tree 95a1571794d7d9a63eb376f54a26b02c999c22ca
parent 186929fd217c12e69cbb3e31cb40b90760b0f799
author Dan Hecht <dan.hecht@apple.com> 1786127150 -0700
committer Dan Hecht <dan.hecht@apple.com> 1786127150 -0700

[JSC] LazyJSValue::emit leaks a StringImpl reference when finalization is skipped
https://bugs.webkit.org/show_bug.cgi?id=321221
rdar://184272837

Reviewed by Yusuke Suzuki.

emit() manually refs a NewStringImpl's StringImpl and relies on the main-thread
finalization task to deref it, but several paths skip that task. When JIT
executable memory runs out after code generation, both DFG and FTL bail on
LinkBuffer::didFailToAllocate(), so the link task never runs and the finalization
task it would have registered never exists. Separately,
runMainThreadFinalizationTasks() runs inside JITFinalizer::finalize(), which
Plan::finalize() only reaches past its isStillValidCodeBlock() check, so a
compilation that links successfully and is then invalidated leaks as well. A plan
cancelled after code generation would leak the same way, which today only the
placement of safepoints prevents.

Hold the reference in a RefPtr instead, so it is released whether the task runs
or not.

* Source/JavaScriptCore/dfg/DFGLazyJSValue.cpp:
(JSC::DFG::EscapedLazyJSValue::EscapedLazyJSValue):
(JSC::DFG::LazyJSValue::emit const):

Canonical link: https://commits.webkit.org/318800@main