280671 - getting an ArrayIndexOutOfBoundException while trying to access the default Element in a HTML select list, without having an object selected as default

Status: RESOLVED INVALID

(Rhino Graveyard :: Core, defect)

Description

[Thomas Fritz]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Opera 7.54  [en]
Build Identifier: httpunit/1.6

On a Website with the following JavaScript code "document.myForm.card.
options[document.myForm.card.selectedIndex].value" and with no default selected 
option in the corresponding HTML - select, you get -1 as a result of document.
myForm.card.selectedIndex. You then try to access document.myForm.card.options[-
1].value. While JavaScript the effect is, that the -1 is replaced by a 0 and 
then the result of value is the first element in the list, in Java you get an 
ArrayIndexOutOfBoundsException. 

Reproducible: Always

Steps to Reproduce:
1.Parse the Purchase page of www.ryanair.com with Rhino and HTTPUnit.
2.
3.

Actual Results:  
I got an ArrayIndexOutOfBoundsException

Expected Results:  
It should have taken the first Element of the List.

Comment 1

[Thomas Fritz]

It can be fixed, by changing the Method "public static Object 
getObjectElem(Scriptable obj, Object elem, Context cx)", and altering the 
following:

Original Code:

if (s == null) {
    int index = lastIndexResult(cx);
    result = ScriptableObject.getProperty(obj, index);
}

Fixed Code:

if (s == null) {
    int index = lastIndexResult(cx);
    if (index==-1)
      index=0;
    result = ScriptableObject.getProperty(obj, index);
}

Comment 2

[Igor Bukanov]

Marking as invalid: if it is necessary to deal with such behaviour to support
the special treatment of -1 in a browser-specific world please override
Scriptable.get(String property, Scriptable) and check for -1 in property.

Comment 3

[Thomas Fritz]

Just noticing, I forgot to add, that the change has to be made in the Class 
org.mozilla.javascript.ScriptRuntime ... was a bit late yesterday, sorry :)

To be more specific, here is the old Version of the Method:

    public static Object getObjectElem(Scriptable obj, Object elem,
                                       Context cx)
    {
        if (obj instanceof XMLObject) {
            XMLObject xmlObject = (XMLObject)obj;
            return xmlObject.ecmaGet(cx, elem);
        }

        Object result;

        String s = toStringIdOrIndex(cx, elem);
        if (s == null) {
            int index = lastIndexResult(cx);
            result = ScriptableObject.getProperty(obj, index);
        } else {
            result = ScriptableObject.getProperty(obj, s);
        }

        if (result == Scriptable.NOT_FOUND) {
            result = Undefined.instance;
        }

        return result;
    }

This should be the new version:

    public static Object getObjectElem(Scriptable obj, Object elem,
                                       Context cx)
    {
        if (obj instanceof XMLObject) {
            XMLObject xmlObject = (XMLObject)obj;
            return xmlObject.ecmaGet(cx, elem);
        }

        Object result;

        String s = toStringIdOrIndex(cx, elem);
        if (s == null) {
            int index = lastIndexResult(cx);
            if (index==-1)
              index=0;
            result = ScriptableObject.getProperty(obj, index);
        } else {
            result = ScriptableObject.getProperty(obj, s);
        }

        if (result == Scriptable.NOT_FOUND) {
            result = Undefined.instance;
        }

        return result;
    }

Comment 4

[Igor Bukanov]

(In reply to comment #3)
> Just noticing, I forgot to add, that the change has to be made in the Class 
> org.mozilla.javascript.ScriptRuntime ... was a bit late yesterday, sorry :)

This change breaks ECMA Standard and as I wrote should be done in the custom
host objects.

Comment 5

[Thomas Fritz]

Could you point me to the explicit ECMA Standard you are talking about?

To be explicit, we had to patch the js.jar to fix this problem, which is also a 
bit annoying, as the BEA Webserver for example has the complete js.jar inside 
it's weblogic.jar and thus with the normal classpath, the fix is ignored.

I don't really see where I can fix this in a custom host object.

Comment 6

[Igor Bukanov]

(In reply to comment #5)
> Could you point me to the explicit ECMA Standard you are talking about?

See http://www.ecma-international.org/publications/files/ecma-st/ECMA-262.pdf ,

11.2.1 Property Accessors

which does not define any special treatment for "-1" and the method in Rhino you
suggested to change corresponds to this action. 
> 
> To be explicit, we had to patch the js.jar to fix this problem, which is also a 
> bit annoying, as the BEA Webserver for example has the complete js.jar inside 
> it's weblogic.jar and thus with the normal classpath, the fix is ignored.
> 
> I don't really see where I can fix this in a custom host object.

Just override Scriptable.get(int index, Scriptable start) in yous host object to
call Scriptable.get(0, start) when -1 was not found. See Rhino docs and Google
for details.