Repository navigation
Conversation
The GC collect inside teardownJSCVM is best-effort: any JSC::Strong, conservative stack root, or DOM object with hasPendingActivity (e.g. an entangled MessagePort with a listener) keeps the global marked. When ~GlobalObject doesn't run before shutdown() reaches vm.deinit() / arena_.deinit(), the context stays registered in allScriptExecutionContextsMap with a dangling pointer. Any concurrent postTaskTo — such as the main thread still sending postMessage to a worker that threw on its first message — would find the stale entry and write into freed memory, crashing in mi_malloc. Fix: remove the context from the map explicitly in WebWorker__teardownJSCVM before gcUnprotect, while the globalObject is still alive. This makes postTaskTo() return false deterministically once teardown begins. Make removeFromContextsMap() idempotent via an m_isInContextsMap flag so ~GlobalObject's later call (whenever GC eventually collects the global) is a no-op rather than an assertion failure. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
WalkthroughThis PR prevents a segfault in worker teardown by making ChangesWorker Teardown Context Map Safety
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
seems to have been fixed independently with #30875 |
The GC collect inside teardownJSCVM is best-effort: any JSC::Strong, conservative stack root, or DOM object with hasPendingActivity (e.g. an entangled MessagePort with a listener) keeps the global marked. When ~GlobalObject doesn't run before shutdown() reaches vm.deinit() / arena_.deinit(), the context stays registered in allScriptExecutionContextsMap with a dangling pointer. Any concurrent postTaskTo — such as the main thread still sending postMessage to a worker that threw on its first message — would find the stale entry and write into freed memory, crashing in mi_malloc.
Fix: remove the context from the map explicitly in WebWorker__teardownJSCVM before gcUnprotect, while the globalObject is still alive. This makes postTaskTo() return false deterministically once teardown begins.
Make removeFromContextsMap() idempotent via an m_isInContextsMap flag so ~GlobalObject's later call (whenever GC eventually collects the global) is a no-op rather than an assertion failure.
Fixes: #30348