Branch: refs/heads/main Home: https://github.com/WebKit/WebKit Commit: 55fce2d2fa0fc5c39d9f7d198eb3ff91cbd03c3b https://github.com/WebKit/WebKit/commit/55fce2d2fa0fc5c39d9f7d198eb3ff91cbd03c3b Author: Mikhail R. Gadelha <mikh...@igalia.com> Date: 2022-10-10 (Mon, 10 Oct 2022)
Changed paths: A JSTests/stress/hash-deleted-value-cell-32.js M Source/JavaScriptCore/heap/HeapUtil.h Log Message: ----------- [JSC][32bit] HashTable's deletedValue conflict with cell payload https://bugs.webkit.org/show_bug.cgi?id=246179 Reviewed by Darin Adler. When processing callees in the sampling profiler a cell payload can be 0xFFFFFFFF, which becomes -1 in 32bit systems, causing an assertion to fail in HashTable::checkKey when it compares the key to its default deletedValue (-1), but only when JSC is built with asserts enabled. This patch adds a guard to prevent checking the assertion if the cell is equal to the deletedValue by checking if the cell is a valid set value. It's only enabled in 32bit builds when asserts are enabled. * JSTests/stress/hash-deleted-value-cell-32.js: Added. (__getProperties): (__getRandomProperty): (startSamplingProfiler.__v_45.shouldThrow): (i.try.__v_45.shouldThrow): * Source/JavaScriptCore/heap/HeapUtil.h: (JSC::HeapUtil::isPointerGCObjectJSCell): Canonical link: https://commits.webkit.org/255332@main _______________________________________________ webkit-changes mailing list webkit-changes@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-changes