An enumerated property was disavowed by dom causing bug 233483

NEW
Assigned to

Status

()

Core
DOM: Core & HTML
13 years ago
10 years ago

People

(Reporter: timeless, Assigned: jst)

Tracking

Trunk
x86
Windows XP
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

13 years ago
Follow up to Bug 233483 crash when i'm trying to get specific Array asString [@
MarkSharpObjects]

per bug 233483 comment 11:
+	*(JSString*)((long)((JSAtom*)(ida->vector[i]))->entry.key-4) 
{length=0x00000001 chars=0x01a93860 "0" }	JSString
+	*(JSClass*)(obj->slots[2]-1)	{name=0x027604e8 "HTMLFormElement"
flags=0x0000000d addProperty=0x00ab5af7 XPC_WN_Helper_AddProperty(JSContext *,
JSObject *, long, long *) ...}	JSClass
(Assignee)

Updated

13 years ago
No longer blocks: 233483
(Reporter)

Updated

13 years ago
Blocks: 233483
(Reporter)

Comment 1

13 years ago
jst wrote in bug 233483 comment 16:
Brendan and I (jst) sat down and tracked down where this missing prop comes
from. We end up in the prop == null case when enumerating the properties of an
HTMLFormElement object whose enumerate hook tells the JS engine that there's a
property named "0" (it uses the form controls index if the form control doesn't
have a name, as is the case here), but then the form element's resolve hook
doesn't return anything when "0" (or the integer 0, really) is resolved. Yet
form[0] does return the input. Fun.
Assignee: timeless → jst
(Reporter)

Updated

10 years ago
Component: DOM: HTML → DOM: Core & HTML
QA Contact: ian → general
You need to log in before you can comment on or make changes to this bug.