jsc: treat DFG Plan::m_mustHandleValues as weak so queued compiles don't root user objects

scripts/build/deps/webkit.ts

@@ -7,7 +7,7 @@
 // -lto variants built with ThinLTO (per-module summaries for cross-language
 // importing), and the Windows ICU data table filtered + per-item zstd
 // compressed (lazily decompressed via bun_icu_decompress.cpp).
-export const WEBKIT_VERSION = "4895f45dfbd0d1226c4d41799887bc0ecb9f341b";
+export const WEBKIT_VERSION = "autobuild-preview-pr-308-06ecce07";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

src/jsc/modules/BunJSCModule.h

@@ -799,7 +799,7 @@ JSC_DEFINE_HOST_FUNCTION(functionGenerateHeapSnapshotForDebugging,
     }
     scope.releaseAssertNoException();
 
-    return JSValue::encode(JSONParse(globalObject, WTF::move(jsonString)));
+    RELEASE_AND_RETURN(scope, JSValue::encode(JSONParse(globalObject, WTF::move(jsonString))));
 }
 
 JSC_DEFINE_HOST_FUNCTION(functionSerialize,

test/js/bun/jsc/bun-jsc.test.ts

@@ -24,7 +24,8 @@
   totalCompileTime,
 } from "bun:jsc";
 import { describe, expect, it } from "bun:test";
-import { bunEnv, bunExe, isBuildKite, isWindows } from "harness";
+import { bunEnv, bunExe, isASAN, isBuildKite, isDebug, isWindows } from "harness";
+import path from "node:path";
 
 describe("bun:jsc", () => {
   function count() {
@@ -556,3 +557,36 @@
   const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
   expect({ stdout, exitCode }).toEqual({ stdout: "rejected\n65\n", exitCode: 0 });
 });
+
+// Objects live in a frame at the moment a loop triggers DFG/FTL tier-up are
+// captured into the compilation plan's m_mustHandleValues. Those were rooted
+// as RootMarkReason::JITWorkList for the life of the concurrent compile, so a
+// gc() issued while plans were queued reported fewer objects collected than the
+// program had let go of (node's test-gc-http-client* hit this). The snapshot is
+// now treated as weak; every DFG phase that reads it already handles nullopt.
+it(
+  "gc() does not root user objects from a concurrent DFG plan's OSR-entry snapshot",
+  async () => {
+    // Reproducing this needs several independent functions to request DFG at
+    // roughly the same time so most plans are still in the worklist at gc(). The
+    // http client/server path does that reliably (emit, nextTick drain, stream
+    // flow all tier up during the first burst of responses). The fixture reports
+    // how many ClientRequest/IncomingMessage instances the debugging heap
+    // snapshot attributes directly to the JIT worklist; that count must be zero.
+    // One compiler thread so plans queue instead of draining in parallel.
+    await using proc = Bun.spawn({
+      cmd: [bunExe(), path.join(import.meta.dir, "dfg-plan-gc-fixture.js")],
+      env: { ...bunEnv, BUN_JSC_numberOfDFGCompilerThreads: "1", BUN_JSC_numberOfFTLCompilerThreads: "1" },
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, , exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    // The "alive" count is timing dependent (how many plans were queued at the
+    // first gc()), but no ClientRequest/IncomingMessage may be a JITWorkList root.
+    expect({ stdout: stdout.trim(), exitCode }).toEqual({
+      stdout: expect.stringMatching(/^jitworklist-rooted=0 alive=\d+$/),
+      exitCode: 0,
+    });
+  },
+  isDebug || isASAN ? 30_000 : undefined,
+);