[webkit-changes] [WebKit/WebKit] 9bc2ec: Fix bad assert when a DeferredWorkTimer ticket is ...

[Keith Miller]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 9bc2ec09cdb0f556906527c7d69603037f5ec673
      https://github.com/WebKit/WebKit/commit/9bc2ec09cdb0f556906527c7d69603037f5ec673
  Author: Keith Miller <keith_miller at apple.com>
  Date:   2024-10-28 (Mon, 28 Oct 2024)

  Changed paths:
    M Source/JavaScriptCore/runtime/DeferredWorkTimer.cpp
    M Source/JavaScriptCore/runtime/DeferredWorkTimer.h
    M Source/JavaScriptCore/runtime/JSGlobalObject.cpp

  Log Message:
  -----------
  Fix bad assert when a DeferredWorkTimer ticket is cancelled as its global object is visiting children
https://bugs.webkit.org/show_bug.cgi?id=282125
rdar://138675242

Reviewed by Yijia Huang and Mark Lam.

The isCancelled check in JSGlobalObject's visitChildren is just an optimization since the mutator is
running while visiting. Thus the ticket could get cancelled between the check and the dependency fetch.
Thus we should just relax the assertion in this case.

* Source/JavaScriptCore/runtime/DeferredWorkTimer.h:
(JSC::DeferredWorkTimer::TicketData::dependencies):
* Source/JavaScriptCore/runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::visitChildrenImpl):

Canonical link: https://commits.webkit.org/285781@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications