Bug 228892 - [JSC] Custom getter / setter functions can be collected
Summary: [JSC] Custom getter / setter functions can be collected
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
Keywords: InRadar
Depends on:
Reported: 2021-08-06 22:15 PDT by Yusuke Suzuki
Modified: 2021-08-13 22:16 PDT (History)
3 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Yusuke Suzuki 2021-08-06 22:15:57 PDT
It is weakly held. This means that they can be collected if nobody references it.

    var getter = Object.getOwnPropertyDescriptor(RegExp, "rightContext").get;
    getter.mark = true;

// Make GC happens.

    var getter = Object.getOwnPropertyDescriptor(RegExp, "rightContext").get;
    print(getter.mark); // => undefined

We need to keep these accessors strongly in the holder.
Comment 1 Alexey Shvayka 2021-08-06 22:36:08 PDT
Wow, this is a great catch!

Since there could be a lot of `Object.getOwnPropertyDescriptors(%WebIDLInterface%.prototype)` out there in the web, my first approach would be creating separate HashSet on JSGlobalObject that is strong, and leverage Structure::didTransitionFromThisStructure() (m_transitionWatchpointSet) to copy JSCustom{Getter,Setter}Function objects there, so we can avoid overriding MethodTable::destroy() for performance reasons.
Comment 2 Alexey Shvayka 2021-08-06 22:37:21 PDT
So the idea is to keep them weak unless they transition from initial structure.
Comment 3 Alexey Shvayka 2021-08-06 23:01:44 PDT
Hmm, a watchpoint won't help preserve the first marked getter / setter correctly as we have no place to check it except JSObject::getOwnPropertyDescriptor().

Instead, we should subclass WeakHandleOwner, check for modified structure in its finalize(), and tweak WeakGCSet to accept it.
Comment 4 Radar WebKit Bug Importer 2021-08-13 22:16:17 PDT