Closed
Bug 513016
Opened 15 years ago
Closed 6 years ago
"for...in" iterates too much with Object or Dictionary if its values are manipulated in a loop
Categories
(Tamarin Graveyard :: Virtual Machine, defect, P3)
Tamarin Graveyard
Virtual Machine
Tracking
(Not tracked)
RESOLVED
WONTFIX
Q2 12 - Cyril
People
(Reporter: brbaker, Assigned: nobody)
References
Details
(Whiteboard: must-fix-candidate)
Steps to Reproduce:
1. Create an Object instance.
2. Make a property for the instance and assign a value.
3. Iterate the instance and manipulate the value side-effectively in "for...in" statement.
4. Delete the property of the instance.
5. Repeat from step 2, and it constantly iterates too much in step 3.
Here is the code.
var m:* = new Object();
for(var i:int = 0; i < 20; i++) {
m["a"] = 0;
var count:int = 0;
for(var k:* in m) {
m[k]++;
count++;
}
delete m["a"];
trace(count);
}
Actual Results:
The code traces:
1
1
1
1
1
2
1
1
1
1
2
1
1
1
1
2
1
1
1
1
The code "for...in" iterates twice (and traces "2") with Object at the first sixth result and after that it occurs once per five times.
Expected Results:
trace output like:
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
Workaround:
Making object with "new Object()" or "new Dictionary()" causes the issue.
But with "{}" doesn't.
A side-effective operation like increasing is also the conspiracy.
Don't manipulate but just refer values in a loop.
Flags: flashplayer-triage+
Flags: flashplayer-qrb?
Reporter | ||
Comment 1•15 years ago
|
||
Transferred from JIRA ASC-3820 http://bugs.adobe.com/jira/browse/ASC-3820
Transferred comments:
Brent Baker - [07/31/09 07:43 AM ]
var m:* = new Object();
m["a"] = 0;
for(var k:* in m) {
m[k]++; // comment out this line and it will only loop once
trace(k + "" + m[k])
}
So this is what I have found:
1) this does NOT affect Release builds ONLY ReleaseDebugger builds
2) this only happens if you modify the values of the object while looping
Brent Baker - [07/31/09 07:43 AM ]
var m:* = new Object(); m["a"] = 0; for(var k:* in m) { m[k]++; // comment out this line and it will only loop once trace(k + "" + m[k]) } So this is what I have found: 1) this does NOT affect Release builds ONLY ReleaseDebugger builds 2) this only happens if you modify the values of the object while looping
Brent Baker - [08/27/09 08:54 AM ]
This appears to be an injection, testing using the release_debugger shell from astro does not have this problem
Reporter | ||
Comment 2•15 years ago
|
||
Release builds will output:
a1
Release_Debugger builds will output:
a1
a2
Assignee: nobody → rreitmai
Flags: flashplayer-qrb? → flashplayer-qrb+
Priority: -- → P2
Target Milestone: --- → flash10.1
Comment 3•15 years ago
|
||
Any fix for this bug will likely need version-checking for backwards compatibility.
Reporter | ||
Updated•15 years ago
|
Flags: in-testsuite?
Updated•15 years ago
|
Flags: flashplayer-needsversioning+
Updated•15 years ago
|
Target Milestone: flash10.1 → Future
Updated•15 years ago
|
Priority: P2 → --
Updated•14 years ago
|
Priority: -- → P3
Target Milestone: Future → flash10.2
Updated•14 years ago
|
Flags: flashplayer-bug+
Updated•14 years ago
|
Whiteboard: must–fix-candidate
Updated•14 years ago
|
Whiteboard: must–fix-candidate → must-fix-candidate
Flags: flashplayer-injection-
Target Milestone: Q3 11 - Serrano → Q1 12 - Brannan
Updated•13 years ago
|
Assignee: rreitmai → administration
Target Milestone: Q1 12 - Brannan → Q2 12 - Cyril
Updated•12 years ago
|
Assignee: administration → nobody
Comment 4•6 years ago
|
||
Tamarin is a dead project now. Mass WONTFIX.
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX
Comment 5•6 years ago
|
||
Tamarin isn't maintained anymore. WONTFIX remaining bugs.
You need to log in
before you can comment on or make changes to this bug.
Description
•