355935 - "for ([a, x.b] in x)" hangs if x is an xml element [e4x, iterate]

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> x = <y><z/></y>; print(3); for ([a, x.b] in x) { }

Result: hang

Expected: not hang

Comment 1

[Brendan Eich [:brendan]]

You wrote an iloop, you get an iloop:

js> i = 0; x = <y><z/></y>; print(3); for ([a, x.b] in x){print(a, x);if (++i==4) break}
3
0 <y>
  <z/>
  <z/>
</y>
1 <y>
  <z/>
  <z/>
  <z/>
</y>
2 <y>
  <z/>
  <z/>
  <z/>
  <z/>
</y>
3 <y>
  <z/>
  <z/>
  <z/>
  <z/>
  <z/>
</y>

Recall that ECMA says properties added during enumeration may or may not show up, at the implementation's discretion.

Use the -b option to set a branch callback.

/be

Comment 2

[Jesse Ruderman]

E4X overrides "x.b = y" to mean "add y as a child of x, and ignore the name 'b'"?  Weird.

Comment 3

[Brendan Eich [:brendan]]

(In reply to comment #2)
> E4X overrides "x.b = y" to mean "add y as a child of x, and ignore the name
> 'b'"?  Weird.

It depends on what y is.  If y is an element, it carries its own name (the tag name, of course):

js> x = <y><z/></y>
<y>
  <z/>
</y>
js> x.b = x[0]
<y>
  <z/>
</y>
js> x
<y>
  <z/>
  <y>
    <z/>
  </y>
</y>
js> x.b = x[1]
undefined
js> x
<y>
  <z/>
  <y>
    <z/>
  </y>
  <b>undefined</b>
</y>
js> delete x.b
true
js> x
<y>
  <z/>
  <y>
    <z/>
  </y>
</y>

/be