Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bbab514b1010b4a0eddd2ed5c479747a0511108d
https://github.com/WebKit/WebKit/commit/bbab514b1010b4a0eddd2ed5c479747a0511108d
Author: Dan Hecht <[email protected]>
Date: 2026-08-07 (Fri, 07 Aug 2026)
Changed paths:
M Source/JavaScriptCore/dfg/DFGLazyJSValue.cpp
Log Message:
-----------
[JSC] LazyJSValue::emit leaks a StringImpl reference when finalization is
skipped
https://bugs.webkit.org/show_bug.cgi?id=321221
rdar://184272837
Reviewed by Yusuke Suzuki.
emit() manually refs a NewStringImpl's StringImpl and relies on the main-thread
finalization task to deref it, but several paths skip that task. When JIT
executable memory runs out after code generation, both DFG and FTL bail on
LinkBuffer::didFailToAllocate(), so the link task never runs and the
finalization
task it would have registered never exists. Separately,
runMainThreadFinalizationTasks() runs inside JITFinalizer::finalize(), which
Plan::finalize() only reaches past its isStillValidCodeBlock() check, so a
compilation that links successfully and is then invalidated leaks as well. A
plan
cancelled after code generation would leak the same way, which today only the
placement of safepoints prevents.
Hold the reference in a RefPtr instead, so it is released whether the task runs
or not.
* Source/JavaScriptCore/dfg/DFGLazyJSValue.cpp:
(JSC::DFG::EscapedLazyJSValue::EscapedLazyJSValue):
(JSC::DFG::LazyJSValue::emit const):
Canonical link: https://commits.webkit.org/318800@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
