Subject:
rhino bug(s)
Date:
Mon, 30 Apr 2001 23:07:00 -0700
From:
Mike Dixon <MDixon@placeware.com>
To:
nboyd@atg.com
hi. i'm a happy rhino user, and just stumbled across what looks like a
pretty basic bug in the property stuff on ScriptableObject... (i'm running
1.5, but it looks like this code hasn't changed in CVS.) since it looks
like you're actively developing (even though it's been a while since
1.5...) i figured you might be interested -- apologies if i missed a more
formal bug reporting process...
the symptom was that i got a "Hashtable internal error" thrown from
getSlotToSet. reading the code, here's what i think could happen:
- create a new object (slots.length is initially 5)
- add 3 properties
- delete those 3 properties
(now count == 0, and slots[i] == REMOVED for 3 values of i)
- add 2 more properties
now assume that you're unlucky, and that these two hash to different values
than the first three; now you have 2 elements of slots[] containing real
slots, and the other three containing REMOVED.
now what happens when you try to create another slot? getSlotToSet is only
willing to put something in a null slot[], and you haven't got one, so you
get the internal error.
writing this message encouraged me to try to write a test case to reproduce
it, and in fact it's trivial:
js> x={}; x.a=x.b=x.c=1; delete x.a; delete x.b; delete x.c; x.d=x.e=1
1
js> x.whatever=1
(boom)
by the way, while reading the code i also noticed what looks like another,
less consequential bug: addSlot increments count before deciding to grow
the table, which is done with a recursive call, which will cause count to
be incremented again -- right? as far as i can tell, setting count too big
will only cause it to grow the table a little early next time, so it
doesn't really matter, but it looks wrong.
.mike.
remove jsdIContext and jsdIThreadstate interfaces
add TYPE_BOOLEAN to jsdIValue
update callback signatures to reflect the removal of jsdIContext and jsdIThreadstate
add errorHook and throwHook attributes to jsdIDebuggerService
remove jsdThreadState and jsdContext objects.
consolidate ExecutionHook and BreakpointHook callbacks
remove return value checking from all methods (xpconnect does this for us.)
validate integrity of jsdScript data to guard against calling into a destroyed script.
queue up script deletes that happen during the JS GC cycle, call them when GC finishes (bug 76979.)
don't NS_IF_ADDREF objects that we get using *::FromPtr()
add jsdScript::Invalidate()
move from pc as a ulong to pc as an object wrapped around a uword (jsdIPC)
rename init() to on() on jsdIService
move lineToPc and pcToLine from jsdIThreadState to jsdIScript (where they belong)
add setBreakpoint(), clearBreakpoint(), and clearAllBreakpoints() to jsdIScript
add off(), clearAllBreakpoints(), and breakpointHook attribute to jsdIService
add creatorURL, creatorLine, constructorURL, constructorLine, and value attribut
es to jsdIObject
move from pc as a ulong to pc as an object wrapped around a uword
relocate jsdService constructor to jsd_xpp.cpp in order to initialize the global
service
