See attached file for test code. When splice is used near the end of a max length array, values at the beginning of the array get deleted, and the value to be spliced in does not get inserted. Here is the output for the testcase: Before splice - length: 4294967295 [1,2,3,4...,3rd to last value,2nd to last value,last value,] After splice - length: 0 [,,,...,,,,last value] Note that the length has gone to 0 after splicing, but still has a value at a[uint.MAX_VALUE]. The two values at the beginning of the array have also been converted to undefined.

oh man, just when you think you can put a bug to bed. yeah, i guess for consistency it would be good to address these cases as well.

(should check how unshift behaves too. at first glance it seems like it will fall victim to similar problem as push and splice.)

(In reply to Felix S Klock II from comment #2) > (should check how unshift behaves too. at first glance it seems like it > will fall victim to similar problem as push and splice.) Investigation started and posted on Bug 685323.

Tamarin is a dead project now. Mass WONTFIX.

Tamarin isn't maintained anymore. WONTFIX remaining bugs.