x7f27df0e1eb9 <JS Function> #26# 0x7f27df0e2241: 0x7f27df0e2241 <JS Function> #27# 0x7f27df0e23e9: 0x7f27df0e23e9 <JS Function> #28# 0x7f27df0e2309: 0x7f27df0e2309 <JS Function> #29# 0x7f27df0e25b1: 0x7f27df0e25b1 <JS Function> #30# 0x7f27df0e26b9: 0x7f27df0e26b9 <JS Function> #31# 0x7f27df0e2459: 0x7f27df0e2459 <JS Function> #32# 0x7f27df0e24d1: 0x7f27df0e24d1 <JS Function> #33# 0x7f27df0e25e9: 0x7f27df0e25e9 <JS Function> #34# 0x7f27df0e21d1: 0x7f27df0e21d1 <JS Function> #35# 0x7f27df0e2209: 0x7f27df0e2209 <JS Function> #36# 0x7f27df17f429: 0x7f27df17f429 <JS Function> ===================== -- You received this message because you are listed in the owner or CC fields of this issue, or because you starred this issue. You may adjust your issue notification preferences at: http://code.google.com/hosting/settings --~--~---------~--~----~------------~-------~--~----~ Automated mail from issue updates at http://crbug.com/ Subscription options: http://groups.google.com/group/chromium-bugs -~----------~----~----~----~------~----~------~--~---
