Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9ed2bcd5bc82549634905af1d8fff425b990a936
https://github.com/WebKit/WebKit/commit/9ed2bcd5bc82549634905af1d8fff425b990a936
Author: Sergey Rubanov <[email protected]>
Date: 2026-10-06 (Tue, 06 Oct 2026)
Changed paths:
M Source/JavaScriptCore/wasm/WasmCalleeGroup.cpp
M Source/JavaScriptCore/wasm/WasmOSREntryPlan.cpp
Log Message:
-----------
[JSC][Wasm] Report OMGOSREntryCallee pending with its BBQ owner
https://bugs.webkit.org/show_bug.cgi?id=324077
rdar://187899560
Reviewed by Yijia Huang.
releaseBBQCallee already reports the BBQCallee pending. The
OMGOSREntryCallee is only owned by that BBQCallee, and
calleeIsReferenced treats it as live only while m_bbqCallee.get()
is non-null. The last BBQ ref can drop on the Wasm worklist, so
~BBQCallee reports the OSR-entry callee too late. A mutator frame
still in that callee can see Indeterminate and miss
m_wasmCalleesPendingDestruction.
Report the OSR-entry callee from releaseBBQCallee as well. If loop
OSR finishes after BBQ is already weak, report the new callee from
OSREntryPlan. The destructor still reports as a fallback.
* Source/JavaScriptCore/wasm/WasmCalleeGroup.cpp:
(CalleeGroup::releaseBBQCallee):
* Source/JavaScriptCore/wasm/WasmOSREntryPlan.cpp:
(OSREntryPlan::work):
Canonical link: https://commits.webkit.org/322903@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
