Closed Bug 1382435 Opened 2 years ago Closed 2 years ago

jsid's inside ShapeTable with Symbols created from Symbol.for(foo) and with foo will cause hashtable collision

Categories

(Core :: JavaScript Engine, enhancement)

enhancement
Not set

Tracking

()

RESOLVED FIXED
mozilla56
Tracking Status
firefox56 --- fixed

People

(Reporter: Ehsan, Assigned: Ehsan)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

This is because the symbol will be created using the atom's hash, so if both a jsid with a JSAtom* with that hash inside it and a jsid with the symbol inside it get stored in the hash table, they are guaranteed to collide with each other.

https://searchfox.org/mozilla-central/rev/3a3af33f513071ea829debdfbc628caebcdf6996/js/src/vm/Symbol.cpp#79
I don't think Speedometer actually hits this case, but I found this while looking at the hashing functions for jsid in the context of bug 1382097.
Blocks: 1382097
Comment on attachment 8888082 [details] [diff] [review]
Create Symbols from Symbol.for() with a different hash from the atom used to create them

Review of attachment 8888082 [details] [diff] [review]:
-----------------------------------------------------------------

Good catch.
Attachment #8888082 - Flags: review?(jdemooij) → review+
Pushed by eakhgari@mozilla.com:
https://hg.mozilla.org/integration/mozilla-inbound/rev/fd9640f4e733
Create Symbols from Symbol.for() with a different hash from the atom used to create them; r=jandem
https://hg.mozilla.org/mozilla-central/rev/fd9640f4e733
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla56
You need to log in before you can comment on or make changes to this bug.