681491 - Attempting to concat a sparse array that is near max_length results in OOM.

Status: RESOLVED WONTFIX

(Tamarin Graveyard :: Virtual Machine, defect)

Description

[Chris Peyer]

var x = [1,2];
x[0xfffffffd] = "second to last array slot";
var otherArray = ['a','b','c'];
var newArray = x.concat(otherArray);

VM will OOM.

Comment 1

[Felix S. Klock II [:pnkfelix, :fklock]]

(i'm in the process of digesting what ecma-262 says about this.)

Firefox definitely takes a *long* time to run your code.  That's somewhat of a sign that our behavior may not be absurd.  ;)

Comment 2

[Felix S. Klock II [:pnkfelix, :fklock]]

Not injected by dense array changes; 

32-bit DebugDebugger on TR rev 5711 and
32-bit DebugDebugger on TR rev 5713 both say:

  Assertion failed: "((cap <= kListMaxLength))" ("core/avmplusList-inlines.h":573)

Comment 3

[Sylvestre Ledru [:Sylvestre]]

Tamarin is a dead project now. Mass WONTFIX.

Comment 4

[Sylvestre Ledru [:Sylvestre]]

Tamarin isn't maintained anymore. WONTFIX remaining bugs.