308641 - Setting a property with tinyID on an array object sets the array length to the tinyID

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Steve Evans]

User-Agent:       Opera/8.02 (Windows NT 5.0; U; en)
Build Identifier: 

If I have an object created with JS_NewArrayObject(), and then call 
JS_DefinePropertyWithTinyId() on it, supplying a positive tinyID, then the array 
length gets set to the value of the tinyID. This also occurs if I use 
JS_DefineProperties() with a props structure that features tinyIDs.

Reproducible: Always

Steps to Reproduce:
1.See Details.
2.
3.

Actual Results:  
Array length of array object gets set to the value of the supplied tinyID/
shortID.

Expected Results:  
Set a property on the array object that could be accessed using the tinyID. My 
previous SpiderMonkey build (from way back in 2001) allowed this.

Brendan Eich tells me that I may be able to work around this by using negative 
tinyIDs, but I haven't tried this yet.

Comment 1

[Brendan Eich [:brendan]]

This is a fairly old API regression we should be able to fix easily.

/be

Comment 2

[Daniel Veditz [:dveditz]]

This does not appear to match the criteria for 1.8.0.1, and without a reviewed patch can't even hitch-hike as a "nice to have".

Comment 3

[Mike Schroepfer]

Igor any chance you can take a look?

Comment 4

[Mike Schroepfer]

Given this is an old regression I'm pulling off the 1.8.1 blocker list.  Please re-nom if you disagree.

Comment 5

[Brian Crowder]

Attachment: A testcase of this bug in C

If the array is larger than the tinyID, it doesn't appear to get truncated as a result of this bug.  It -does- grow from 0 to whatever tinyID is, as in this sample.

Comment 6

[Brian Crowder]

On further consideration and after debugging for just a bit, is this really erroneous behavior?  The tinyid is simply being used as the array index (growing the array, if necessary).  Is that bad?  What is the expected behavior?

Comment 7

[Igor Bukanov]

I am not working on the bug right now.

Comment 8

[André Bargull [:anba]]

tinyId was removed in http://hg.mozilla.org/mozilla-central/rev/4027d48cbc51 (bug 975069)