Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 450bcd468bb6fb329654f4c616be4b17caeccb50
https://github.com/WebKit/WebKit/commit/450bcd468bb6fb329654f4c616be4b17caeccb50
Author: Yusuke Suzuki <[email protected]>
Date: 2026-07-23 (Thu, 23 Jul 2026)
Changed paths:
M Source/JavaScriptCore/heap/Heap.cpp
Log Message:
-----------
[JSC] Drop shared Baseline JIT code eagerly when
Heap::deleteAllUnlinkedCodeBlocks is called
https://bugs.webkit.org/show_bug.cgi?id=320071
rdar://178085335
Reviewed by Yijia Huang.
Shareable Baseline JIT code is cached on
UnlinkedCodeBlock::m_unlinkedBaselineCode.
That cache is not owned by any linked CodeBlock or executable, so it survives
deleteAllCodeBlocks and is otherwise only released when the UnlinkedCodeBlock
itself
is collected. A "warm" UnlinkedCodeBlock can therefore pin Baseline JIT
executable
memory across memory warnings indefinitely, which defeats the purpose of a
memory-pressure driven deleteAllCode().
This patch clears m_unlinkedBaselineCode for every live UnlinkedCodeBlock in
Heap::deleteAllUnlinkedCodeBlocks, right after deleteAllCodeBlocks has already
detached the linked CodeBlocks. This is safe because any still-linked CodeBlock
holds
its own ref to the BaselineJITCode, so dropping the cache ref never frees code
that
is still in use. A cache-only entry is freed as soon as its last ref goes away,
synchronously here.
* Source/JavaScriptCore/heap/Heap.cpp:
(JSC::Heap::deleteAllUnlinkedCodeBlocks):
Canonical link: https://commits.webkit.org/317793@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
