228892 2021-08-06 22:15:57 -0700 [JSC] Custom getter / setter functions can be collected 2021-08-13 22:16:17 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 1 ysuzuki webkit-unassigned ashvayka webkit-bug-importer ysuzuki oldest_to_newest 1782663 0 ysuzuki 2021-08-06 22:15:57 -0700 It is weakly held. This means that they can be collected if nobody references it. So, { var getter = Object.getOwnPropertyDescriptor(RegExp, "rightContext").get; getter.mark = true; } // Make GC happens. { var getter = Object.getOwnPropertyDescriptor(RegExp, "rightContext").get; print(getter.mark); // => undefined } We need to keep these accessors strongly in the holder. 1782664 1 ashvayka 2021-08-06 22:36:08 -0700 Wow, this is a great catch! Since there could be a lot of `Object.getOwnPropertyDescriptors(%WebIDLInterface%.prototype)` out there in the web, my first approach would be creating separate HashSet on JSGlobalObject that is strong, and leverage Structure::didTransitionFromThisStructure() (m_transitionWatchpointSet) to copy JSCustom{Getter,Setter}Function objects there, so we can avoid overriding MethodTable::destroy() for performance reasons. 1782665 2 ashvayka 2021-08-06 22:37:21 -0700 So the idea is to keep them weak unless they transition from initial structure. 1782666 3 ashvayka 2021-08-06 23:01:44 -0700 Hmm, a watchpoint won't help preserve the first marked getter / setter correctly as we have no place to check it except JSObject::getOwnPropertyDescriptor(). Instead, we should subclass WeakHandleOwner, check for modified structure in its finalize(), and tweak WeakGCSet to accept it. 1784309 4 webkit-bug-importer 2021-08-13 22:16:17 -0700 <rdar://problem/81928455>