Changeset 35334 in webkit for trunk/JavaScriptCore/wtf/HashFunctions.h

Timestamp:

Jul 24, 2008, 11:40:38 PM (17 years ago)

Author:

[email protected]

Message:

2008-07-24 Geoffrey Garen <​[email protected]>

Reviewed by Maciej Stachowiak.

Fixed a strict aliasing violation, which caused hash tables with floating
point keys not to find items that were indeed in the tables
(intermittently, and only in release builds, of course).

SunSpider reports no change.

This bug doesn't seem to affect any existing code, but it causes obvious
crashes in some new code I'm working on.

• wtf/HashFunctions.h: (WTF::FloatHash::hash): Use a union when punning between a float / double and an unsigned (bucket of bits). With strict aliasing enabled, unions are the only safe way to do this kind of type punning.

• wtf/HashTable.h: When rehashing, ASSERT that the item we just added to the table is indeed in the table. In the buggy case described above, this ASSERT fires.

File:

• trunk/JavaScriptCore/wtf/HashFunctions.h (modified) (1 diff)

trunk/JavaScriptCore/wtf/HashFunctions.h

@@ -95 +95 @@
 
     template<typename T> struct FloatHash {
-        static unsigned hash(T key) { return intHash(*reinterpret_cast<typename IntTypes<sizeof(T)>::UnsignedType*>(&key)); }
+        static unsigned hash(T key)
+        {
+            union {
+                T key;
+                typename IntTypes<sizeof(T)>::UnsignedType bits;
+            } u;
+            u.key = key;
+            return intHash(u.bits);
+        }
         static bool equal(T a, T b) { return a == b; }
         static const bool safeToCompareToEmptyOrDeleted = true;