Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e6507c8f6aa83fb37b02d3c4ceaf7e4f4eb661d3
https://github.com/WebKit/WebKit/commit/e6507c8f6aa83fb37b02d3c4ceaf7e4f4eb661d3
Author: Anand Srinivasan <[email protected]>
Date: 2026-09-04 (Fri, 04 Sep 2026)
Changed paths:
A JSTests/stress/watchpoint-async-generator-code-deletion.js
A JSTests/stress/watchpoint-closure-not-affected.js
M Source/JavaScriptCore/bytecode/CodeBlock.cpp
Log Message:
-----------
Pre-invalidate captured-variable WatchpointSets in generator and async
function bodies
https://bugs.webkit.org/show_bug.cgi?id=313499
rdar://173777534
Reviewed by Yusuke Suzuki.
When deleteAllCode runs while an async generator is suspended, the generator
body's CodeBlock is cleared and later re-created from re-parsed source. The
new CodeBlock's constant pool gets a fresh SymbolTable clone with fresh
WatchpointSets, but the suspended activation still references the original.
A subsequent ResolvedClosureVar put_to_scope on the new CodeBlock fires
touch() against the fresh clone's WatchpointSet, which the DFG is not
watching, so DFG code that constant-folded the captured variable never
deoptimizes and returns stale values.
Treat ResolvedClosureVar writes inside suspendable bodies the same way
ClosureVar writes are already treated: invalidate the WatchpointSet at
link time. Sibling closures using ClosureVar already pay this cost;
extending it to the declaring function eliminates the only remaining
runtime path that relies on SymbolTable identity across re-link.
Tests: JSTests/stress/watchpoint-async-generator-code-deletion.js
JSTests/stress/watchpoint-closure-not-affected.js
* JSTests/stress/watchpoint-async-generator-code-deletion.js: Added.
(async sleepAsync):
(async main.opt):
(async main):
* JSTests/stress/watchpoint-closure-not-affected.js: Added.
(async sleepAsync):
(async test.):
(async test.obj):
* Source/JavaScriptCore/bytecode/CodeBlock.cpp:
(JSC::CodeBlock::finishCreation):
Originally-landed-as: [email protected] (1af72a6f5454).
rdar://185366656
Canonical link: https://commits.webkit.org/320521@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
