Bug 246179

Summary:	[JSC][32bit] HashTable's deletedValue conflict with cell payload
Product:	WebKit	Reporter:	Mikhail R. Gadelha <mikhail>
Component:	JavaScriptCore	Assignee:	Mikhail R. Gadelha <mikhail>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Description Mikhail R. Gadelha 2022-10-06 14:19:13 PDT

When processing callees in the sampling profiler a cell payload can be 0xFFFFFFFF, which becomes -1 in 32bit systems, causing an assertion to fail in HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::checkKey(const T& key) when it compares the key to its default deletedValue (-1).

Comment 1 Mikhail R. Gadelha 2022-10-06 14:26:49 PDT

Pull request: https://github.com/WebKit/WebKit/pull/5109

Comment 2 EWS 2022-10-10 00:01:42 PDT

Committed 255332@main (55fce2d2fa0f): <https://commits.webkit.org/255332@main>

Reviewed commits have been landed. Closing PR #5109 and removing active labels.

Comment 3 Radar WebKit Bug Importer 2022-10-10 00:02:19 PDT

<rdar://problem/100965275>