Bug 235880

Summary: WeakRef deref can return null instead of undefined
Product: WebKit Reporter: Stef Busking <stef.busking>
Component: JavaScriptCoreAssignee: Yusuke Suzuki <ysuzuki>
Status: RESOLVED FIXED    
Severity: Normal CC: ashvayka, bfulgham, ews-watchlist, fpizlo, keith_miller, mark.lam, msaboff, saam, sam, tzagallo, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: Safari 15   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch
none
Patch ashvayka: review+

Description Stef Busking 2022-01-31 01:51:25 PST 
Seen in Safari 15.1, 15.2 (macOS) and Epiphany 41.3 (Linux)

According to the ECMAScript specification (https://tc39.es/ecma262/multipage/managing-memory.html#sec-weakrefderef), a WeakRef's deref method should either return the referenced object or `undefined`. This behaves as expected in Chrome, Firefox and Edge, but it seems that in WebKit browsers this method may return `null` instead.

I've confirmed this behavior using the following in the dev tools console:

```
a = new WeakRef(new ArrayBuffer(10000000))
// wait a while to allow GC to clean up the ArrayBuffer
a.deref()
```

I'm not sure if Webkit browsers have a way to force garbage collection, but waiting a while or using other tabs seems to work for triggering this issue most of the time. Firefox allows forcing GC on about:memory, Chrome and Edge provide a button for this on the Memory tab of their dev tools. 

Expected behavior: a.deref() returns undefined (happens in Chrome, Firefox and Edge)
Actual behavior: a.deref() returns null in Safari and Epiphany
Comment 1 Radar WebKit Bug Importer 2022-02-04 16:18:02 PST 
<rdar://problem/88513359>
Comment 2 Yusuke Suzuki 2022-02-04 17:04:46 PST 
Created attachment 450955 [details]
Patch
Comment 3 Yusuke Suzuki 2022-02-04 17:14:24 PST 
Created attachment 450956 [details]
Patch
Comment 4 Alexey Shvayka 2022-02-04 17:26:52 PST 
Comment on attachment 450956 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=450956&action=review

> Source/JavaScriptCore/ChangeLog:8
> +        WeakRef#deref should return undefined when a wrapped object is collected.

nit: a spec link perhaps? https://tc39.es/ecma262/#sec-weakrefderef
Comment 5 Yusuke Suzuki 2022-02-04 17:27:18 PST 
Thanks Sam and Alexey!
Comment 6 Yusuke Suzuki 2022-02-04 18:00:33 PST 
Comment on attachment 450956 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=450956&action=review

>> Source/JavaScriptCore/ChangeLog:8
>> +        WeakRef#deref should return undefined when a wrapped object is collected.
> 
> nit: a spec link perhaps? https://tc39.es/ecma262/#sec-weakrefderef

Nice, done.
Comment 7 Yusuke Suzuki 2022-02-04 23:27:04 PST 
Committed r289152 (246848@trunk): <https://commits.webkit.org/246848@trunk>