Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 219e93dc77b96cb3d375ed8193f920a8d9e2f00a
https://github.com/WebKit/WebKit/commit/219e93dc77b96cb3d375ed8193f920a8d9e2f00a
Author: Qianlang Chen <[email protected]>
Date: 2026-09-01 (Tue, 01 Sep 2026)
Changed paths:
A
LayoutTests/http/tests/site-isolation/inspector/debugger/resources/symbolic-breakpoint-native-frame.html
A
LayoutTests/http/tests/site-isolation/inspector/debugger/symbolic-breakpoint-native-across-frame-targets-expected.txt
A
LayoutTests/http/tests/site-isolation/inspector/debugger/symbolic-breakpoint-native-across-frame-targets.html
M Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp
Log Message:
-----------
[Site Isolation] Web Inspector: Symbolic breakpoints on native functions
never pause the frame target
https://bugs.webkit.org/show_bug.cgi?id=321820
rdar://184961104
Reviewed by BJ Burg and Devin Rousso.
The thunk installed for a symbolic breakpoint on a native function is
tracked process-wide in replacedThunks(), but the symbols an agent will
break on, SymbolicBreakpoint::knownMatchingSymbols, are per-agent and
only SymbolicBreakpoint::matches() fills them. addSymbolicBreakpoint()
bumped the reference count of an already-installed thunk without
evaluating the symbol, so the second agent to set the same breakpoint
learned nothing and never paused. That is the normal case now: the page
target installs every thunk before the frame agent that owns the frame's
JavaScript, which is the one the thunk dispatches to, ever asks.
Evaluate the symbol on those paths too. Counting only matches also makes
matchCount symmetric with the paths that decrement it, which have always
required a match. Fix this in the agent rather than in the frontend,
because two frame agents in one process will contend the same way once
the page target is gone.
Native constructors are InternalFunctions and take a second path, with
two more bugs on it. internalFunctionWithDebuggerHook() notified every
debugger in the VM instead of the callee realm's, so breakpoint actions
ran once per agent; dispatch to globalObject->debugger(), matching
operationDebuggerWillCallNativeExecutable(). And
clearInspectorBreakpointState() had its VM check inverted there, so an
agent released other VMs' entries instead of its own.
These Debugger domain tests now progress, each in its four exact/regex
and case-sensitive/insensitive variants:
- 12 that break through the native executable thunk:
symbolic-breakpoint-call-native-dom,
symbolic-breakpoint-call-native-js and
symbolic-breakpoint-intrinsic-js.
- 8 that break through the InternalFunction hook and so need both the
symbol evaluation and the dispatch fix:
symbolic-breakpoint-construct-native-dom and
symbolic-breakpoint-construct-native-js.
*
LayoutTests/http/tests/site-isolation/inspector/debugger/resources/symbolic-breakpoint-native-frame.html:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/debugger/symbolic-breakpoint-native-across-frame-targets-expected.txt:
Added.
*
LayoutTests/http/tests/site-isolation/inspector/debugger/symbolic-breakpoint-native-across-frame-targets.html:
Added.
* Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp:
(Inspector::internalFunctionWithDebuggerHook):
(Inspector::InspectorDebuggerAgent::addSymbolicBreakpoint):
(Inspector::InspectorDebuggerAgent::clearInspectorBreakpointState):
Canonical link: https://commits.webkit.org/320291@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
