Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: c98a8ac7469499f55e3cd361171c07f77e3a9f39
https://github.com/WebKit/WebKit/commit/c98a8ac7469499f55e3cd361171c07f77e3a9f39
Author: Shu-yu Guo <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
A JSTests/stress/regress-174463162.js
M Source/JavaScriptCore/bytecode/PropertyInlineCacheClearingWatchpoint.h
M Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h
M Source/JavaScriptCore/tools/JSDollarVM.cpp
M Source/JavaScriptCore/tools/JSDollarVM.h
Log Message:
-----------
[JSC] Override isValid() on AdaptiveValuePropertyInlineCacheClearingWatchpoint
https://bugs.webkit.org/show_bug.cgi?id=312610
rdar://174463162
Reviewed by Keith Miller.
AdaptiveValuePropertyInlineCacheClearingWatchpoint doesn't override isValid().
The base class fire() calls isValid() before dereferencing m_key.object()
via m_key.isWatchable() and install(). The default isValid() returns true,
allowing fire() to dereference a potentially dead m_key.object() when the
owning stub routine's CodeBlock has been collected.
The IC code paths that exercise this are not directly exercisable from vanilla
JS, so a $vm.installPropertyInlineCacheClearingWatchpointWithDeadOwner is added
to simulate the conditions that would trigger this bug.
Test: JSTests/stress/regress-174463162.js
* JSTests/stress/regress-174463162.js: Added.
(main):
* Source/JavaScriptCore/bytecode/PropertyInlineCacheClearingWatchpoint.h:
* Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h:
* Source/JavaScriptCore/tools/JSDollarVM.cpp:
(JSC::JSDollarVMHelper::setOwnerIsDead):
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::JSDollarVM::finishCreation):
(JSC::JSDollarVM::visitChildrenImpl):
* Source/JavaScriptCore/tools/JSDollarVM.h:
Originally-landed-as: 305413.706@safari-7624-branch (d577d4001218).
rdar://180437192
Canonical link: https://commits.webkit.org/316292@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
