685204 - AS3 Array unshift misbehavior when 0 undefined _and_ 1 defined

Status: RESOLVED WONTFIX

(Tamarin Graveyard :: Library, defect)

Description

[Felix S. Klock II [:pnkfelix, :fklock]]

While writing a set of test cases for Bug 661330, I encountered this fun bit of behavior:

  var a = new Array();
  a[1] = 1;
  a.length = 3;
  a.push(3,4,5,6);
  var aunshift = a.unshift(-2,-1);
  print("unshift contents "+a);

When compiled with -AS3, this produces the output:

  unshift contents ,-2,-1,,1,,3,4,5

Compare that to the expected behavior that one gets without -AS3 (and also in Firefox):

  unshift contents -2,-1,,1,,3,4,5,6

We should check if this is an injection (e.g. from the dense-array work).

----

I'll post the AS3 code I used to explore the cases here, along with the output when compiled with/without -AS3.

Comment 1

[Felix S. Klock II [:pnkfelix, :fklock]]

Attachment: AS test case A v1: unshift test case

Comment 2

[Felix S. Klock II [:pnkfelix, :fklock]]

Attachment: HTML test case B v1: unshift test case (javascript)

(for comparison with web browser behaviors)

Comment 3

[Felix S. Klock II [:pnkfelix, :fklock]]

Attachment: transcript T v1: transcript of test A (v1) with -AS3

Comment 4

[Felix S. Klock II [:pnkfelix, :fklock]]

Attachment: transcript U v1: transcript of test A (v1) without -AS3

(compare with T.)

Comment 5

[Felix S. Klock II [:pnkfelix, :fklock]]

Attachment: transcript V v1: "transcript" of Firefox on test B (v1)

(compare with T and U; it matches U exactly.)

Comment 6

[Felix S. Klock II [:pnkfelix, :fklock]]

Attachment: AS test case A v2: unshift test case

Added an extra test at the end that exposes another case where -AS3 and default differ.

The new case is a slight variation on the previous final case where the array was undefined at indices 0,1,2; in the variation, the array is initially defined at 1 but then we delete a[1].  So in principle the two cases should behave the same (assuming I understand delete), and they do behave the same without -AS3; but they do not when you include -AS3:

Case: undefined at 0, 1, 2 (v1)
original contents ,,,3,4,5,6
original length 7
unshift value 9
unshift contents -2,-1,,,,3,4,5,6
unshift length 9

Case: undefined at 0, 1, 2 (v2)
original contents ,,,3,4,5,6
original length 7
unshift value 9
unshift contents ,-2,-1,,,,3,4,5
unshift length 9

Comment 7

[Felix S. Klock II [:pnkfelix, :fklock]]

Attachment: HTML test case B v2: unshift test case (javascript)

(updated analogously to test case A v2 as described in comment 6)

Comment 8

[Felix S. Klock II [:pnkfelix, :fklock]]

(In reply to Felix S Klock II from comment #0)
> We should check if this is an injection (e.g. from the dense-array work).

Its not an injection.  I did a run of attachment 558868 [details] with avm from rev 5711, and another from rev 5713 (on both 32-bit and 64-bit DebugDebugger shells).  The output from pre- and post- revisions in both cases matched; so not an injection.

Comment 9

[Felix S. Klock II [:pnkfelix, :fklock]]

(In reply to Felix S Klock II from comment #8)
> (In reply to Felix S Klock II from comment #0)
> > We should check if this is an injection (e.g. from the dense-array work).
> 
> Its not an injection.  I did a run of attachment 558868 [details] with avm
> from rev 5711, and another from rev 5713 (on both 32-bit and 64-bit
> DebugDebugger shells).  The output from pre- and post- revisions in both
> cases matched; so not an injection.

This may have been incorrect.  I am trying to replicate the above claim now, and am seeing differences between the pre- and post- revisions.

(It also appears like this bug might be fixed by the patch applied to Bug 694884; i.e. the two may be duplicates of each other.)

Comment 10

[Sylvestre Ledru [:Sylvestre]]

Tamarin is a dead project now. Mass WONTFIX.

Comment 11

[Sylvestre Ledru [:Sylvestre]]

Tamarin isn't maintained anymore. WONTFIX remaining bugs.