[Pkg-chromium-maint] Bug#582709: chromium-browser: aw snap at http://www.nytimes.com/

[Jonathan Nieder]

Package: chromium-browser
Version: 5.0.375.38~r46659-2
Tags: upstream
Forwarded: http://code.google.com/p/chromium/issues/detail?id=44824

Visiting http://www.nytimes.com/, first the page is rendered, and
then (after a few “Waiting for www.nytimes.com” events), the
“Aw, Snap!” message comes.

Run with --debug --single-process, the stack trace looks like this[1]:

 SEGV
 WebCore::createV8HTMLWrapper, V8HTMLElementWrapperFactory.cpp:618
 WebCore::toV8 (impl=0x0), V8HTMLElementCustom.cpp:42
 createHTMLVideoElementWrapper, V8HTMLElementWrapperFactory.cpp:611
 WebCore::createV8HTMLWrapper, V8HTMLElementWrapperFactory.cpp:722
 WebCore::toV8 (impl=0x0), V8HTMLElementCustom.cpp:42
 ...

Those last three frames repeat.  Looks like the stack got corrupted.

Any tips for debugging?

Jonathan

$ dpkg -l libv8-2.2.7 | tail -1
ii  libv8-2.2.7     2.2.7-1         V8 JavaScript Engine

[1] full paths from gdb for source files:
 out/Release/obj/gen/webkit/V8HTMLElementWrapperFactory.cpp
 third_party/WebKit/WebCore/bindings/v8/custom/V8HTMLElementCustom.cpp