Bug 176150 – Crash in JSC::MacroAssemblerCodeRef::~MacroAssemblerCodeRef

• Status: NEW
• Component: JavaScriptCore

[Michael Catanzaro]

Crash in JSC::MacroAssemblerCodeRef::~MacroAssemblerCodeRef. I only have one report of this, so it's probably low priority:

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 std::__exchange<WTF::MetaAllocatorHandle*, decltype(nullptr)>(WTF::MetaAllocatorHandle*&, decltype(nullptr)&&) at /usr/include/c++/6.3.1/bits/move.h:143
 #1 std::exchange<WTF::MetaAllocatorHandle*, decltype(nullptr)>(WTF::MetaAllocatorHandle*&, decltype(nullptr)&&) at /usr/include/c++/6.3.1/utility:255
 #2 WTF::RefPtr<WTF::MetaAllocatorHandle>::~RefPtr at /usr/src/debug/webkitgtk-2.16.3/Source/WTF/wtf/RefPtr.h:62
 #3 JSC::MacroAssemblerCodeRef::~MacroAssemblerCodeRef at /usr/src/debug/webkitgtk-2.16.3/Source/JavaScriptCore/assembler/MacroAssemblerCodeRef.h:341
 #4 WebCore::RuleData::~RuleData at /usr/src/debug/webkitgtk-2.16.3/Source/WebCore/css/RuleSet.h:65
 #5 WTF::VectorDestructor<true, WebCore::RuleData>::destruct at /usr/src/debug/webkitgtk-2.16.3/Source/WTF/wtf/Vector.h:60
 #6 WTF::VectorTypeOperations<WebCore::RuleData>::destruct at /usr/src/debug/webkitgtk-2.16.3/Source/WTF/wtf/Vector.h:224
 #7 WTF::Vector<WebCore::RuleData, 1ul, WTF::CrashOnOverflow, 16ul>::~Vector at /usr/src/debug/webkitgtk-2.16.3/Source/WTF/wtf/Vector.h:631
 #8 std::default_delete<WTF::Vector<WebCore::RuleData, 1ul, WTF::CrashOnOverflow, 16ul> >::operator() at /usr/include/c++/6.3.1/bits/unique_ptr.h:76
 #9 std::unique_ptr<WTF::Vector<WebCore::RuleData, 1ul, WTF::CrashOnOverflow, 16ul>, std::default_delete<WTF::Vector<WebCore::RuleData, 1ul, WTF::CrashOnOverflow, 16ul> > >::reset at /usr/include/c++/6.3.1/bits/unique_ptr.h:347

Better backtrace plus register/assembler dump attached.

[Michael Catanzaro]

Created attachment 319445 [details]
Backtrace