Bug 235880 - WeakRef deref can return null instead of undefined
Summary: WeakRef deref can return null instead of undefined
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari 15
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Yusuke Suzuki
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2022-01-31 01:51 PST by Stef Busking
Modified: 2022-02-04 23:27 PST (History)
12 users (show)

See Also:


Attachments
Patch (2.69 KB, patch)
2022-02-04 17:04 PST, Yusuke Suzuki
no flags Details | Formatted Diff | Diff
Patch (6.19 KB, patch)
2022-02-04 17:14 PST, Yusuke Suzuki
ashvayka: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Stef Busking 2022-01-31 01:51:25 PST
Seen in Safari 15.1, 15.2 (macOS) and Epiphany 41.3 (Linux)

According to the ECMAScript specification (https://tc39.es/ecma262/multipage/managing-memory.html#sec-weakrefderef), a WeakRef's deref method should either return the referenced object or `undefined`. This behaves as expected in Chrome, Firefox and Edge, but it seems that in WebKit browsers this method may return `null` instead.

I've confirmed this behavior using the following in the dev tools console:

```
a = new WeakRef(new ArrayBuffer(10000000))
// wait a while to allow GC to clean up the ArrayBuffer
a.deref()
```

I'm not sure if Webkit browsers have a way to force garbage collection, but waiting a while or using other tabs seems to work for triggering this issue most of the time. Firefox allows forcing GC on about:memory, Chrome and Edge provide a button for this on the Memory tab of their dev tools. 

Expected behavior: a.deref() returns undefined (happens in Chrome, Firefox and Edge)
Actual behavior: a.deref() returns null in Safari and Epiphany
Comment 1 Radar WebKit Bug Importer 2022-02-04 16:18:02 PST
<rdar://problem/88513359>
Comment 2 Yusuke Suzuki 2022-02-04 17:04:46 PST
Created attachment 450955 [details]
Patch
Comment 3 Yusuke Suzuki 2022-02-04 17:14:24 PST
Created attachment 450956 [details]
Patch
Comment 4 Alexey Shvayka 2022-02-04 17:26:52 PST
Comment on attachment 450956 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=450956&action=review

> Source/JavaScriptCore/ChangeLog:8
> +        WeakRef#deref should return undefined when a wrapped object is collected.

nit: a spec link perhaps? https://tc39.es/ecma262/#sec-weakrefderef
Comment 5 Yusuke Suzuki 2022-02-04 17:27:18 PST
Thanks Sam and Alexey!
Comment 6 Yusuke Suzuki 2022-02-04 18:00:33 PST
Comment on attachment 450956 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=450956&action=review

>> Source/JavaScriptCore/ChangeLog:8
>> +        WeakRef#deref should return undefined when a wrapped object is collected.
> 
> nit: a spec link perhaps? https://tc39.es/ecma262/#sec-weakrefderef

Nice, done.
Comment 7 Yusuke Suzuki 2022-02-04 23:27:04 PST
Committed r289152 (246848@trunk): <https://commits.webkit.org/246848@trunk>