Closed
Bug 685323
Opened 14 years ago
Closed 7 years ago
Array unshift property modification loop wraps around
Categories
(Tamarin Graveyard :: Library, defect, P4)
Tamarin Graveyard
Library
Tracking
(Not tracked)
RESOLVED
WONTFIX
Future
People
(Reporter: pnkfelix, Assigned: phohense)
References
Details
Bug 681511, comment 2 noted that there remained work to be done to investigate unshift.
I finally got around to doing that investigation today.
Here is some code:
var azero;
var afive;
var amax0;
var amax5;
var all_arrays;
function reset() {
azero = new Array(0);
afive = new Array(5);
amax0 = new Array(uint.MAX_VALUE);
amax2 = new Array(uint.MAX_VALUE - 2);
amax5 = new Array(uint.MAX_VALUE - 5);
all_arrays = [azero, afive, amax0, amax2, amax5];
}
function applyall(f) { all_arrays.map(f); }
function lengths() {
return all_arrays.map(function (a) { return a.length; }).toString();;
}
reset();
applyall(function(a) { a.unshift(1,2,3,4,5); });
I would expect an appropriate test case entry at this point to look like this:
AddTestCase("unshift", "5,10,4294967295,4294967295,4294967295", lengths());
But at the moment, the actual result is:
"5,10,4,2,4294967295"
Notably, the amax0 and amax2 are both wrapping around due to modular arithmetic. This appears to be the case on both AS3 and non-AS3 code.
(Admittedly, anyone who is actually doing this with unshift is seriously asking for big trouble; I doubt the language has a mandate to use (or even a definition for) asymptotically-efficient sparse arrays as the backing store for the Array class. For some reason I find push in this context (see Bug 681803) to be more digestable than unshift.)
| Reporter | ||
Updated•14 years ago
|
Assignee: nobody → fklockii
Flags: flashplayer-qrb+
Flags: flashplayer-injection-
Flags: flashplayer-bug-
Priority: -- → P4
Target Milestone: --- → Future
| Reporter | ||
Updated•14 years ago
|
Blocks: ecma-incompatibility
| Reporter | ||
Updated•14 years ago
|
Summary: Array.prototype.unshift property modification loop wraps around → Array unshift property modification loop wraps around
Comment 1•14 years ago
|
||
changeset: 6709:ac91969bcc46
user: Felix S Klock II <fklockii@adobe.com>
summary: Bug 661330: acceptance tests for modifying Array .length property (r=dschaffe).
http://hg.mozilla.org/tamarin-redux/rev/ac91969bcc46
| Reporter | ||
Updated•14 years ago
|
Blocks: array-correctness
| Reporter | ||
Comment 2•13 years ago
|
||
Note that this was not fixed. (The tests that were added in comment 1 have the case of interest for this bug if(false)'d out, with comments saying that one should enable those tests once this bug is fixed.
Perhaps it should never be fixed, given plans for AS4.
So I'm reassigning to Paul, who can make the call as to whether to close as wontfix.
Assignee: fklockii → phohense
Comment 3•7 years ago
|
||
Tamarin is a dead project now. Mass WONTFIX.
Status: NEW → RESOLVED
Closed: 7 years ago
Resolution: --- → WONTFIX
Comment 4•7 years ago
|
||
Tamarin isn't maintained anymore. WONTFIX remaining bugs.
You need to log in
before you can comment on or make changes to this bug.
Description
•