1382435 - jsid's inside ShapeTable with Symbols created from Symbol.for(foo) and with foo will cause hashtable collision

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement)

Description

[(no longer active)]

This is because the symbol will be created using the atom's hash, so if both a jsid with a JSAtom* with that hash inside it and a jsid with the symbol inside it get stored in the hash table, they are guaranteed to collide with each other.

https://searchfox.org/mozilla-central/rev/3a3af33f513071ea829debdfbc628caebcdf6996/js/src/vm/Symbol.cpp#79

Comment 1

[(no longer active)]

Attachment: Create Symbols from Symbol.for() with a different hash from the atom used to create them

Comment 2

[(no longer active)]

I don't think Speedometer actually hits this case, but I found this while looking at the hashing functions for jsid in the context of bug 1382097.

Comment 3

[Jan de Mooij [:jandem]]

Comment on attachment 8888082 [details] [diff] [review]
Create Symbols from Symbol.for() with a different hash from the atom used to create them

Review of attachment 8888082 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/fd9640f4e733
Create Symbols from Symbol.for() with a different hash from the atom used to create them; r=jandem

Comment 5

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/fd9640f4e733