361452 - Javascript: for each...in statement overlooped

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[David]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0

I spotted some strange error in javascript code:

fragment of code:

		var values={};
		for each (var v in this.CB.buttonParameters){
	
			values[v]=document.getElementById(v).value;
		}

where length of array this.CB.buttonParameters.length was 4 elements
but loop was executed 5 times and caused exception at 5th pass
value of non existing item assigned to variable "v" was {script}

after backup and restoration of profile in new place it seems that problem disappeared,
but I think that this error was caused by some bug in javascript engine



 


Reproducible: Sometimes

Comment 1

[David]

To reproduce bug:

0. download my firefox 2 test profile from
   http://www.sharebigfile.com/file/23665/profile-01-.fbu.html
1. run firefox and install extensions: FEBE and CLEO 
2. create new profile
3. restore downloaded profile file into created profile
4. run firefox with created profile
5. right click on button "FireFTP as dialog" placed right next search bar
   and from popup menu choose "Edit button..."
6. run debugger (button is on first toolbar)
7. in debugger find script "editor.js"
8. in "editor.js" find method "setButtonParameters:function()" 
   in this function there is loop "for each (var v in this.CB.buttonParameters)"
   on line 40, set break point at this loop
9. back in edit button dialog choose OK button  (debugger stops after this)
10. in debugger you see that 
   "this.CB.buttonParameters" has 4 elements but "for each" does one more step


there is some corruption in data of javascript engine ???

Comment 2

[Bob Clary [:bc] (inactive)]

Compact Library Extension Organizer (CLEO)
https://addons.mozilla.org/firefox/2942/

Firefox Extension Backup Extension (FEBE)
https://addons.mozilla.org/firefox/2109/

If this is dependent on your profile, it isn't the JavaScript Engine.

Comment 3

[David]

I agree that there is some bug somewhere in extensions 
but this bug leads to some corruption in javascript engine (data overflow?).

Then "for each" thinks that array contains more elements than it actually have

I send my profile (where this bug can be found) because I think that it is hard to find another way to simulate this bug

Profile contains 7 extensions, only 2 of them are needed to simulate bug
"TestGen4Web" and "Custom Buttons" (others can be uninstalled)
But when these extensions are installed in new profile from web (same versions), all is working well (strange)

Is it possible make corruption in firefox memory only with javascript (without using ole or accessing dll) ?

Comment 4

[David]

Attachment: Screenshot of error

Stopped right before exception, look at array, itemsCount and loopCount

itemsCount should be equal to loopCount but it is not

Comment 5

[David]

Attachment: One Another screenshot (maybe will explain averything)

I added "For...In" block to get all elements...

and 

"For...In" and "For Each...In" statements also enumerate custom methods of array object

If it is correct behaviour of enumerating arrays then please close this bug.

Comment 6

[Bob Clary [:bc] (inactive)]

Yes, enumeration will get any user added properties or functions. The problem you were seeing seems to be that you were expecting the array to only contain id values that could be looked up. You can easily fix this by checking if the returned value from the |for each| is a string and checking that the call to |document.getElementById| is non-null before attempting to access the .value propertye.

The only remaining question I have is why the difference between your profiles? Did one of the extensions add custom properties to the form elements or something?

Thanks for digging into this deeper.

Comment 7

[David]

Yes, "TestGen4Web" extension added some methods to array object of another extension "Custom buttons", in which enumeration of affected array throws exception (I disabled TestGen4Web and all is working fine)