Improve the v8::Object uniqueness check in V8ValueConverterImpl

Improve the v8::Object uniqueness check in V8ValueConverterImpl

Previously it used a set with identity hashes of the objects.
Those are not necessarily unique, so now it also stores the handle (with the id hashes as keys), and checks the handle equality for objects with identical hashes.


BUG=177662
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=189284

[vabr (Chromium), 2013-03-14 14:24:19]

Hi eaugusti,

This is an implementation of
https://code.google.com/p/chromium/issues/detail?id=177662#c13. Could you please
review, or suggest a reviewer?

(Beside that I'll ask jamesr@ for an OWNERS review, but let's check whether this
CL makes sense first.)

Thanks,
Vaclav

[eaugusti, 2013-03-14 17:21:09]

Looking pretty good, just a few small comments.

I would add someone from the v8 team, since the handle comparison is
non-intuitive.

If you want someone besides that, I believe aa@, asargent@, and kalman@ have
some experience with the value converter.

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
File content/renderer/v8_value_converter_impl.cc (right):

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
content/renderer/v8_value_converter_impl.cc:223: if
(!UpdateAndCheckUniqueness(unique_map, v8::Handle<v8::Array>::Cast(val)))
Why the cast? Is it necessary?

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
content/renderer/v8_value_converter_impl.cc:361: bool
V8ValueConverterImpl::UpdateAndCheckUniqueness(
Maybe add a comment about how uniqueness is defined and how the handle
comparison is actually a deep comparison.

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
content/renderer/v8_value_converter_impl.cc:369: for (Iterator it = range.first;
!false && it != range.second; ++it) {
Why the "!false"?

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
content/renderer/v8_value_converter_impl.cc:371: }
nit: drop the braces on the for.

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
File content/renderer/v8_value_converter_impl.h (right):

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
content/renderer/v8_value_converter_impl.h:61: // If |handle| is not in |map|,
then adds it to |map| and returns true.
nit: "add" and "return" (singular).

[vabr (Chromium), 2013-03-14 17:59:37]

Sven,
Since I already talked to you about this problem with identity hashes, could you
please view this CL as a V8 expert?

Anthony,
If you find time, could you please take a look as well? eaugusti@ mentioned you
as a good person to ask about value converter. (If you don't, don't worry, two
other people + OWNER will be reviewing this. I just would value your opinion.)

eaugusti@ -- thanks a lot for your quick help! Please take a look at my
responses to your comments.

Thanks all,
Vaclav

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
File content/renderer/v8_value_converter_impl.cc (right):

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
content/renderer/v8_value_converter_impl.cc:223: if
(!UpdateAndCheckUniqueness(unique_map, v8::Handle<v8::Array>::Cast(val)))
On 2013/03/14 17:21:09, eaugusti wrote:
> Why the cast? Is it necessary?

It was not! Thanks. :)

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
content/renderer/v8_value_converter_impl.cc:361: bool
V8ValueConverterImpl::UpdateAndCheckUniqueness(
On 2013/03/14 17:21:09, eaugusti wrote:
> Maybe add a comment about how uniqueness is defined and how the handle
> comparison is actually a deep comparison.

Done.
I added a comment about the uniqueness to the declaration in the header file,
and the comment about deep comparison at the line where == is called.

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
content/renderer/v8_value_converter_impl.cc:369: for (Iterator it = range.first;
!false && it != range.second; ++it) {
On 2013/03/14 17:21:09, eaugusti wrote:
> Why the "!false"?

Thanks for catching that, was meant to be !found. :)

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
content/renderer/v8_value_converter_impl.cc:371: }
On 2013/03/14 17:21:09, eaugusti wrote:
> nit: drop the braces on the for.

No longer can due to the added comment.

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
File content/renderer/v8_value_converter_impl.h (right):

https://codereview.chromium.org/12633013/diff/2001/content/renderer/v8_value_...
content/renderer/v8_value_converter_impl.h:61: // If |handle| is not in |map|,
then adds it to |map| and returns true.
On 2013/03/14 17:21:09, eaugusti wrote:
> nit: "add" and "return" (singular).

Done.

[eaugusti, 2013-03-14 18:19:35]

Could you add some tests for this?

I remember that you said that you could get 100% reproducibility when 100,000
rules.
Could you either do something like that, or (if it takes too long) maybe hack
together some v8::Objects that produce the same hash.

[vabr (Chromium), 2013-03-14 18:29:21]

On 2013/03/14 18:19:35, eaugusti wrote:
> Could you add some tests for this?
> 
> I remember that you said that you could get 100% reproducibility when 100,000
> rules.
> Could you either do something like that, or (if it takes too long) maybe hack
> together some v8::Objects that produce the same hash.

