[JSC] Make a bit defensive on jettisoning

https://bugs.webkit.org/show_bug.cgi?id=274672 rdar://126591959 Reviewed by Yijia Huang. Speculatively making a bit defensive against jettisoning. 1. Ensure jettisoning does not add dead CodeBlocks. 2. Loop finalizeCodeBlockEdge until we ensure that edge is cleared or edge is alive. 3. Clear CallSlot for dead cells in PolymorphicCallStubRoutine (not necessary, but just for defensive change). * Source/JavaScriptCore/jit/PolymorphicCallStubRoutine.cpp: (JSC::PolymorphicCallStubRoutine::visitWeakImpl): * Source/JavaScriptCore/runtime/ScriptExecutable.cpp: (JSC::ScriptExecutable::installCode): * Source/JavaScriptCore/runtime/ScriptExecutableInlines.h: (JSC::ScriptExecutable::finalizeCodeBlockEdge): Canonical link: https://commits.webkit.org/279292@main
WebKit · May 24, 2024 · fc1a727 · fc1a727
1 parent dd1da9b
commit fc1a727
Show file tree

Hide file tree

Showing 3 changed files with 35 additions and 20 deletions.
diff --git a/Source/JavaScriptCore/jit/PolymorphicCallStubRoutine.cpp b/Source/JavaScriptCore/jit/PolymorphicCallStubRoutine.cpp
@@ -171,9 +171,18 @@ void PolymorphicCallStubRoutine::clearCallNodesFor(CallLinkInfo*)
 bool PolymorphicCallStubRoutine::visitWeakImpl(VM& vm)
 {
     bool isStillLive = true;
-    forEachDependentCell([&](JSCell* cell) {
-        isStillLive &= vm.heap.isMarked(cell);
-    });
+    for (unsigned i = 0, size = std::size(trailingSpan()) - 1; i < size; ++i) {
+        auto& slot = trailingSpan()[i];
+        if (!slot.m_calleeOrExecutable) {
+            isStillLive = false;
+            continue;
+        }
+        if (!vm.heap.isMarked(slot.m_calleeOrExecutable)) {
+            slot = CallSlot();
+            isStillLive = false;
+            continue;
+        }
+    }
     return isStillLive;
 }
 

diff --git a/Source/JavaScriptCore/runtime/ScriptExecutable.cpp b/Source/JavaScriptCore/runtime/ScriptExecutable.cpp
@@ -120,8 +120,19 @@ void ScriptExecutable::installCode(CodeBlock* codeBlock)
 
 void ScriptExecutable::installCode(VM& vm, CodeBlock* genericCodeBlock, CodeType codeType, CodeSpecializationKind kind, Profiler::JettisonReason reason)
 {
-    if (genericCodeBlock)
+    if (genericCodeBlock) {
         CODEBLOCK_LOG_EVENT(genericCodeBlock, "installCode", ());
+        switch (reason) {
+        case Profiler::JettisonReason::JettisonDueToWeakReference:
+        case Profiler::JettisonReason::JettisonDueToOldAge: {
+            if (genericCodeBlock && !vm.heap.isMarked(genericCodeBlock))
+                genericCodeBlock = nullptr;
+            break;
+        }
+        default:
+            break;
+        }
+    }
 
     CodeBlock* oldCodeBlock = nullptr;
 
@@ -198,17 +209,6 @@ void ScriptExecutable::installCode(VM& vm, CodeBlock* genericCodeBlock, CodeType
             debugger->registerCodeBlock(genericCodeBlock);
     }
 
-    switch (reason) {
-    case Profiler::JettisonReason::JettisonDueToWeakReference:
-    case Profiler::JettisonReason::JettisonDueToOldAge: {
-        if (genericCodeBlock && !vm.heap.isMarked(genericCodeBlock))
-            genericCodeBlock = nullptr;
-        break;
-    }
-    default:
-        break;
-    }
-
     if (oldCodeBlock)
         oldCodeBlock->unlinkOrUpgradeIncomingCalls(vm, genericCodeBlock);
 

diff --git a/Source/JavaScriptCore/runtime/ScriptExecutableInlines.h b/Source/JavaScriptCore/runtime/ScriptExecutableInlines.h
@@ -32,17 +32,23 @@ namespace JSC {
 
 inline void ScriptExecutable::finalizeCodeBlockEdge(VM& vm, WriteBarrier<CodeBlock>& codeBlockEdge)
 {
-    auto* codeBlock = codeBlockEdge.get();
-    if (!codeBlock)
-        return;
+    for (;;) {
+        auto* codeBlock = codeBlockEdge.get();
+        if (!codeBlock)
+            return;
+
+        if (vm.heap.isMarked(codeBlock))
+            return;
 
-    if (!vm.heap.isMarked(codeBlock)) {
         if (codeBlock->shouldJettisonDueToWeakReference(vm))
             codeBlock->jettison(Profiler::JettisonDueToWeakReference);
         else
             codeBlock->jettison(Profiler::JettisonDueToOldAge);
-        if (codeBlock == codeBlockEdge.get())
+
+        if (codeBlock == codeBlockEdge.get()) {
             codeBlockEdge.clear();
+            return;
+        }
     }
 }