Bug 110155

Summary: Structure::flattenDictionaryStructure should compute max offset in a manner that soundly handles the case where the property list becomes empty
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: JavaScriptCoreAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: barraclough, bjhomer, ggaren, mark.lam, mhahnenberg, mrowe, msaboff, oliver, sam
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch
none
the patch mrowe: review+

Description Filip Pizlo 2013-02-18 14:48:21 PST
This was a rookie mistake.  It was doing:

for (blah) {
   m_offset = foo // foo's monotonically increase in the loop
}

as a way of computing max offset for all of the properties.  Except what if the loop doesn't execute because there are no properties?  Well, then, you're going to have a bogus m_offset.

The solution is to initialize m_offset at the top of the loop.
Comment 1 Filip Pizlo 2013-02-18 14:48:43 PST
<rdar://problem/13233773>
Comment 2 Filip Pizlo 2013-02-18 14:51:46 PST
Created attachment 188945 [details]
the patch
Comment 3 Filip Pizlo 2013-02-18 14:52:38 PST
Comment on attachment 188945 [details]
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=188945&action=review

> Source/WTF/wtf/DataLog.cpp:80
> -        if (!file)
> +        if (!file) {
>              fprintf(stderr, "Warning: Could not open log file %s for writing.\n", actualFilename);
> +            CRASH();
> +        }

Oops, I will back this out.
Comment 4 Filip Pizlo 2013-02-18 14:53:00 PST
Created attachment 188946 [details]
the patch
Comment 5 Filip Pizlo 2013-02-18 15:23:05 PST
Landed in http://trac.webkit.org/changeset/143269
Comment 6 Filip Pizlo 2013-02-18 16:29:35 PST
*** Bug 110154 has been marked as a duplicate of this bug. ***