Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 20d1bae11e90cb09967c16480965584fc14b89c6
https://github.com/WebKit/WebKit/commit/20d1bae11e90cb09967c16480965584fc14b89c6
Author: Vignesh Rao <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
M Source/JavaScriptCore/wasm/WasmCallee.cpp
M Source/JavaScriptCore/wasm/WasmCalleeGroup.cpp
Log Message:
-----------
[JSC] Unconditionally keep OMGOSREntryCallee alive while updating its
callsites
https://bugs.webkit.org/show_bug.cgi?id=313063
rdar://174492346
Reviewed by Keith Miller.
After a re-tier, when a fresh BBQCallee replaces a retired one,
m_osrEntryCallees may hold a stale weak ref to an OMGOSREntryCallee not owned
by the current BBQCallee. Currently, updateCallsitesToCallUs will not track
this since it assumes that this OMGOSREntryCallee will be owned by the BBQCallee
This patch fixes it by unconditionally keeping the
OMGOSREntryCallee alive
while we update all the callsites within it. The assert in ~BBQCallee is void
now since an OMGOSREntryCallee can now have multiple owners.
* Source/JavaScriptCore/wasm/WasmCallee.cpp:
(JSC::Wasm::BBQCallee::~BBQCallee):
* Source/JavaScriptCore/wasm/WasmCalleeGroup.cpp:
(JSC::Wasm::CalleeGroup::updateCallsitesToCallUs):
Originally-landed-as: 305413.784@safari-7624-branch (84a5f91f00a5).
rdar://180437899
Canonical link:
https://flagged.apple.com:443/proxy?t2=DJ4e7e0Yv8&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzE2MTMyQG1haW4=&emid=d0791117-792e-47fc-8a95-b0c863b5a355&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
