[webkit-dev] Stability problems involving Javascript GC

[David Kilzer]

On Dec 17, 2010, at 12:02 AM, Zoltan Herczeg wrote:

>>> On 6 December 2010 22:31, Zoltan Herczeg <zherczeg at inf.u-szeged.hu> wrote:
>>>> Crash in WTF::fastMalloc? Such things only happen if something overwrites
>>>> memory areas belongs to the memory manager (i.e overwrites some bytes
>>>> before or after a block returned by malloc). Try some valgrind equivalent
>>>> on mac to detect those writings into "red zones".
>>> 
>>> How can you use valgrind to help on that? We had some symptoms similar
>>> to this and also came to the conclusion that probably something is
>>> overwriting the structures used by fast malloc, but couldn't find
>>> anything with valgrind. Overwriting in an area that has bee reserved
>>> is not an error vangrind finds, at least not with any options that I
>>> know.
> 
> I haven't received your reply before. To capture this bug, you have to
> disable fastmalloc, and use the internal (trackable) memory allocator
> replacement of valgrind.
> 
> Run "build-webkit --system-malloc"
> 
> This will redirect all allocations to the system malloc.

In addition to valgrind, try running the test under guard malloc on Mac OS X with system malloc enabled.   See "man libgmalloc":

<http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man3/libgmalloc.3.html%23//apple_ref/doc/man/3/libgmalloc>

Dave