#972 bug
Shwetank Dixit

Issue regarding Array.concat

Reported by Shwetank Dixit | December 30th, 2009 @ 07:13 AM

There is a bug in prototype.js. The code that currently looks like this:

 function concat() { 
    var array = slice.call(this, 0), item; 
    for (var i = 0, length = arguments.length; i < length; i++) { 
      item = arguments[i]; 
      if (Object.isArray(item) && !('callee' in item)) { 
        for (var j = 0, arrayLength = item.length; j < arrayLength; j++) 
          array.push(item[j]); 
      } else { 
        array.push(item); 
      } 
    } 
    return array; 
  }

Should change

array.push(item[j]);

to

if(j in item)array.push(item[j]);

to avoid creating indexes for array entries that have been removed with delete.

Test: if this runs when Prototype has overwritten Array concat:

var ar=['a', 'b']; 
delete ar[0]; // ar[0] now undefined, ar.length still 2 
ar.push('c'); 
var ar2=[].concat(ar); // what happens here when prototype.js has overwritten concat? 
console.log('ar2.length: '+ar2.length); 
for(var idx in ar2)console.log(' enumerated index: '+idx);

for..in will here see an extra array entry that should not be there.

Comments and changes to this ticket

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป

The Prototype JavaScript library.

Shared Ticket Bins

Pages