[Webkit-unassigned] [Bug 200863] Crash in JSC::SlotVisitor::visitChildren

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=200863

--- Comment #23 from Michael Catanzaro <mcatanzaro at gnome.org> ---
(In reply to Justin Michaud from comment #21)
> How does it check? I can't find any details in the documentation. Our write
> barrier class is intentionally used to read memory that it did not construct
> itself, so it doesn't seem strange to me that it would complain.

The user-friendly documentation is here: https://valgrind.org/docs/manual/mc-manual.html#mc-manual.uninitvals

If you are smarter than me and really want to know what it's doing, there are more docs here: https://valgrind.org/docs/manual/mc-manual.html#mc-manual.machine

TL;DR WriteBarrierBase::cell is returning a garbage SymbolTable* pointer.

(In reply to Justin Michaud from comment #22)
> Your line numbers seem to be pretty off from mine, what build is this?

Krzysztof reported WPE WebKit 2.34.7. It would be better to test with a newer version, but the code for 2.34.7 is here:

https://trac.webkit.org/browser#webkit/releases/WPE%20WebKit/webkit-2.34.7

(Can't wait for this to move to GitHub....)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20221115/87ffb4cd/attachment.htm>