[JSC] ConservativeRoots: no past-the-end butterfly slack for cells that cannot hold a butterfly (MarkedBlock rule + PreciseAllocation::contains) - #398
Merged
dylan-conway merged 3 commits intoAug 9, 2026
Claude / Claude Code Review
completed
Aug 9, 2026 in 14m 42s
Code review found 1 potential issue
Found 1 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | Source/JavaScriptCore/heap/ConservativeRoots.cpp:195-198 |
MarkedBlock path drops exact one-past-the-end for non-butterfly cells; PreciseAllocation path keeps it |
Annotations
Check warning on line 198 in Source/JavaScriptCore/heap/ConservativeRoots.cpp
claude / Claude Code Review
MarkedBlock path drops exact one-past-the-end for non-butterfly cells; PreciseAllocation path keeps it
Commit 9b999ae9d4 relaxed the PreciseAllocation branch to `<= end` because compiler-rewritten loops over trailing in-cell storage (DirectArguments, JSLexicalEnvironment, JSBigInt digits, large JSFinalObject inline storage) can materialise the exact one-past-the-end pointer as the only live reference — but that same rationale applies to those types when they live in a MarkedBlock with `objectSize == cellSize`, and here the new `mayHaveIndexingHeader(cellKind)` guard now drops that case (when the
Loading