jsc: treat DFG Plan::m_mustHandleValues as weak so queued compiles don't root user objects

scripts/build/deps/webkit.ts

@@ -7,7 +7,7 @@
 // -lto variants built with ThinLTO (per-module summaries for cross-language
 // importing), and the Windows ICU data table filtered + per-item zstd
 // compressed (lazily decompressed via bun_icu_decompress.cpp).
-export const WEBKIT_VERSION = "4895f45dfbd0d1226c4d41799887bc0ecb9f341b";
+export const WEBKIT_VERSION = "autobuild-preview-pr-308-06ecce07";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

src/jsc/modules/BunJSCModule.h

@@ -799,7 +799,7 @@ JSC_DEFINE_HOST_FUNCTION(functionGenerateHeapSnapshotForDebugging,
     }
     scope.releaseAssertNoException();
 
-    return JSValue::encode(JSONParse(globalObject, WTF::move(jsonString)));
+    RELEASE_AND_RETURN(scope, JSValue::encode(JSONParse(globalObject, WTF::move(jsonString))));
 }
 
 JSC_DEFINE_HOST_FUNCTION(functionSerialize,

test/js/bun/jsc/bun-jsc.test.ts

@@ -24,7 +24,8 @@
   totalCompileTime,
 } from "bun:jsc";
 import { describe, expect, it } from "bun:test";
-import { bunEnv, bunExe, isBuildKite, isWindows } from "harness";
+import { bunEnv, bunExe, isASAN, isBuildKite, isDebug, isWindows } from "harness";
+import path from "node:path";
 
 describe("bun:jsc", () => {
   function count() {
@@ -556,3 +557,36 @@
   const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
   expect({ stdout, exitCode }).toEqual({ stdout: "rejected\n65\n", exitCode: 0 });
 });
+
+// Objects live in a frame at the moment a loop triggers DFG/FTL tier-up are
+// captured into the compilation plan's m_mustHandleValues. Those were rooted
+// as RootMarkReason::JITWorkList for the life of the concurrent compile, so a
+// gc() issued while plans were queued reported fewer objects collected than the
+// program had let go of (node's test-gc-http-client* hit this). The snapshot is
+// now treated as weak; every DFG phase that reads it already handles nullopt.
+it("gc() does not root user objects from a concurrent DFG plan's OSR-entry snapshot", async () => {
+  // Reproducing this needs several independent functions to request DFG at
+  // roughly the same time so most plans are still in the worklist at gc(). The
+  // http client/server path does that reliably (emit, nextTick drain, stream
+  // flow all tier up during the first burst of responses). The fixture reports
+  // how many ClientRequest/IncomingMessage instances the debugging heap
+  // snapshot attributes directly to the JIT worklist; that count must be zero.
+  // One compiler thread so plans queue instead of draining in parallel.
+  await using proc = Bun.spawn({
+    cmd: [
+      bunExe(),
+      "--jsc-numberOfDFGCompilerThreads=1",
+      "--jsc-numberOfFTLCompilerThreads=1",
+      path.join(import.meta.dir, "dfg-plan-gc-fixture.js"),
+    ],
+    env: bunEnv,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+  expect(stderr).toBe("");
+  // The "alive" count is timing dependent (how many plans were queued at the
+  // first gc()), but no ClientRequest/IncomingMessage may be a JITWorkList root.
+  expect(stdout.trim()).toMatch(/^jitworklist-rooted=0 alive=\d+$/);
+  expect(exitCode).toBe(0);
+}, isDebug || isASAN ? 30_000 : undefined);