<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>11336</bug_id>
          
          <creation_ts>2006-10-17 17:57:34 -0700</creation_ts>
          <short_desc>HashTable.h not zeroing pointers in constructor</short_desc>
          <delta_ts>2007-09-30 06:37:06 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>420+</version>
          <rep_platform>PC</rep_platform>
          <op_sys>OS X 10.4</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>WONTFIX</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Michael Emmel">mike.emmel</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>52234</commentid>
    <comment_count>0</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2006-10-17 17:57:34 -0700</bug_when>
    <thetext>In debug mode the new m_next and m_previous pointers are net set to zero
leadin to crashes.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>52235</commentid>
    <comment_count>1</comment_count>
      <attachid>11126</attachid>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2006-10-17 17:58:49 -0700</bug_when>
    <thetext>Created attachment 11126
zero pointers in constructor HashTable.h</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>52211</commentid>
    <comment_count>2</comment_count>
      <attachid>11127</attachid>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2006-10-17 18:02:50 -0700</bug_when>
    <thetext>Created attachment 11127
Missed the second constructor</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>52162</commentid>
    <comment_count>3</comment_count>
    <who name="Maciej Stachowiak">mjs</who>
    <bug_when>2006-10-17 20:49:44 -0700</bug_when>
    <thetext>I don&apos;t think this is necessary because the constructors all call addIterator, which initializes both m_next and m_previous. Will ask for Darin&apos;s input.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>52094</commentid>
    <comment_count>4</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2006-10-17 21:24:39 -0700</bug_when>
    <thetext>
Okay the problem is  in the assert

assert(table-&gt;m_iterators != it);
it-&gt;m_next = table-&gt;m_iterators;

If their is a problem it triggers before we initalize the m_next so its still garbage and makes it hard to debug.

Been a while since I looked at this.
The assert could be moved below and still work.



</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>51941</commentid>
    <comment_count>5</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2006-10-18 11:35:57 -0700</bug_when>
    <thetext>(In reply to comment #3)
&gt; I don&apos;t think this is necessary because the constructors all call addIterator,
&gt; which initializes both m_next and m_previous. Will ask for Darin&apos;s input.

Maciej&apos;s correct about my original intent.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>51921</commentid>
    <comment_count>6</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2006-10-18 12:08:45 -0700</bug_when>
    <thetext>
Can you move the assert below the setting of the value then ?
So the pointer is not garbage when the assert triggers.

From this

assert(table-&gt;m_iterators != it);
it-&gt;m_next = table-&gt;m_iterators;

To this
//set pointer so its not garbage
it-&gt;m_next = table-&gt;m_iterators;
//assert now if its incorrect.
assert(table-&gt;m_iterators != it);

Its not completely obvious the next pointer is garbage
if you trigger this in a debugger.



</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>51522</commentid>
    <comment_count>7</comment_count>
      <attachid>11127</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2006-10-21 18:48:52 -0700</bug_when>
    <thetext>Comment on attachment 11127
Missed the second constructor 

This patch won&apos;t compile (missing colon in the second constructor).

And I&apos;m not convinced the change is helpful. I understand that this confused you once while debugging, but I&apos;d prefer to just leave this as-is unless you present a more compelling argument to change it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>51342</commentid>
    <comment_count>8</comment_count>
    <who name="Michael Emmel">mike.emmel</who>
    <bug_when>2006-10-22 00:02:38 -0700</bug_when>
    <thetext>
I don&apos;t think the patch is the right answer in the first place.
If you do hit the assert your dealing with some intresting info in a debugger.
And it does its job below.
I&apos;ve got no strong feelings either way it was just confusing at the time.

The reason I hit it the first time is actually a bit more involved I had
compiled JavaScriptCore and WebKit with different debug flags but this is more a build/linking issue. From my experience this does not seem to work.

