[Webkit-unassigned] [Bug 176309] New: Crash in JSC::MarkedBlock::Handle::<lambda(WTF::PrintStream&)>::operator()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=176309

            Bug ID: 176309
           Summary: Crash in
                    JSC::MarkedBlock::Handle::<lambda(WTF::PrintStream&)>:
                    :operator()
           Product: WebKit
           Version: Other
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: mcatanzaro at igalia.com

Created attachment 319782

  --> https://bugs.webkit.org/attachment.cgi?id=319782&action=review

Backtrace

I have only one report (so probably low priority) of this crash in JSC::MarkedBlock::Handle::<lambda(WTF::PrintStream&)>::operator():

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 WTFCrash at /usr/src/debug/webkitgtk-2.16.6/Source/WTF/wtf/Assertions.cpp:323
 #1 JSC::MarkedBlock::Handle::<lambda(WTF::PrintStream&)>::operator() at /usr/src/debug/webkitgtk-2.16.6/Source/JavaScriptCore/heap/MarkedBlockInlines.h:174
 #2 WTF::PrintStream::atomically<JSC::MarkedBlock::Handle::specializedSweep(JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, const DestroyFunc&) [with bool <anonymous> = true; JSC::MarkedBlock::Handle::EmptyMode <anonymous> = (JSC::MarkedBlock::Handle::EmptyMode)0; JSC::MarkedBlock::Handle::SweepMode <anonymous> = (JSC::MarkedBlock::Handle::SweepMode)1; JSC::MarkedBlock::Handle::SweepDestructionMode <anonymous> = (JSC::MarkedBlock::Handle::SweepDestructionMode)0; JSC::MarkedBlock::Handle::ScribbleMode <anonymous> = (JSC::MarkedBlock::Handle::ScribbleMode)0; JSC::MarkedBlock::Handle::NewlyAllocatedMode <anonymous> = (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1; JSC::MarkedBlock::Handle::MarksMode <anonymous> = (JSC::MarkedBlock::Handle::MarksMode)1; DestroyFunc = JSC::MarkedBlock::Handle::sweep(JSC::MarkedBlock::Handle::SweepMode)::<lambda()>::<lambda(JSC::VM&, JSC::JSCell*)>]::<lambda(WTF::PrintStream&)> > at /usr/src/debug/webkitgtk-2.16.6/Source/WTF/wtf/PrintStream.h:64
 #3 JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::MarkedBlock::Handle::sweep(JSC::MarkedBlock::Handle::SweepMode)::<lambda()>::<lambda(JSC::VM&, JSC::JSCell*)> > at /usr/src/debug/webkitgtk-2.16.6/Source/JavaScriptCore/heap/MarkedBlockInlines.h:168
 #4 JSC::MarkedBlock::Handle::<lambda()>::operator() at /usr/src/debug/webkitgtk-2.16.6/Source/JavaScriptCore/heap/MarkedBlock.cpp:455
 #5 JSC::MarkedBlock::Handle::sweep at /usr/src/debug/webkitgtk-2.16.6/Source/JavaScriptCore/heap/MarkedBlock.cpp:477
 #6 JSC::MarkedAllocator::tryAllocateIn at /usr/src/debug/webkitgtk-2.16.6/Source/JavaScriptCore/heap/MarkedAllocator.cpp:142
 #7 JSC::MarkedAllocator::tryAllocateWithoutCollecting at /usr/src/debug/webkitgtk-2.16.6/Source/JavaScriptCore/heap/MarkedAllocator.cpp:109
 #8 JSC::MarkedAllocator::allocateSlowCaseImpl at /usr/src/debug/webkitgtk-2.16.6/Source/JavaScriptCore/heap/MarkedAllocator.cpp:227
 #9 JSC::MarkedAllocator::allocateSlowCase at /usr/src/debug/webkitgtk-2.16.6/Source/JavaScriptCore/heap/MarkedAllocator.cpp:195

Better backtrace attached.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20170903/9504ae6b/attachment.html>