[Webkit-unassigned] [Bug 265721] New: [Wasm-GC] Typedef unrolling cache should hold values strongly

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=265721

            Bug ID: 265721
           Summary: [Wasm-GC] Typedef unrolling cache should hold values
                    strongly
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebAssembly
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: asumu at igalia.com

There is a cache used for unrolling rec/sub types, to avoid re-computing this constantly. The cache holds keys weakly (when the key is collected, it should be explicitly removed from the cache map) but it should hold values strongly to avoid deallocation. Right now the values are also held weakly.

Changing this to use a `RefPtr` instead fixes some crashes related to this. It's been difficult to construct a example to reproduce the issue, but it comes up in real programs.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20231202/53e43b00/attachment.htm>