[Webkit-unassigned] [Bug 227767] fitcored crashes at JavaScriptCore: JSC::Heap::releaseAccessSlow

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed Jul 7 13:41:05 PDT 2021


Geoffrey Garen <ggaren at apple.com> changed:

           What    |Removed                     |Added
                 CC|                            |ggaren at apple.com
 Attachment #433066|review?                     |review+
              Flags|                            |

--- Comment #4 from Geoffrey Garen <ggaren at apple.com> ---
Comment on attachment 433066
  --> https://bugs.webkit.org/attachment.cgi?id=433066


Is it ever correct to have heap access when we run the VM destructor? I think it is not. So, I think the VM destructor should RELEASE_ASSERT !hasAccess().

(I'm asking because that RELEASE_ASSERT would remove all the speculation in your reasoning.)

You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210707/224e536d/attachment.htm>

More information about the webkit-unassigned mailing list