504525 - Vector.concat processes arguments in reverse order

Status: RESOLVED FIXED

(Tamarin Graveyard :: Virtual Machine, defect, P2)

Description

[Lars T Hansen]

Attachment: Test case

See test case.  The two lines printed should be the same; the vector case prints 1,4,3,2 rather than 1,2,3,4.

Comment 1

[Chris Peyer]

Added testcase to as3/Vector/concat.as as well as expectedfail to testconfig.txt.

Comment 2

[Brent Baker]

Chris do you have a patch for this? (comment #1)

Comment 3

[Chris Peyer]

Media added: http://hg.mozilla.org/tamarin-redux/rev/2705

Comment 4

[Tom Harwood]

Attachment: Patch, splices into result vector using result's updated length

Args were processed in correct order, but were spliced into the result vector using the length of the original vector as an insert point, thus apparently backwards.

Comment 5

[Erik Tierney]

Comment on attachment 405340 [details] [diff] [review]
Patch, splices into result vector using result's updated length

Fix looks ok, but do we need to version check this fix?  Code that's depending on this behavior or working around it might not work if it suddenly changes.

There is a bugFlags member in avmplus::PoolObject to allow hosts to turn on/off certain bug fixes.  I think it's only used for one bug so far.  

Come to think of it, does the other recent Vector fix also need version checking?

Comment 6

[Steven Johnson]

If this changes existing behavior of Vector (as shipping in Flash/AIR) then it absolutely *MUST* be version checked.

Comment 7

[Steven Johnson]

To(In reply to comment #6)
> If this changes existing behavior of Vector (as shipping in Flash/AIR) then it
> absolutely *MUST* be version checked.

To expand upon this comment: clearly, the existing behavior of Vector.concat is "wrong" according to the spec. Nevertheless, any existing Flash/AIR content that calls Vector.concat is potentially relying on the existing (wrong) behavior, so said existing behavior needs to be preserved in order to prevent breakage of existing content.

Comment 8

[Steven Johnson]

This was fixed (in a versioned way) in http://hg.mozilla.org/tamarin-redux/rev/3ad427924afe as part of bug 535770