Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b9d477930eddda119e2220c8db8f80658ce9a70b
https://github.com/WebKit/WebKit/commit/b9d477930eddda119e2220c8db8f80658ce9a70b
Author: Keith Miller <[email protected]>
Date: 2026-09-18 (Fri, 18 Sep 2026)
Changed paths:
M Source/JavaScriptCore/heap/Heap.cpp
Log Message:
-----------
finalizeWasmCalleeCleanup should run a cross-modifying code fence
https://bugs.webkit.org/show_bug.cgi?id=320401
rdar://183357733
Reviewed by Marcus Plutowski.
In theory it's possible for finalizeWasmCalleeCleanup to remove the last
reference to a BBQCallee while it's still reachable from the current
thread via a stale direct call. While I don't think this is practically
possible we might as well fence so the requirement is documented.
No new tests, theoretical bug.
Originally-landed-as: 316606.250@safari-7625-branch (0c21be440adc).
rdar://187506372
Canonical link: https://commits.webkit.org/321424@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
