Fix invalid object property key conversions

Different property names are mapped to the same property key through a
the identifier hash table. In the case of QTBUG-69280 we map a for-in
loop "for (var prop in testCase)" in TestCase.qml to an internal
iterator object, which signals whether it's finished or not by setting a
"done" property on the iterator result object to a boolean. On the
setter side, the property is specified via

  result->put(engine->newString("done"))

and on the getter side the code uses

  result->get(engine->id_done())

For this to work, the newly created string has to map to the same
identifier, otherwise we end up with differing property keys and wrong
values.

The test failure of QTBUG-69280 reproduced a scenario where two strings,
"pathChanged" and "done", mapped to the same index in the hash table
after a rehashing (growing), despite different string hash values. As a
consequence of the hash collision they had adjacent entries in the hash
table, with "pathChanged" coming first.

A subsequent garbage collection run ended up with "pathChanged" being
not marked and subject to removal from the identifier table.
IdentifierTable::sweep() wiped the entry for "pathChanged" and lastEntry
to the now free index and also remembered the exact string hash value.
In the next iteration, sweep() looked at the entry for "done", which
should move to the now free slot, as both strings map to the same index.
However sweep() didn't do that because the comparison of string hash
values failed.

The fix is to compare table indices (covered by
sweepFirstEntryInSameBucketWithDifferingHash) and respect bucket boundaries
(covered by dontSweepAcrossBucketBoundaries).

However it may happen that entries that would map to the same bucket end
up after another bucket because of the insertion order. This would lead
to

    Q_ASSERT(table[lastIdx] == nullptr);

failing right after

    lastIdx = (lastIdx + 1) % alloc;

Instead the determination of the next free slot must follow the same
logic as in addEntry, by finding the first null entry. This is covered
by sweepAcrossBucketBoundariesIfFirstBucketFull.

Task-number: QTBUG-69280
Change-Id: I284f53418d0a75e2edb631f8bacca8c5a596e603
Reviewed-by: Qt CI Bot <qt_ci_bot@qt-project.org>
Reviewed-by: Ulf Hermann <ulf.hermann@qt.io>

0 files changed, 0 insertions, 0 deletions