[Webkit-unassigned] [Bug 227767] fitcored crashes at JavaScriptCore: JSC::Heap::releaseAccessSlow

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=227767

Geoffrey Garen <ggaren at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ggaren at apple.com
 Attachment #433066|review?                     |review+
              Flags|                            |

--- Comment #4 from Geoffrey Garen <ggaren at apple.com> ---
Comment on attachment 433066
  --> https://bugs.webkit.org/attachment.cgi?id=433066
Patch

r=me

Is it ever correct to have heap access when we run the VM destructor? I think it is not. So, I think the VM destructor should RELEASE_ASSERT !hasAccess().

(I'm asking because that RELEASE_ASSERT would remove all the speculation in your reasoning.)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210707/224e536d/attachment.htm>