Skip stack trace formatting in case the global object is already dead.

src/heap.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 7273 matching lines @@
     MapWord first_word = object->map_word();
     if (first_word.IsForwardingAddress()) {
       list_[i] = first_word.ToForwardingAddress();
     }
   }
 }
 
 
 // Unforwarded objects in new space are dead and removed from the list.
 void ErrorObjectList::UpdateReferencesInNewSpace(Heap* heap) {
+  if (list_.is_empty()) return;
   if (!nested_) {
     int write_index = 0;
     for (int i = 0; i < list_.length(); i++) {
       MapWord first_word = HeapObject::cast(list_[i])->map_word();
       if (first_word.IsForwardingAddress()) {
         list_[write_index++] = first_word.ToForwardingAddress();
       }
     }
     list_.Rewind(write_index);
   } else {
     // If a GC is triggered during DeferredFormatStackTrace, we do not move
     // objects in the list, just remove dead ones, as to not confuse the
     // loop in DeferredFormatStackTrace.
     for (int i = 0; i < list_.length(); i++) {
       MapWord first_word = HeapObject::cast(list_[i])->map_word();
       list_[i] = first_word.IsForwardingAddress()
                      ? first_word.ToForwardingAddress()
                      : heap->the_hole_value();
     }
   }
 }
 
 
 void ErrorObjectList::DeferredFormatStackTrace(Isolate* isolate) {
   // If formatting the stack trace causes a GC, this method will be
   // recursively called.  In that case, skip the recursive call, since
   // the loop modifies the list while iterating over it.
-  if (nested_ || isolate->has_pending_exception()) return;
+  if (nested_ || list_.is_empty() || isolate->has_pending_exception()) return;
+  // In rare cases some error objects are still alive even though the global
+  // object provided by the embedder (WebKit) has already been collected.
+  // Those error objects are going to die soon afterwards.  Stop right here.
+  if (isolate->context() == NULL) return;
+  if (!isolate->global_proxy()->GetPrototype()->IsJSGlobalProxy()) return;

[Michael Starzinger, 2013/01/16 13:35:53]

That is quite a hack that is going on here. I think a better approach would be
for %GetDataProperty to actually check  whether the receiver is a JSGlobalProxy,
skip to the JSGlobalObject and if that is not present return undefined (as it's
implementing safe semantics that should gracefully fail).

+
   nested_ = true;
   HandleScope scope(isolate);
   Handle<String> stack_key = isolate->factory()->stack_symbol();
   int write_index = 0;
   int budget = kBudgetPerGC;
   for (int i = 0; i < list_.length(); i++) {
     Object* object = list_[i];
     JSFunction* getter_fun;
 
     { AssertNoAllocation assert;
@@ skipping 178 matching lines @@
       static_cast<int>(object_sizes_last_time_[index]));
   FIXED_ARRAY_SUB_INSTANCE_TYPE_LIST(ADJUST_LAST_TIME_OBJECT_COUNT)
 #undef ADJUST_LAST_TIME_OBJECT_COUNT
 
   memcpy(object_counts_last_time_, object_counts_, sizeof(object_counts_));
   memcpy(object_sizes_last_time_, object_sizes_, sizeof(object_sizes_));
   ClearObjectStats();
 }
 
 } }  // namespace v8::internal