1435922 - Discrepancy in behavior between Array.from and array spread

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[Chuck]

Attachment: safe.js

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0
Build ID: 20180131005501

Steps to reproduce:

This may not actually be a security bug but it's inexplicable (to me) and only seems to occur when working with a somewhat large number of objects so I'm reporting it as such to be on the safe side.

0. I traverse the properties under `window` and index property names and property values in a Map (attached source is all that is necessary to recreate issue)
1. The indexer returns a map with ~6000 entries. I convert the iterator over entries into an array in two ways:
  a. `Array.from(map.entries())`
  b. `[...map.entries()]`
2. On many sites, these are the same. On some sites (the one brought to my attention and on which I can recreate is 511tactical.com), 1a and 1b yield arrays of different length.


Actual results:

let map = index()
map.size === 6165
Array.from(map.entries()).length === 0
[...map.entries()].length === 6165


Expected results:

let map = index()
map.size === 6165
Array.from(map.entries()).length === 6165
[...map.entries()].length === 6165

Comment 1

[Chuck]

Attachment: JS that recreates issue

Comment 2

[Chuck]

Investigated this further, it seems like the site in question is using a polyfill that unconditionally replaces the built-in implementation. Closing.