301334 2025-10-23 03:08:41 -0700 Dereferenced WeakRef's are not strongified 2025-11-18 18:42:04 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 1 olivf webkit-unassigned keith_miller olivf omerkatz syg webkit-bug-importer ysuzuki oldest_to_newest 2153636 0 olivf 2025-10-23 03:08:41 -0700 While discussing a user reported OOM exception in V8 (http://crbug.com/42202112) we noticed that JSC does not behave spec compliant with regards to weak refs. Namely it seems to either not implement `9.11 AddToKeptObjects` or call `9.10 ClearKeptObjects` earlier than allowed. Quoting (https://tc39.es/ecma262/#sec-weakref-invariants) "When WeakRef.prototype.deref is called, the referent (if undefined is not returned) is kept alive so that subsequent, synchronous accesses also return the same value". In other words a dereferenced weak ref temporarily makes it strong until the end of the current microtask. Here is a repro which prints "not defined" but is supposed to print "defined". ``` let o = {}; let wr1; let wr2; (function() { wr1 = new WeakRef(o); wr2 = new WeakRef(o); })(); o = null; setTimeout(function() { (function () { wr1.deref(); })(); wr1 = null; gc(); if (typeof wr2.deref() === 'undefined') { print("undefined"); } else { print("not undefined"); } }, 0); ``` 2155210 1 webkit-bug-importer 2025-10-30 03:09:11 -0700 <rdar://problem/163702155> 2159762 2 keith_miller 2025-11-18 18:42:04 -0800 Oh, interesting, I guess either I misunderstood the spec or it changed at some point. We basically make the WeakRef a strong pointer when it gets derefed until the next event loop turn. From an our implementation perspective that's certainly a lot easier (and more performant), that said, it does seem like we don't implement the spec.