Bug 246179 - [JSC][32bit] HashTable's deletedValue conflict with cell payload
Summary: [JSC][32bit] HashTable's deletedValue conflict with cell payload
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mikhail R. Gadelha
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2022-10-06 14:19 PDT by Mikhail R. Gadelha
Modified: 2022-10-10 00:02 PDT (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mikhail R. Gadelha 2022-10-06 14:19:13 PDT 
When processing callees in the sampling profiler a cell payload can be 0xFFFFFFFF, which becomes -1 in 32bit systems, causing an assertion to fail in HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::checkKey(const T& key) when it compares the key to its default deletedValue (-1).
Comment 1 Mikhail R. Gadelha 2022-10-06 14:26:49 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/5109
Comment 2 EWS 2022-10-10 00:01:42 PDT 
Committed 255332@main (55fce2d2fa0f): <https://commits.webkit.org/255332@main>

Reviewed commits have been landed. Closing PR #5109 and removing active labels.
Comment 3 Radar WebKit Bug Importer 2022-10-10 00:02:19 PDT 
<rdar://problem/100965275>