[webkit-changes] [WebKit/WebKit] 55fce2: [JSC][32bit] HashTable's deletedValue conflict wit...

[Mikhail R. Gadelha]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 55fce2d2fa0fc5c39d9f7d198eb3ff91cbd03c3b
      https://github.com/WebKit/WebKit/commit/55fce2d2fa0fc5c39d9f7d198eb3ff91cbd03c3b
  Author: Mikhail R. Gadelha <mikhail at igalia.com>
  Date:   2022-10-10 (Mon, 10 Oct 2022)

  Changed paths:
    A JSTests/stress/hash-deleted-value-cell-32.js
    M Source/JavaScriptCore/heap/HeapUtil.h

  Log Message:
  -----------
  [JSC][32bit] HashTable's deletedValue conflict with cell payload
https://bugs.webkit.org/show_bug.cgi?id=246179

Reviewed by Darin Adler.

When processing callees in the sampling profiler a cell payload can be
0xFFFFFFFF, which becomes -1 in 32bit systems, causing an assertion to fail in
HashTable::checkKey when it compares the key to its default deletedValue (-1),
but only when JSC is built with asserts enabled.

This patch adds a guard to prevent checking the assertion if the cell is equal
to the deletedValue by checking if the cell is a valid set value. It's only
enabled in 32bit builds when asserts are enabled.

* JSTests/stress/hash-deleted-value-cell-32.js: Added.
(__getProperties):
(__getRandomProperty):
(startSamplingProfiler.__v_45.shouldThrow):
(i.try.__v_45.shouldThrow):
* Source/JavaScriptCore/heap/HeapUtil.h:
(JSC::HeapUtil::isPointerGCObjectJSCell):

Canonical link: https://commits.webkit.org/255332@main