Closed
Bug 1265956
Opened 9 years ago
Closed 9 years ago
HashTable's putNew doesn't actually assert if an entry with the same key already exists
Categories
(Core :: JavaScript Engine, defect)
Core
JavaScript Engine
Tracking
()
RESOLVED
FIXED
mozilla48
| Tracking | Status | |
|---|---|---|
| firefox48 | --- | fixed |
People
(Reporter: shu, Unassigned)
References
Details
Attachments
(1 file, 1 obsolete file)
|
(deleted),
patch
|
terrence
:
review+
|
Details | Diff | Splinter Review |
The bug is this:
HashTable::putNewInfallible finds a free entry and does setLive on it. I think the intention was that if the exact same lookup is already in the table, setLive would assert as the entry would be live. But findFreeEntry isn't that smart: it treats attempts to putNew a lookup that already exists in the tree as a collision. This puts the HashTable into a very strange state where you need to remove the same lookup as many times as you putNew'd it for it to be fully removed.
|
Reporter | |
Comment 1•9 years ago
|
||
Attachment #8743104 -
Flags: review?(luke)
|
||
Updated•9 years ago
|
Attachment #8743104 -
Flags: review?(luke) → review+
|
|
Reporter | |
Comment 2•9 years ago
|
||
The previous version didn't work because putNewInfallible is used for rekeying.
Attachment #8743522 -
Flags: review?(terrence)
|
|
Reporter | |
Updated•9 years ago
|
Attachment #8743104 -
Attachment is obsolete: true
|
||
Updated•9 years ago
|
Attachment #8743522 -
Flags: review?(terrence) → review+
|
||
Comment 4•9 years ago
|
||
| bugherder | ||
Status: NEW → RESOLVED
Closed: 9 years ago
status-firefox48:
--- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
You need to log in
before you can comment on or make changes to this bug.
Description
•