[Webkit-unassigned] [Bug 40875] New: segfault from invalid write in JSC::JIT::unlinkCall

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=40875

           Summary: segfault from invalid write in JSC::JIT::unlinkCall
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: Critical
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: mike at vee.net


Created an attachment (id=59179)
 --> (https://bugs.webkit.org/attachment.cgi?id=59179)
Valgrind log showing invalid write

I'm getting pretty random crashes daily with WebKit 531.2 (Epiphany 2.30.2, libwebkit 1.2.0) that seems to be stemming from invalid write in JSC::JIT::unlinkCall.

Valgrind memcheck log of one such crash is attached.

This is reasonably straight-forward thing to reproduce, generally browsing my daily news sites in a single window with a bunch of tabs open will do it, so let me know if you need any additional information/debugging.

Originally reported at https://bugzilla.gnome.org/show_bug.cgi?id=621657

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.