Foxhound contains a small number of regression tests for SpiderMonkey to make sure tainting is still working:

js/src/tests/jstests.py obj-spider-release/dist/bin/js taint/

While trying to debug these tests, I noticed something strange was going on while running the atom tests:

https://github.com/SAP/project-foxhound/blob/main/js/src/tests/taint/atoms.js

When splitting a string into an array of chars, there was some confusion between tainted and untainted strings, e.g.:

var untainted = "world";
var tainted = String.tainted("hello");

var untaintedStrings = untainted.split('');
var taintedStrings = tainted.split('');

taintedStrings[3].taint;  // Tainted, OK
untaintedStrings[3].taint;  // Tainted, what's going on?!??

So the char l is actually tainted in both arrays. Note that this only occurs after a number of iterations of the test function, not immediately.