Wpe 2.38 dump info and crash for invalid handle backport

Source/JavaScriptCore/heap/BlockDirectory.cpp

@@ -306,6 +306,17 @@ void BlockDirectory::shrink()
         });
 }
 
+// FIXME: rdar://139998916
+MarkedBlock::Handle* BlockDirectory::findMarkedBlockHandleDebug(MarkedBlock* block)
+{
+    for (size_t index = 0; index < m_blocks.size(); ++index) {
+        MarkedBlock::Handle* handle = m_blocks[index];
+        if (&handle->block() == block)
+            return handle;
+    }
+    return nullptr;
+}
+
 void BlockDirectory::assertNoUnswept()
 {
     if (!ASSERT_ENABLED)

Source/JavaScriptCore/heap/BlockDirectory.h

@@ -130,8 +130,11 @@ class BlockDirectory {
     void setNextDirectoryInAlignedMemoryAllocator(BlockDirectory* directory) { m_nextDirectoryInAlignedMemoryAllocator = directory; }
 
     MarkedBlock::Handle* findEmptyBlockToSteal();
-    
+
     MarkedBlock::Handle* findBlockToSweep();
+
+    // FIXME: rdar://139998916
+    MarkedBlock::Handle* findMarkedBlockHandleDebug(MarkedBlock*);
 
     Subspace* subspace() const { return m_subspace; }
     MarkedSpace& markedSpace() const;

Source/JavaScriptCore/heap/CellContainerInlines.h

@@ -90,7 +90,7 @@ inline WeakSet& CellContainer::weakSet() const
 inline void CellContainer::aboutToMark(HeapVersion markingVersion)
 {
     if (!isPreciseAllocation())
-        markedBlock().aboutToMark(markingVersion);
+        markedBlock().aboutToMark(markingVersion, nullptr);
 }
 
 inline bool CellContainer::areMarksStale() const

Source/JavaScriptCore/heap/HeapInlines.h

@@ -83,7 +83,7 @@ ALWAYS_INLINE bool Heap::testAndSetMarked(HeapVersion markingVersion, const void
     if (cell->isPreciseAllocation())
         return cell->preciseAllocation().testAndSetMarked();
     MarkedBlock& block = cell->markedBlock();
-    Dependency dependency = block.aboutToMark(markingVersion);
+    Dependency dependency = block.aboutToMark(markingVersion, cell);
     return block.testAndSetMarked(cell, dependency);
 }