Unfathomable Bugs #4: Keys that aren’t

posted by Craig Gidney on November 6, 2012

Today’s bug design flaw comes courtesy of Adobe. Thank you, Adobe, this series wouldn’t exist without the generous support of entities like you.

I mentioned this bug design flaw in passing in a previous post, but it’s so good it deserves one of its own.

Here’s the hypothetical situation: you’re making a flash game. In that game users can create named profiles. You store the profiles, keyed by their name, so that you ca- OOPS, you just introduced a bug. What’s the problem? The dictionary.

Dictionaries (a.k.a. maps or hash tables or associative arrays) are a very useful construct. Most languages, including ActionScript 3.0, have one built in to their standard library. However, ActionScript 3.0′s dictionary is… special.

Action script is, at heart, a dynamic language. Object methods can be (in principle) added, changed, and removed at runtime. As a consequence, every object contains a mapping from method names to method instances (a “method table”). When the AS3 Dictionary class was implemented, the implementor(s) used a “small trick”. They noticed that the method table implemented all of the functionality of a dictionary, and decided to shove each dictionary’s contents into its own method table. Cool, that’s probably more efficient and it works perfectly!…? Right? Wrong.

Dictionaries have methods. Methods that are stored in the method table. The same place the “small trick” is trying to read and write unstructured data. Clearly we’ll need an additional trick to ensure the dictionary’s keys don’t intersect with method na- NOPE. RUNTIME FAIL.

var d:Dictionary = new Dictionary();

//Error #1037: Cannot assign to a method hasOwnProperty on flash.utils.Dictionary.
d["hasOwnProperty"] = "oh";

//Error #1037: Cannot assign to a method isPrototypeOf on flash.utils.Dictionary.
d["isPrototypeOf"] = "god";

//Error #1037: Cannot assign to a method propertyIsEnumerable on flash.utils.Dictionary.
d["propertyIsEnumerable"] = "why";

The reason we had a bug in our hypothetical situation is that the user could name a profile “hasOwnProperty”, or some other method name, and cause an unexpected exception. If you’ve ever used user input as the key to a dictionary in action script, you probably have this bug.

Even worse than the existence of this bug is the fact that there’s a special exception for it, meaning it’s actually a design flaw. Clearly someone knew about it, but didn’t fix the real problem. It is a blatant violation of the principle that correctness is more important than simplicity or efficiency. As a result, AS3 has an almost-a-dictionary class instead of an actual dictionary class.

Discuss on Reddit


Twisted Oak Studios offers consulting and development on high-tech interactive projects. Check out our portfolio, or Give us a shout if you have anything you think some really rad engineers should help you with.

Archive

More interesting posts (12 of 33 articles)

Or check out our Portfolio.