Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 1edc620316f57c3c4539f58d5c9e00f33fcc29f6
https://github.com/WebKit/WebKit/commit/1edc620316f57c3c4539f58d5c9e00f33fcc29f6
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-02 (Wed, 02 Sep 2026)
Changed paths:
M Source/JavaScriptCore/heap/GCOwnedDataScope.cpp
M Source/JavaScriptCore/jit/JITArithmetic.cpp
M Source/JavaScriptCore/lol/LOLJIT.cpp
Log Message:
-----------
[JSC] Baseline JIT should not construct `GCOwnedDataScope` on the compiler
thread
https://bugs.webkit.org/show_bug.cgi?id=323102
Reviewed by Yusuke Suzuki.
Heap::m_topGCOwnedDataScope is a debug-only, unsynchronized field that says
whether a GCOwnedDataScope is live on the mutator's stack, and
Heap::clearConcurrentRetainedDataIfPossible asserts it is null before dropping
the old StringImpls it keeps alive for such scopes. Compiler and GC threads are
covered by separate checks there. But JIT::emit_compareImpl and
LOLJIT::emitCompareImpl read a single-character string constant through
JSString::tryGetValue(), which returns a GCOwnedDataScope, so the JITWorker
thread writes the field too. If the IncrementalSweeper timer fires while the
JIT thread is inside that scope, the assertion aborts even though the
ongoing-compilation check would have kept the strings alive.
Read the constant through tryGetValueImpl() and StringImpl::at(0), as the DFG
already does, and assert in setTopGCOwnedDataScopeIfNeeded and
clearTopGCOwnedDataScopeIfNeeded that they never run on a compiler thread.
GC threads still construct such scopes, since
ErrorInstance::reconcileWeakReferencesAtGCEnd materializes stack traces into
strings on the collector thread, so the field keeps ignoring them.
This assertion fired in an ASan build in Bun's CI. Release builds are not
affected.
* Source/JavaScriptCore/heap/GCOwnedDataScope.cpp:
(JSC::setTopGCOwnedDataScopeIfNeeded):
(JSC::clearTopGCOwnedDataScopeIfNeeded):
* Source/JavaScriptCore/jit/JITArithmetic.cpp:
(JSC::JIT::emit_compareImpl):
* Source/JavaScriptCore/lol/LOLJIT.cpp:
(JSC::LOL::LOLJIT::emitCompareImpl):
Canonical link: https://commits.webkit.org/320348@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
