While writing a set of test cases for Bug 661330, I encountered this fun bit of behavior: var a = new Array(); a[1] = 1; a.length = 3; a.push(3,4,5,6); var aunshift = a.unshift(-2,-1); print("unshift contents "+a); When compiled with -AS3, this produces the output: unshift contents ,-2,-1,,1,,3,4,5 Compare that to the expected behavior that one gets without -AS3 (and also in Firefox): unshift contents -2,-1,,1,,3,4,5,6 We should check if this is an injection (e.g. from the dense-array work). ---- I'll post the AS3 code I used to explore the cases here, along with the output when compiled with/without -AS3.

(for comparison with web browser behaviors)

(compare with T.)

(compare with T and U; it matches U exactly.)

Added an extra test at the end that exposes another case where -AS3 and default differ. The new case is a slight variation on the previous final case where the array was undefined at indices 0,1,2; in the variation, the array is initially defined at 1 but then we delete a[1]. So in principle the two cases should behave the same (assuming I understand delete), and they do behave the same without -AS3; but they do not when you include -AS3: Case: undefined at 0, 1, 2 (v1) original contents ,,,3,4,5,6 original length 7 unshift value 9 unshift contents -2,-1,,,,3,4,5,6 unshift length 9 Case: undefined at 0, 1, 2 (v2) original contents ,,,3,4,5,6 original length 7 unshift value 9 unshift contents ,-2,-1,,,,3,4,5 unshift length 9

(updated analogously to test case A v2 as described in comment 6)

(In reply to Felix S Klock II from comment #0) > We should check if this is an injection (e.g. from the dense-array work). Its not an injection. I did a run of attachment 558868 [details] with avm from rev 5711, and another from rev 5713 (on both 32-bit and 64-bit DebugDebugger shells). The output from pre- and post- revisions in both cases matched; so not an injection.

(In reply to Felix S Klock II from comment #8) > (In reply to Felix S Klock II from comment #0) > > We should check if this is an injection (e.g. from the dense-array work). > > Its not an injection. I did a run of attachment 558868 [details] with avm > from rev 5711, and another from rev 5713 (on both 32-bit and 64-bit > DebugDebugger shells). The output from pre- and post- revisions in both > cases matched; so not an injection. This may have been incorrect. I am trying to replicate the above claim now, and am seeing differences between the pre- and post- revisions. (It also appears like this bug might be fixed by the patch applied to Bug 694884; i.e. the two may be duplicates of each other.)

Tamarin is a dead project now. Mass WONTFIX.

Tamarin isn't maintained anymore. WONTFIX remaining bugs.