Javascript: for statement overlooped




11 years ago
11 years ago


(Reporter: David, Unassigned)


Firefox Tracking Flags

(Not tracked)



(2 attachments)



11 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0

I spotted some strange error in javascript code:

fragment of code:

		var values={};
		for each (var v in this.CB.buttonParameters){

where length of array this.CB.buttonParameters.length was 4 elements
but loop was executed 5 times and caused exception at 5th pass
value of non existing item assigned to variable "v" was {script}

after backup and restoration of profile in new place it seems that problem disappeared,
but I think that this error was caused by some bug in javascript engine


Reproducible: Sometimes


11 years ago
Assignee: nobody → general
Component: General → JavaScript Engine
Product: Firefox → Core
QA Contact: general → general
Version: unspecified → 1.8 Branch

Comment 1

11 years ago
To reproduce bug:

0. download my firefox 2 test profile from
1. run firefox and install extensions: FEBE and CLEO 
2. create new profile
3. restore downloaded profile file into created profile
4. run firefox with created profile
5. right click on button "FireFTP as dialog" placed right next search bar
   and from popup menu choose "Edit button..."
6. run debugger (button is on first toolbar)
7. in debugger find script "editor.js"
8. in "editor.js" find method "setButtonParameters:function()" 
   in this function there is loop "for each (var v in this.CB.buttonParameters)"
   on line 40, set break point at this loop
9. back in edit button dialog choose OK button  (debugger stops after this)
10. in debugger you see that 
   "this.CB.buttonParameters" has 4 elements but "for each" does one more step

there is some corruption in data of javascript engine ???

Comment 2

11 years ago
Compact Library Extension Organizer (CLEO)

Firefox Extension Backup Extension (FEBE)

If this is dependent on your profile, it isn't the JavaScript Engine.
Assignee: general → nobody
Component: JavaScript Engine → General
Product: Core → Firefox
QA Contact: general → general
Summary: Javascript: for statemet overlooped → Javascript: for statement overlooped
Version: 1.8 Branch → unspecified

Comment 3

11 years ago
I agree that there is some bug somewhere in extensions 
but this bug leads to some corruption in javascript engine (data overflow?).

Then "for each" thinks that array contains more elements than it actually have

I send my profile (where this bug can be found) because I think that it is hard to find another way to simulate this bug

Profile contains 7 extensions, only 2 of them are needed to simulate bug
"TestGen4Web" and "Custom Buttons" (others can be uninstalled)
But when these extensions are installed in new profile from web (same versions), all is working well (strange)

Is it possible make corruption in firefox memory only with javascript (without using ole or accessing dll) ?


Comment 4

11 years ago
Created attachment 246413 [details]
Screenshot of error

Stopped right before exception, look at array, itemsCount and loopCount

itemsCount should be equal to loopCount but it is not

Comment 5

11 years ago
Created attachment 246423 [details]
One Another screenshot (maybe will explain averything)

I added "For...In" block to get all elements...


"For...In" and "For Each...In" statements also enumerate custom methods of array object

If it is correct behaviour of enumerating arrays then please close this bug.

Comment 6

11 years ago
Yes, enumeration will get any user added properties or functions. The problem you were seeing seems to be that you were expecting the array to only contain id values that could be looked up. You can easily fix this by checking if the returned value from the |for each| is a string and checking that the call to |document.getElementById| is non-null before attempting to access the .value propertye.

The only remaining question I have is why the difference between your profiles? Did one of the extensions add custom properties to the form elements or something?

Thanks for digging into this deeper.
Last Resolved: 11 years ago
Resolution: --- → WORKSFORME

Comment 7

11 years ago
Yes, "TestGen4Web" extension added some methods to array object of another extension "Custom buttons", in which enumeration of affected array throws exception (I disabled TestGen4Web and all is working fine)
You need to log in before you can comment on or make changes to this bug.