Regressed with <http://trac.webkit.org/changeset/62898> (bug 40352) Invalid read of size 4, address 0x3fdc0 is not stack'd, malloc'd or (recently) free'd JSC::Heap::allocate(unsigned long) (Collector.h:220) JSC::ErrorInstance::create(JSC::JSGlobalData*, WTF::NonNullPassRefPtr<JSC::Structure>, JSC::UString const&) (JSCell.h:170) JSC::createError(JSC::ExecState*, JSC::UString const&) (Error.cpp:48) JSC::Bindings::QtField::valueFromInstance(JSC::ExecState*, JSC::Bindings::Instance const*) const (qt_instance.cpp:391) JSC::Bindings::QtInstance::markAggregate(JSC::MarkStack&) (qt_instance.cpp:217) JSC::Bindings::QtRuntimeObject::markChildren(JSC::MarkStack&) (qt_instance.cpp:57) JSC::Heap::markProtectedObjects(JSC::MarkStack&) (JSArray.h:202) JSC::Heap::markRoots() (Collector.cpp:1092) JSC::Heap::allocate(unsigned long) (Collector.cpp:1225) JSC::InternalFunction::InternalFunction(JSC::JSGlobalData*, JSC::JSGlobalObject*, WTF::NonNullPassRefPtr<JSC::Structure>, JSC::Identifier const&) (JSCell.h:170) JSC::NumberConstructor::NumberConstructor(JSC::ExecState*, JSC::JSGlobalObject*, WTF::NonNullPassRefPtr<JSC::Structure>, JSC::NumberPrototype*) (NumberConstructor.cpp:58) JSC::JSGlobalObject::reset(JSC::JSValue) (JSGlobalObject.cpp:255) JSC::JSGlobalObject::init(JSC::JSObject*) (JSGlobalObject.cpp:149) WebCore::JSDOMGlobalObject::JSDOMGlobalObject(WTF::NonNullPassRefPtr<JSC::Structure>, WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData*, JSC::JSObject*) (JSGlobalObject.h:186) WebCore::JSDOMWindowBase::JSDOMWindowBase(WTF::NonNullPassRefPtr<JSC::Structure>, WTF::PassRefPtr<WebCore::DOMWindow>, WebCore::JSDOMWindowShell*) (JSDOMWindowBase.cpp:56) WebCore::JSDOMWindow::JSDOMWindow(WTF::NonNullPassRefPtr<JSC::Structure>, WTF::PassRefPtr<WebCore::DOMWindow>, WebCore::JSDOMWindowShell*) (JSDOMWindow.cpp:956) WebCore::JSDOMWindowShell::setWindow(WTF::PassRefPtr<WebCore::DOMWindow>) (JSDOMWindowShell.cpp:67) WebCore::ScriptController::clearWindowShell(bool) (ScriptController.cpp:204) WebCore::Frame::pageDestroyed() (Frame.cpp:1359) WebCore::FrameLoader::detachFromParent() (FrameLoader.cpp:2654) QWebPage::~QWebPage() (qwebpage.cpp:1883) QWebViewPrivate::detachCurrentPage() (qwebview.cpp:372) QWebViewPrivate::~QWebViewPrivate() (qwebview.cpp:60) QWebView::~QWebView() (qwebview.cpp:329) tst_QWebFrame::cleanup() (tst_qwebframe.cpp:736) tst_QWebFrame::qt_metacall(QMetaObject::Call, int, void**) (tst_qwebframe.moc:662) QMetaObject::metacall(QObject*, QMetaObject::Call, int, void**) (qmetaobject.cpp:237) QMetaMethod::invoke(QObject*, Qt::ConnectionType, QGenericReturnArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument, QGenericArgument) const (qmetaobject.cpp:1575) QTest::invokeMethod(QObject*, char const*) (qmetaobject.h:119) QTest::qInvokeTestMethod(char const*, char const*) (qtestcase.cpp:1241) QTest::qExec(QObject*, int, char**) (qtestcase.cpp:1499) main (tst_qwebframe.cpp:3104)