зеркало из https://github.com/mozilla/pjs.git
6a31817fc0
Subject:
rhino bug(s)
Date:
Mon, 30 Apr 2001 23:07:00 -0700
From:
Mike Dixon <MDixon@placeware.com>
To:
nboyd@atg.com
hi. i'm a happy rhino user, and just stumbled across what looks like a
pretty basic bug in the property stuff on ScriptableObject... (i'm running
1.5, but it looks like this code hasn't changed in CVS.) since it looks
like you're actively developing (even though it's been a while since
1.5...) i figured you might be interested -- apologies if i missed a more
formal bug reporting process...
the symptom was that i got a "Hashtable internal error" thrown from
getSlotToSet. reading the code, here's what i think could happen:
- create a new object (slots.length is initially 5)
- add 3 properties
- delete those 3 properties
(now count == 0, and slots[i] == REMOVED for 3 values of i)
- add 2 more properties
now assume that you're unlucky, and that these two hash to different values
than the first three; now you have 2 elements of slots[] containing real
slots, and the other three containing REMOVED.
now what happens when you try to create another slot? getSlotToSet is only
willing to put something in a null slot[], and you haven't got one, so you
get the internal error.
writing this message encouraged me to try to write a test case to reproduce
it, and in fact it's trivial:
js> x={}; x.a=x.b=x.c=1; delete x.a; delete x.b; delete x.c; x.d=x.e=1
1
js> x.whatever=1
(boom)
by the way, while reading the code i also noticed what looks like another,
less consequential bug: addSlot increments count before deciding to grow
the table, which is done with a recursive call, which will cause count to
be incremented again -- right? as far as i can tell, setting count too big
will only cause it to grow the table a little early next time, so it
doesn't really matter, but it looks wrong.
.mike.
|
||
|---|---|---|
| .. | ||
| docs | ||
| examples | ||
| macbuild | ||
| org/mozilla | ||
| src | ||
| toolsrc | ||
| Makefile | ||
| README.html | ||
| apiClasses.properties | ||
| build-date | ||
| build.xml | ||
README.html
<html> <!-- - The contents of this file are subject to the Netscape Public - License Version 1.1 (the "License"); you may not use this file - except in compliance with the License. You may obtain a copy of - the License at http://www.mozilla.org/NPL/ - - Software distributed under the License is distributed on an "AS - IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or - implied. See the License for the specific language governing - rights and limitations under the License. - - The Original Code is Rhino code, released - May 6, 1999. - - The Initial Developer of the Original Code is Netscape - Communications Corporation. Portions created by Netscape are - Copyright (C) 1998-1999 Netscape Communications Corporation. All - Rights Reserved. - - Contributor(s): - Norris Boyd - - Alternatively, the contents of this file may be used under the - terms of the GNU Public License (the "GPL"), in which case the - provisions of the GPL are applicable instead of those above. - If you wish to allow use of your version of this file only - under the terms of the GPL and not to allow others to use your - version of this file under the NPL, indicate your decision by - deleting the provisions above and replace them with the notice - and other provisions required by the GPL. If you do not delete - the provisions above, a recipient may use your version of this - file under either the NPL or the GPL. --> <body> <h1> <span CLASS=LXRSHORTDESC> Rhino: JavaScript in Java<p> </span> </h1> <span CLASS=LXRLONGDESC> Rhino is an implementation of JavaScript in Java. Documentation can be found <a href="http://www.mozilla.org/js/rhino/rhino.html">here</a>. </span> </body> </html>