Closed Bug 1259677 Opened 8 years ago Closed 8 years ago

nsRuleNode passes wrong hash key to PLDHashTable when converting child list into child hash

Categories

(Core :: CSS Parsing and Computation, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
mozilla48
Tracking Status
firefox47 --- fixed
firefox48 --- fixed

People

(Reporter: bholley, Assigned: bholley)

References

Details

Attachments

(1 file)

The second and third entries of the hash key are garbage, which means that we'll generally fail to share those 32 entries, since we'll never find them in the hash table. :-(

PLDHashTable--
Comment on attachment 8734614 [details] [diff] [review]
nsRuleNode passes wrong hash key to PLDHashTable when converting child list into child hash. v1

Ouch.  r=me
Attachment #8734614 - Flags: review?(bzbarsky) → review+
What was the effect of this bug? Did it affect correctness or speed?
Speed.  Cached information that should have been found was not (because it was cached with an incorrect key), and was recomputed later as needed (then cached correctly).
https://hg.mozilla.org/mozilla-central/rev/7b04f2150681
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla48
... also memory use, since we'd end up caching the same information twice.
Comment on attachment 8734614 [details] [diff] [review]
nsRuleNode passes wrong hash key to PLDHashTable when converting child list into child hash. v1

dbaron wants to uplift bug 1258017. That bug depends on this one, so let's start with this one (low risk).

Approval Request Comment
[Feature/regressing bug #]: long ago
[User impact if declined]: slightly worse memory and performance. Out of bounds memory reads.
[Describe test coverage new/current, TreeHerder]: None
[Risks and why]: Very low risk - fixing obviously faulty usage of the API.
[String/UUID change made/needed]: None
Attachment #8734614 - Flags: approval-mozilla-aurora?
Comment on attachment 8734614 [details] [diff] [review]
nsRuleNode passes wrong hash key to PLDHashTable when converting child list into child hash. v1

Potential crash fix and perf improvement, Aurora47+
Attachment #8734614 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Regressions: 1118168
No longer regressions: 1118168
You need to log in before you can comment on or make changes to this bug.