Bug 236278

Summary:

IDBRequest should emit write barrier on JSValueInWrappedObject modification

Product:

WebKit

Reporter:

Yusuke Suzuki <ysuzuki>

Component:

Website Storage

Assignee:

Sihui Liu <sihui_liu>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

alecflett, beidson, darin, ews-watchlist, ggaren, jsbell, sihui_liu, webkit-bug-importer, ysuzuki

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

See Also:

https://bugs.webkit.org/show_bug.cgi?id=236277

Attachments:

Description	Flags
Patch	none
Patch for landing	none

Description Yusuke Suzuki 2022-02-07 19:35:43 PST

https://bugs.webkit.org/show_bug.cgi?id=194806 introduced JSValueInWrappedObject assignment, but this is not correct in terms of semantics since we are not emitting a write-barrier.
So, these fields can be collected by concurrent GC.
See https://bugs.webkit.org/show_bug.cgi?id=236277's FIXME comment for more detail.

Comment 1 Sihui Liu 2022-02-08 16:12:06 PST

Created attachment 451319 [details]
Patch

Comment 2 Geoffrey Garen 2022-02-09 09:49:01 PST

Comment on attachment 451319 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=451319&action=review

r=me

> Source/WebCore/ChangeLog:15
> +        This has a semantice error as the swap process does not emit write barrier (webkit.org/b/236277). To fix the

semantice => semantic

Comment 3 Sihui Liu 2022-02-09 23:29:46 PST

Created attachment 451496 [details]
Patch for landing

Comment 4 EWS 2022-02-10 00:18:14 PST

Committed r289522 (247053@main): <https://commits.webkit.org/247053@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 451496 [details].

Comment 5 Radar WebKit Bug Importer 2022-02-10 00:19:19 PST

<rdar://problem/88740386>

Comment 6 EWS 2023-02-09 11:24:32 PST

Committed 260073@main (4d3456e83828): <https://commits.webkit.org/260073@main>

Reviewed commits have been landed. Closing PR #9696 and removing active labels.