273228 2024-04-24 21:09:59 -0700 Disable use-after-return checking to fix JSC GC on ASan builds 2024-04-25 15:00:56 -0700 1 1 1 Unclassified WebKit Tools / Tests Other Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=273080 InRadar P2 Normal --- 1 ddkilzer ddkilzer webkit-bug-importer oldest_to_newest 2031080 0 ddkilzer 2024-04-24 21:09:59 -0700 Disable use-after-return checking to fix JSC garbage collection on ASan builds. ASan use-after-return (UAR) checking allocates objects on a "fake stack" in order to detect UAR issues, but the JavaScriptCore garbage collector knows nothing of the "fake stack" (and thus does not scan it for live objects). The garbage collector then assumes any object in the "fake stack" is no longer being referenced and can be freed, which results in false-positive use-after-free crashes. The temporary fix is to disable use-after-return checking at compile time using `-fsanitize-address-use-after-return=never`. At some point if ASan provides API to scan its "fake stack", JSC GC could scan that on ASan builds, and this change could be reverted. <rdar://126269133> 2031082 1 ddkilzer 2024-04-24 21:17:06 -0700 Pull request: https://github.com/WebKit/WebKit/pull/27728 2031226 2 ews-feeder 2024-04-25 11:10:30 -0700 Committed 277993@main (b59055bbf3f5): <https://commits.webkit.org/277993@main> Reviewed commits have been landed. Closing PR #27728 and removing active labels. 2031307 3 ews-feeder 2024-04-25 15:00:56 -0700 Committed 272448.961@safari-7618-branch (89f3455464b3): <https://commits.webkit.org/272448.961@safari-7618-branch> Reviewed commits have been landed. Closing PR #1240 and removing active labels.