Closed Bug 1372875 Opened 3 years ago Closed 3 years ago

HashTable::AddPtr's mutation count is not checked

Categories

(Core :: JavaScript Engine, enhancement)

55 Branch
enhancement
Not set

Tracking

()

RESOLVED FIXED
mozilla56
Tracking Status
firefox56 --- fixed

People

(Reporter: jonco, Assigned: jonco)

Details

Attachments

(1 file)

HashTable::AddPtr has a mutation count which is presumably there so we can check that the table has not changed since lookupForAdd was called, but this check is missing.
Patch to check generation and mutation count in HashTable:add and generation in remove and rekeyWithoutRehash methods.  Also increment generation when hash table is rehashed in place.

None of these asserts failed in a try push: https://treeherder.mozilla.org/#/jobs?repo=try&revision=7501bac95a0aac586212c11f502be790e285d979&selectedJob=107008453
Attachment #8877609 - Flags: review?(luke)
Attachment #8877609 - Flags: review?(luke) → review+
Pushed by jcoppeard@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f71a1645c218
Add more assertions for hash table pointer generation and mutation count r=luke
https://hg.mozilla.org/mozilla-central/rev/f71a1645c218
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla56
You need to log in before you can comment on or make changes to this bug.