Changeset 248337 in webkit

Timestamp:

Aug 6, 2019, 7:48:07 PM (7 years ago)

Author:

ysuzuki@apple.com

Message:

[JSC] sampling-profiler can see garbage Wasm::Callee* pointer which is HashTable deleted / empty values
​https://bugs.webkit.org/show_bug.cgi?id=200494

Reviewed by Saam Barati.

The sampling-profiler can see a garbage pointer which is like Wasm::Callee*. This can be filtered by HashSet<Callee*>.
But this is safe only when the garbage pointer is not deleted / empty values. We saw occasional crash with JetStream2/tsf-wasm.
This patch filters out these values with HashSet<Callee*>::isValidValue.

• wasm/WasmCalleeRegistry.h:

(JSC::Wasm::CalleeRegistry::isValidCallee):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• wasm/WasmCalleeRegistry.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-08-06  Yusuke Suzuki  <ysuzuki@apple.com>
+
+        [JSC] sampling-profiler can see garbage Wasm::Callee* pointer which is HashTable deleted / empty values
+        https://bugs.webkit.org/show_bug.cgi?id=200494
+
+        Reviewed by Saam Barati.
+
+        The sampling-profiler can see a garbage pointer which is like Wasm::Callee*. This can be filtered by HashSet<Callee*>.
+        But this is safe only when the garbage pointer is not deleted / empty values. We saw occasional crash with JetStream2/tsf-wasm.
+        This patch filters out these values with `HashSet<Callee*>::isValidValue`.
+
+        * wasm/WasmCalleeRegistry.h:
+        (JSC::Wasm::CalleeRegistry::isValidCallee):
+
 2019-08-06  Commit Queue  <commit-queue@webkit.org>
 

trunk/Source/JavaScriptCore/wasm/WasmCalleeRegistry.h

@@ -63 +63 @@
     bool isValidCallee(const AbstractLocker&, Callee* callee)
     {
+        if (!HashSet<Callee*>::isValidValue(callee))
+            return false;
         return m_calleeSet.contains(callee);
     }