Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: fb935fc3e266c357c09b4f0e65b4d7c8c03f263a
https://github.com/WebKit/WebKit/commit/fb935fc3e266c357c09b4f0e65b4d7c8c03f263a
Author: Sergey Rubanov <[email protected]>
Date: 2026-07-23 (Thu, 23 Jul 2026)
Changed paths:
M Source/JavaScriptCore/wasm/WasmCalleeGroup.cpp
Log Message:
-----------
[JSC] Make releaseBBQCallee tolerate missing BBQ
https://bugs.webkit.org/show_bug.cgi?id=290296
Reviewed by Yusuke Suzuki.
When freeRetiredWasmCode retires BBQ after OMG installs, there is not
always a same-mode BBQCallee to release. releaseBBQCallee assumed a
BBQ was present whenever an optimized-callee tuple existed, so
convertToWeak() followed by reportToVMsForDestruction() could null-deref
on a strong nullptr, and the fallback ASSERT required Signaling memory
— which is wrong for BoundsChecking and flaked on
workers/wasm-hashset.html in debug.
Only convert and report when the BBQ slot is still strong and non-null;
return early when there is no tuple or no BBQ. Drop the Signaling-only
assert.
* Source/JavaScriptCore/wasm/WasmCalleeGroup.cpp:
(JSC::Wasm::CalleeGroup::releaseBBQCallee): Guard missing BBQ;
drop Signaling-only assert.
Canonical link: https://commits.webkit.org/317822@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
