Unfathomable Bugs #4: Keys that aren’t

Today’s bug design flaw comes courtesy of Adobe. Thank you, Adobe, this series wouldn’t exist without the generous support of entities like you.

I mentioned this bug design flaw in passing in a previous post, but it’s so good it deserves one of its own.

—

Here’s the hypothetical situation: you’re making a flash game. In that game users can create named profiles. You store the profiles, keyed by their name, so that you ca- OOPS, you just introduced a bug. What’s the problem? The dictionary.

Dictionaries (a.k.a. maps or hash tables or associative arrays) are a very useful construct. Most languages, including ActionScript 3.0, have one built in to their standard library. However, ActionScript 3.0′s dictionary is… special.

Action script is, at heart, a dynamic language. Object methods can be (in principle) added, changed, and removed at runtime. As a consequence, every object contains a mapping from method names to method instances (a “method table”). When the AS3 Dictionary class was implemented, the implementor(s) used a “small trick”. They noticed that the method table implemented all of the functionality of a dictionary, and decided to shove each dictionary’s contents into its own method table. Cool, that’s probably more efficient and it works perfectly!…? Right? Wrong.

Dictionaries have methods. Methods that are stored in the method table. The same place the “small trick” is trying to read and write unstructured data. Clearly we’ll need an additional trick to ensure the dictionary’s keys don’t intersect with method na- NOPE. RUNTIME FAIL.

var d:Dictionary = new Dictionary();

//Error #1037: Cannot assign to a method hasOwnProperty on flash.utils.Dictionary.
d["hasOwnProperty"] = "oh";

//Error #1037: Cannot assign to a method isPrototypeOf on flash.utils.Dictionary.
d["isPrototypeOf"] = "god";

//Error #1037: Cannot assign to a method propertyIsEnumerable on flash.utils.Dictionary.
d["propertyIsEnumerable"] = "why";

The reason we had a bug in our hypothetical situation is that the user could name a profile “hasOwnProperty”, or some other method name, and cause an unexpected exception. If you’ve ever used user input as the key to a dictionary in action script, you probably have this bug.