</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>11126</attachid>
            <date>2006-10-17 17:58:49 -0700</date>
            <delta_ts>2006-10-17 18:02:50 -0700</delta_ts>
            <desc>zero pointers in constructor HashTable.h</desc>
            <filename>hash.diff</filename>
            <type>text/plain</type>
            <size>544</size>
            <attacher name="Michael Emmel">mike.emmel</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0phdmFTY3JpcHRDb3JlL3d0Zi9IYXNoVGFibGUuaCBiL0phdmFTY3JpcHRD
b3JlL3d0Zi9IYXNoVGFibGUuaAppbmRleCA0ZTA3ZWVjLi40Zjk2ZDU2IDEwMDc1NQotLS0gYS9K
YXZhU2NyaXB0Q29yZS93dGYvSGFzaFRhYmxlLmgKKysrIGIvSmF2YVNjcmlwdENvcmUvd3RmL0hh
c2hUYWJsZS5oCkBAIC05OCw2ICs5OCwxMCBAQCAjZW5kaWYKIAogICAgICAgICBIYXNoVGFibGVD
b25zdEl0ZXJhdG9yKGNvbnN0IEhhc2hUYWJsZVR5cGUqIHRhYmxlLCBQb2ludGVyVHlwZSBwb3Np
dGlvbiwgUG9pbnRlclR5cGUgZW5kUG9zaXRpb24pCiAgICAgICAgICAgICA6IG1fcG9zaXRpb24o
cG9zaXRpb24pLCBtX2VuZFBvc2l0aW9uKGVuZFBvc2l0aW9uKQorI2lmIENIRUNLX0hBU0hUQUJM
RV9JVEVSQVRPUlMKKyAgICAgICAgICAgICwgbV9uZXh0KDApLCBtX3ByZXZpb3VzKDApCisjZW5k
aWYKKwogICAgICAgICB7CiAgICAgICAgICAgICBhZGRJdGVyYXRvcih0YWJsZSwgdGhpcyk7CiAg
ICAgICAgICAgICBza2lwRW1wdHlCdWNrZXRzKCk7Cg==
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>11127</attachid>
            <date>2006-10-17 18:02:50 -0700</date>
            <delta_ts>2006-10-21 18:48:52 -0700</delta_ts>
            <desc>Missed the second constructor </desc>
            <filename>hash.diff</filename>
            <type>text/plain</type>
            <size>752</size>
            <attacher name="Michael Emmel">mike.emmel</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0phdmFTY3JpcHRDb3JlL3d0Zi9IYXNoVGFibGUuaCBiL0phdmFTY3JpcHRD
b3JlL3d0Zi9IYXNoVGFibGUuaAppbmRleCA0ZTA3ZWVjLi4zZDYwNTVlIDEwMDc1NQotLS0gYS9K
YXZhU2NyaXB0Q29yZS93dGYvSGFzaFRhYmxlLmgKKysrIGIvSmF2YVNjcmlwdENvcmUvd3RmL0hh
c2hUYWJsZS5oCkBAIC05OCw2ICs5OCwxMCBAQCAjZW5kaWYKIAogICAgICAgICBIYXNoVGFibGVD
b25zdEl0ZXJhdG9yKGNvbnN0IEhhc2hUYWJsZVR5cGUqIHRhYmxlLCBQb2ludGVyVHlwZSBwb3Np
dGlvbiwgUG9pbnRlclR5cGUgZW5kUG9zaXRpb24pCiAgICAgICAgICAgICA6IG1fcG9zaXRpb24o
cG9zaXRpb24pLCBtX2VuZFBvc2l0aW9uKGVuZFBvc2l0aW9uKQorI2lmIENIRUNLX0hBU0hUQUJM
RV9JVEVSQVRPUlMKKyAgICAgICAgICAgICwgbV9uZXh0KDApLCBtX3ByZXZpb3VzKDApCisjZW5k
aWYKKwogICAgICAgICB7CiAgICAgICAgICAgICBhZGRJdGVyYXRvcih0YWJsZSwgdGhpcyk7CiAg
ICAgICAgICAgICBza2lwRW1wdHlCdWNrZXRzKCk7CkBAIC0xMDUsNiArMTA5LDkgQEAgI2VuZGlm
CiAKICAgICBwdWJsaWM6CiAgICAgICAgIEhhc2hUYWJsZUNvbnN0SXRlcmF0b3IoKQorI2lmIENI
RUNLX0hBU0hUQUJMRV9JVEVSQVRPUlMKKyAgICAgICAgICBtX25leHQoMCksIG1fcHJldmlvdXMo
MCkKKyNlbmRpZgogICAgICAgICB7CiAgICAgICAgICAgICBhZGRJdGVyYXRvcigwLCB0aGlzKTsK
ICAgICAgICAgfQo=
</data>
<flag name="review"
          id="3794"
          type_id="1"
          status="-"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>