553088 - Array iteration methods visit elements that have been deleted during the iteration

Status: RESOLVED WONTFIX

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Chris Peyer]

as:
function deleteLaterElement(v, index, array)
{
  print(v, index, array);
  if (index == 0)
  {
    delete array[2];
  }
}

var myArr = ['zero', 'one', 2, 'three'];
myArr.forEach(deleteLaterElement);

actual:
zero 0 zero,one,2,three
one 1 zero,one,,three
undefined 2 zero,one,,three
three 3 zero,one,,three

expected:
zero 0 zero,one,2,three
one 1 zero,one,,three
three 3 zero,one,,three

This behavior happens with all of the array iteration methods: every, filter, forEach, map, some.

See https://developer.mozilla.org/en/Core_JavaScript_1.5_Reference/Global_Objects/Array/forEach#Compatibility for the mozilla implementation.

(or ecma 262 edition 5 section 15.4.4.18)

Tamarin-Redux does not do a check for the presence of the array element before invoking the iteration method.

This is not an injection in TR.

Comment 1

[Chris Peyer]

Another manifestation of this is the iteration methods visiting missing elements of the array:

(From 15.4.4.18)
callbackfn is called only for elements of the array which actually exist; 
it is not called for missing elements of the array.

We currently iterate through empty array slots.