Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 111d7edcecd19a77402355eb24e46dc53866de55
https://github.com/WebKit/WebKit/commit/111d7edcecd19a77402355eb24e46dc53866de55
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A JSTests/stress/regexp-test-inline-delete-all-code-race.js
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
M Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp
M Source/JavaScriptCore/runtime/RegExp.h
Log Message:
-----------
[JSC] `RegExpTestInline` crashes when `deleteAllCode()` runs during a DFG/FTL
compilation
https://bugs.webkit.org/show_bug.cgi?id=323583
Reviewed by Yusuke Suzuki.
DFGStrengthReductionPhase converts RegExpTest to RegExpTestInline after
checking regExp->getRegExpJITCodeBlock() on the compiler thread, but records
only the frozen RegExp* in the node. Code generation calls
getRegExpJITCodeBlock() again, and it returns nullptr once the RegExp has
left the JITCode state. The main thread can reset that state at any point
during the compilation: VM::deleteAllCode() clears every cached RegExp
before completing the in-flight JIT plans. When this lands between strength
reduction and code generation, the compiler thread crashes on the null
YarrCodeBlock. The race has existed since 244149@main introduced
RegExpTestInline.
Make code generation read the YarrCodeBlock through a new
getRegExpJITCodeBlockConcurrently() that does not consult the compilation
state. This is safe because deleteCode() only clears the compiled code refs:
it never resets m_regExpJITCode once allocated, and YarrCodeBlock::clear()
keeps the InlineStats. Code generation reads only stackSize() and
needsTemp2() from the stats, which are functions of the pattern alone
(unlike canInline() and codeSize(), which depend on the subject string
sampled for the Boyer-Moore lookahead), and it regenerates the matcher from
the pattern source via jitCompileInlinedTest, so the emitted code is correct
whatever the compilation state is.
Test: JSTests/stress/regexp-test-inline-delete-all-code-race.js
* JSTests/stress/regexp-test-inline-delete-all-code-race.js: Added.
(tick):
(let.hot):
(ftlTick):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compileRegExpTestInline):
* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
* Source/JavaScriptCore/runtime/RegExp.h:
Canonical link: https://commits.webkit.org/320684@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
