Bug 246179

Summary:	[JSC][32bit] HashTable's deletedValue conflict with cell payload
Product:	WebKit	Reporter:	Mikhail R. Gadelha <mikhail>
Component:	JavaScriptCore	Assignee:	Mikhail R. Gadelha <mikhail>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Mikhail R. Gadelha

Reported 2022-10-06 14:19:13 PDT

When processing callees in the sampling profiler a cell payload can be 0xFFFFFFFF, which becomes -1 in 32bit systems, causing an assertion to fail in HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::checkKey(const T& key) when it compares the key to its default deletedValue (-1).

Attachments
Add attachment proposed patch, testcase, etc.

Mikhail R. Gadelha

Comment 1 2022-10-06 14:26:49 PDT

Pull request: https://github.com/WebKit/WebKit/pull/5109

EWS

Comment 2 2022-10-10 00:01:42 PDT

Committed 255332@main (55fce2d2fa0f): <https://commits.webkit.org/255332@main> Reviewed commits have been landed. Closing PR #5109 and removing active labels.

Radar WebKit Bug Importer

Comment 3 2022-10-10 00:02:19 PDT

<rdar://problem/100965275>

Note You need to log in before you can comment on or make changes to this bug.