<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:daniel.zimmerman@me.com" title="Dan Zimmerman <daniel.zimmerman@me.com>"> <span class="fn">Dan Zimmerman</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - [Win] Null pointer crash."
href="https://bugs.webkit.org/show_bug.cgi?id=149957">bug 149957</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>daniel.zimmerman@me.com
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [Win] Null pointer crash."
href="https://bugs.webkit.org/show_bug.cgi?id=149957#c5">Comment # 5</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [Win] Null pointer crash."
href="https://bugs.webkit.org/show_bug.cgi?id=149957">bug 149957</a>
from <span class="vcard"><a class="email" href="mailto:daniel.zimmerman@me.com" title="Dan Zimmerman <daniel.zimmerman@me.com>"> <span class="fn">Dan Zimmerman</span></a>
</span></b>
<pre>I've found a similar crash on iOS 10.2's version of JavascriptCore.
I have the following backtrace:
#0 0x0000000104d6d2ef in JSC::speculationFromCell(JSC::JSCell*) ()
#1 0x00000001047d2ec3 in JSC::CodeBlock::updateAllPredictionsAndCountLiveness(unsigned int&, unsigned int&) ()
#2 0x00000001047cebc7 in JSC::CodeBlock::stronglyVisitStrongReferences(JSC::SlotVisitor&) ()
#3 0x00000001047ce969 in JSC::CodeBlock::visitChildren(JSC::SlotVisitor&) ()
#4 0x0000000104d699ac in JSC::SlotVisitor::drain() ()
#5 0x0000000104a0869c in JSC::Heap::markRoots(double, void*, void*, int (&) [37]) ()
#6 0x0000000104a0b065 in JSC::Heap::collectImpl(JSC::HeapOperation, void*, void*, int (&) [37]) ()
#7 0x0000000104a0ada1 in JSC::Heap::collect(JSC::HeapOperation) ()
#8 0x0000000104c3c957 in JSC::MarkedAllocator::allocateSlowCase(unsigned long) ()
#9 0x0000000104b72ee0 in JSObjectMake ()
and the state of the JSCell is:
m_structureID: 0
m_indexingType: 0
m_type: UnspecifiedType (0)
m_flags: 0
m_cellState: AnthraciteOrBlack (0)
Is there anyway I can help to find the source of the issue? I have a setup where the bug is pretty reproducible.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>