496633 - TypeError thrown when Vector types from different loaded abcs collide

Status: VERIFIED FIXED

(Tamarin Graveyard :: Virtual Machine, defect, P1)

Description

[Dan Schaffer]

reported from a player bug.

collision occurs when two different Domains create a typed Vector of the class.

e.g.
    public class mas {
        public function mas() {
            print("mas: in constructor");
            var d1:Domain=new Domain(Domain.currentDomain);
            d1.load("mod1.abc");
            var d2:Domain=new Domain(Domain.currentDomain);
            d2.load("mod2.abc");
        }
    }
    new mas();

TypeError occurs if each loaded class in different domains create a typed vector with the same type.  e.g.
mod1.abc and mod2.abc both do:
            var v:Vector.<foo>=new Vector.<foo>();
            v.push(new foo());

when mas.abc is run error is:
TypeError: Error #1034: Type Coercion failed: cannot convert foo@312e91 to foo.
	at Vector$object/http://adobe.com/AS3/2006/builtin::push()
	at Function/http://adobe.com/AS3/2006/builtin::apply()
	at Function/<anonymous>()
	at mod2()
	at global$init()
	at avmplus::Domain/loadBytes()
	at avmplus::Domain/load()
	at mas()
	at global$init()

commented out the Vector reference and changing to just a simple reference does not return the TypeError. e.g.
  // both mod1.abc and mod2.abc contain:
  var v:foo=new foo();

Comment 1

[Dan Schaffer]

Attachment: files to reproduce bug

added bug files to reproduce bug.  see build.sh for build instructions.  running avmshell mas.abc reproduces the TypeError in tr-1982.

Comment 2

[Erik Tierney]

Attachment: Fix vector problem

The problem was that we were only creating 1 Vector class for Vector.<Foo>.  However, there were 2 different Foo's from different domains.

Instead of storing the instantiated Vector classes in the builtin Domain, store them in the Domain the type parameter came from.  This allows us to have 2 different Vector.<Foo> (one for each Foo) that are only visible where the appropriate definition of Foo is available.  

Also had to change the instantiated_type map from using the name, to using the type parameter since there can now be multipe Vector.<Foo>.

Comment 3

[Steven Johnson]

Comment on attachment 382158 [details] [diff] [review]
Fix vector problem

approved, but we *must* add acceptance tests for this in a subsequent patch.

Comment 4

[Dan Schaffer]

Attachment: testcase

Comment 5

[Erik Tierney]

Pushed fix along with testcases:
http://hg.mozilla.org/tamarin-redux/rev/d13df55e72bb

Comment 6

[Dan Schaffer]

closing bug by marking verified/fixed