Right, that's a very good idea! Sorry I forgot to add tests in the first place.

I will write a unit-test with objects faking their identity hashes to be a
constant.
It's late here, and I need to go home, but tomorrow I'll add them.

Thanks,
Vaclav

[Sven Panne, 2013-03-15 08:58:16]

I don't know the details of V8ValueConverterImpl, but from the v8 side, the CL
looks OK: GetIdentityHash() doesn't guarantee uniqueness and operator== on
Handles is defined as object identity.

Regarding tests: You won't be able to write one, the identity hashes are random
numbers, guaranteed to be stable during the lifetime of an object.

Just out of curiosity: How are lifetime issues handled, e.g. are things ever
removed from the map? And how long does the map live? But these are all binding
issues which I don't fully understand.

https://codereview.chromium.org/12633013/diff/13001/content/renderer/v8_value...
File content/renderer/v8_value_converter_impl.cc (right):

https://codereview.chromium.org/12633013/diff/13001/content/renderer/v8_value...
content/renderer/v8_value_converter_impl.cc:374: found |= it->second == handle;
Nit: Just kill 'found' and use

    if (it->second == handle) return false;

We return early anyway below, and this boolean flag is so 1970ish... ;-)

[vabr (Chromium), 2013-03-15 14:37:45]

Thanks, eaugusti and Sven, for your helpful comments.

I addressed all of them, please take another look.

On 2013/03/15 08:58:16, Sven Panne wrote:
> I don't know the details of V8ValueConverterImpl, but from the v8 side, the CL
> looks OK: GetIdentityHash() doesn't guarantee uniqueness and operator== on
> Handles is defined as object identity.
> 
> Regarding tests: You won't be able to write one, the identity hashes are
random
> numbers, guaranteed to be stable during the lifetime of an object.

You are right that it is not possible to replace the GetIdentityHash for the
objects, in particular deriving a sub-class does not work, because
GetIdentityHash is not virtual.
I opted for a "tests-only" flag in the converter to ignore the hashes instead.
Does that look bearable?

To eaugusti's first suggestion for test -- while I was able to reproduce the
hash clash with 100'000 rules fairly reliably, it will never be 100%, thus
introducing flakiness. Also to get a reasonable reproduction rate, at least
20'000 rules are needed, and that would make the unit test already slow.

> 
> Just out of curiosity: How are lifetime issues handled, e.g. are things ever
> removed from the map? And how long does the map live? But these are all
binding
> issues which I don't fully understand.
The map (and handles in it) get destroyed once V8ValueConverterImpl::FromV8Value
finishes. I don't think they can be erased sooner. Does that look like a good
idea?


Looking forward for any additional comments you might have! :)

Thanks,
Vaclav

https://codereview.chromium.org/12633013/diff/13001/content/renderer/v8_value...
File content/renderer/v8_value_converter_impl.cc (right):

https://codereview.chromium.org/12633013/diff/13001/content/renderer/v8_value...
content/renderer/v8_value_converter_impl.cc:374: found |= it->second == handle;
On 2013/03/15 08:58:16, Sven Panne wrote:
> Nit: Just kill 'found' and use
> 
>     if (it->second == handle) return false;
> 
> We return early anyway below, and this boolean flag is so 1970ish... ;-)

Sure, thanks for pointing that out! :)

https://codereview.chromium.org/12633013/diff/19001/content/renderer/v8_value...
File content/renderer/v8_value_converter_impl_unittest.cc (right):

https://codereview.chromium.org/12633013/diff/19001/content/renderer/v8_value...
content/renderer/v8_value_converter_impl_unittest.cc:22: class
ScopedAvoidIdentityHashForTesting {
This class cannot be in the anonymous namespace, because it needs to be declared
as a friend in the header file.

https://codereview.chromium.org/12633013/diff/19001/content/renderer/v8_value...
content/renderer/v8_value_converter_impl_unittest.cc:610:
TEST_F(V8ValueConverterImplTest, DetectCycles) {
If this test does not succeed, it will most likely time out.

[eaugusti, 2013-03-15 16:55:55]

lgtm

[vabr (Chromium), 2013-03-15 17:00:08]

Hi James,

Could I get your OWNERS approval? eaugusti@ reviewed the patch.

Cheers,
Vaclav

[jamesr, 2013-03-18 01:23:55]

lgtm

[commit-bot: I haz the power, 2013-03-18 08:34:50]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/[email protected]/12633013/19001

[commit-bot: I haz the power, 2013-03-20 14:00:39]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/[email protected]/12633013/19001

[commit-bot: I haz the power, 2013-03-20 15:35:22]

Change committed as 189284