267574 - An enumerated property was disavowed by dom causing bug 233483

Status: RESOLVED WORKSFORME

(Core :: DOM: Core & HTML, defect)

Description

[timeless]

Follow up to Bug 233483 crash when i'm trying to get specific Array asString [@
MarkSharpObjects]

per bug 233483 comment 11:
+	*(JSString*)((long)((JSAtom*)(ida->vector[i]))->entry.key-4) 
{length=0x00000001 chars=0x01a93860 "0" }	JSString
+	*(JSClass*)(obj->slots[2]-1)	{name=0x027604e8 "HTMLFormElement"
flags=0x0000000d addProperty=0x00ab5af7 XPC_WN_Helper_AddProperty(JSContext *,
JSObject *, long, long *) ...}	JSClass

Comment 1

[timeless]

jst wrote in bug 233483 comment 16:
Brendan and I (jst) sat down and tracked down where this missing prop comes
from. We end up in the prop == null case when enumerating the properties of an
HTMLFormElement object whose enumerate hook tells the JS engine that there's a
property named "0" (it uses the form controls index if the form control doesn't
have a name, as is the case here), but then the form element's resolve hook
doesn't return anything when "0" (or the integer 0, really) is resolved. Yet
form[0] does return the input. Fun.

Comment 2

[Anne (:annevk)]

Going out on a limb here and assuming this has long been rewritten/addressed.