tree dbf5b5823bb17fd368b0a1c8cb1465080401aa60
parent 36fb64fd7f00f5c8dc6de21eeca71ca645fc6078
author mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1585864109 +0000
committer mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1585864109 +0000

HeapSnapshotBuilder::analyzeNode() should filter out duplicate cells.
https://bugs.webkit.org/show_bug.cgi?id=209929
<rdar://problem/60974478>

Reviewed by Keith Miller.

HeapSnapshot::finalize() assumes that its list of cells contain no duplicate cells.
HeapSnapshot::appendNode() expects to only be called once for a cell.  It doesn't
check for duplicates.

However, with the concurrent GC marker, there’s a racy chance that the same cell
is visited more than once by SlotVisitor, and therefore, SlotVisitor may call
HeapSnapshotBuilder::analyzeNode() (and HeapSnapshot::appendNode()) more than once
for the same cell.

The easiest and cleanest fix for this is to simply keep a HashSet of appended
cells in HeapSnapshotBuilder while it is building the snapshot.  We can then use
the hash set to filter out already appended cells, and avoid adding duplicates to
the HeapSnapshot.

* heap/HeapSnapshotBuilder.cpp:
(JSC::HeapSnapshotBuilder::buildSnapshot):
(JSC::HeapSnapshotBuilder::analyzeNode):
* heap/HeapSnapshotBuilder.h:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@259418 268f45cc-cd09-0410-ab3c-d52691b4dbfc