[Webkit-unassigned] [Bug 200863] Crash in JSC::SlotVisitor::visitChildren

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=200863

--- Comment #7 from Krzysztof Konopko <kris at youview.com> ---
Created attachment 463518

  --> https://bugs.webkit.org/attachment.cgi?id=463518&action=review

core dump with concurrent GC disabled

(In reply to Krzysztof Konopko from comment #4)
> OK, thanks for confirming.  Will be trying to chase it down.  BTW, disabling
> concurrent GC (RipTide) also makes the problem go away so it might be
> something with that implementation.

On a custom AArch64 platform I saw a crash with concurrent GC _disabled_.  See the attachment.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20221114/96e275a1/attachment.htm>