141173 - Map is crash happy. Let's blame TxObject

Status: VERIFIED FIXED

(Core :: XSLT, defect)

Description

[Axel Hecht]

Depending on how eagerly ones OS returns high value pointers, the following
code in Map blows:

    //-- compute hash for key
    PRInt32 hashCode = key->hashCode();

    //-- calculate index
    int idx = hashCode % numberOfBuckets;

    //-- fetch first item in bucket
    BucketItem* bktItem = elements[idx];

hashCode is signed -> idx is signed, negative indexes aren't fun.

Patch coming up.

Comment 1

[Axel Hecht]

Attachment: make TxObject::hashCode() return PRUint32

Comment 2

[Peter Van der Beken [:peterv]]

Comment on attachment 81671 [details] [diff] [review]
make TxObject::hashCode() return PRUint32

r=peterv

Comment 3

[jag (Peter Annema)]

Comment on attachment 81671 [details] [diff] [review]
make TxObject::hashCode() return PRUint32

sr=jag

Comment 4

[Axel Hecht]

fix landed on the trunk, mailed drivers

Comment 5

[Axel Hecht]

let it crash.

Comment 6

[Heikki Toivonen (remove -bugzilla when emailing directly)]

We have time for 1.0.1, so this bug has a chance to go there. Do you have a
testcase/platform where this occurs, or is this totally random? Are there
talkback reports on this? Does this cause any new compiler warnings? Are all the
users of this API and the new unsigned values prepared to deal with unsigned values?

Comment 7

[Axel Hecht]

we didn't verify for a long time.
I really checked, so VERIFIED.