Add a patch that prevents #548

Author: cowtowncoder

src/main/java/com/fasterxml/jackson/core/sym/ByteQuadsCanonicalizer.java

@@ -18,7 +18,7 @@ public final class ByteQuadsCanonicalizer
 {
     /**
      * Initial size of the primary hash area. Each entry consumes 4 ints (16 bytes),
-     * and secondary area is same as primary; so default size will use 2kB of memory_tertiaryStart
+     * and secondary area is same as primary; so default size will use 2kB of memory
      * (plus 64x4 or 64x8 (256/512 bytes) for references to Strings, and Strings
      * themselves).
      */
@@ -27,7 +27,6 @@ public final class ByteQuadsCanonicalizer
 
     /**
      * Let's not expand symbol tables past some maximum size;
-     * this should protected against OOMEs caused by large documents
      * with unique (~= random) names.
      * Size is in 
      */
@@ -169,7 +168,7 @@ public final class ByteQuadsCanonicalizer
 
     /**
      * Offset within {@link #_hashArea} that follows main slots and contains
-     * quads for longer names (13 bytes or longers), and points to the
+     * quads for longer names (13 bytes or longer), and points to the
      * first available int that may be used for appending quads of the next
      * long name.
      * Note that long name area follows immediately after the fixed-size
@@ -317,7 +316,8 @@ public ByteQuadsCanonicalizer makeChild(int flags) {
     public void release()
     {
         // we will try to merge if child table has new entries
-        if (_parent != null && maybeDirty()) {
+        // 28-Jul-2019, tatu: From [core#548]: do not share if immediate rehash needed
+        if ((_parent != null) && maybeDirty() && !_needRehash) {
             _parent.mergeChild(new TableInfo(this));
             // Let's also mark this instance as dirty, so that just in
             // case release was too early, there's no corruption of possibly shared data.

src/test/java/com/fasterxml/jackson/core/sym/TestByteBasedSymbols.java

@@ -2,6 +2,7 @@
 
 import java.io.*;
 import java.lang.reflect.Field;
+import java.util.Random;
 
 import com.fasterxml.jackson.core.*;
 
@@ -120,6 +121,49 @@ public void testIssue207() throws Exception
         p.close();
     }
 
+    // [core#548]
+    public void testQuadsIssue548()
+    {
+        Random r = new Random(42);
+        ByteQuadsCanonicalizer root = ByteQuadsCanonicalizer.createRoot();
+        ByteQuadsCanonicalizer canon = root.makeChild(JsonFactory.Feature.collectDefaults());
+
+        int n_collisions = 25;
+        int[] collisions = new int[n_collisions];
+
+        // generate collisions
+        {
+            int maybe = r.nextInt();
+            int hash = canon.calcHash(maybe);
+            int target = ((hash & (2048-1)) << 2);
+
+            for (int i = 0; i < collisions.length; ) {
+                maybe = r.nextInt();
+                hash = canon.calcHash(maybe);
+                int offset = ((hash & (2048-1)) << 2);
+
+                if (offset == target) {
+                    collisions[i++] = maybe;
+                }
+            }
+        }
+
+        // fill spillover area until _needRehash is true.
+        for(int i = 0; i < 22 ; i++) {
+            canon.addName(Integer.toString(i), collisions[i]);
+        }
+        // canon._needRehash is now true, since the spillover is full
+
+        // release table to update tableinfo with canon's data
+        canon.release();
+
+        // new table pulls data from new tableinfo, that has a full spillover, but set _needRehash to false
+        canon = root.makeChild(JsonFactory.Feature.collectDefaults());
+
+        // canon._needRehash == false, so this will try to add another item to the spillover area, even though it is full
+        canon.addName(Integer.toString(22), collisions[22]);
+    }
+
     /*
     /**********************************************************
     /* Helper methods