380729 - Firefox can not endure recursion for "for in" supporting of Javascript

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect)

Description

[MingHao Li]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.1) Gecko/20061010 Firefox/2.0

It seems that Firefox can not endure much recursion for "for in" supporting of Javascript.

<script>
uyt={_ffa:{_4ed:'1',
_eef:'2',
_46f:'3'},
_3da:{_8d0:'4',
_0a6:'5',
_827:'6',
_11d:'7'},
_92f:{_80a:'8',
_040:'9',
_80e:'0',
_635:'1',
_171:'2'},
_ed4:{_fb2:{_377:'3',_1ff:'4'},
_d03:'5'},
_22d:'6'}
function m(h){var c='';for(i in h){if(typeof(h[i])!="object")c+=h[i];c+=m(h[i])}return c}
alert(m(uyt))
</script>

This code above works well in IE. However, it doesn't work in Firefox 2.0, and gets the error "too much recursion".


Reproducible: Always

Steps to Reproduce:
Run this code in web page: 

<script>
uyt={_ffa:{_4ed:'1',
_eef:'2',
_46f:'3'},
_3da:{_8d0:'4',
_0a6:'5',
_827:'6',
_11d:'7'},
_92f:{_80a:'8',
_040:'9',
_80e:'0',
_635:'1',
_171:'2'},
_ed4:{_fb2:{_377:'3',_1ff:'4'},
_d03:'5'},
_22d:'6'}
function m(h){var c='';for(i in h){if(typeof(h[i])!="object")c+=h[i];c+=m(h[i])}return c}
alert(m(uyt))
</script>

Actual Results:  
This code above works well in IE. However, it doesn't work in Firefox 2.0, and gets the error "too much recursion".

Expected Results:  
Shows alert() as It showed in IE.

We are the group of Blueidea (http://bbs.blueidea.com), devoting our mind to develop new applications of web. We'll pay attentions for development of browsers.

Comment 1

[Steve England [:stevee]]

You appear to be using a pretty old version of firefox. Can you please try 2.0.0.4RC2?
- http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2.0.0.4-candidates/rc2/

Comment 2

[Bob Clary [:bc] (inactive)]

This hits the internal recursion error in bonecho from today. The problem is the script ends up enumerating the properties of a string. In Firefox|Spidermonkey, strings have properties 0,1,...length-1 so that the characters in the string can be index as string[index], but IE does not support this extension.

You are enumerating a string, getting an index property, then trying to enumerate the character returned by that index, then trying to enumerate the properties of that character until you recurse to death.

The question would be if the index properties should be enumerable or not, but marking this invalid in the mean time.

Comment 3

[Brendan Eich [:brendan]]

ES4 aka JS2 is making individual chars enumerable as indexed, unit-string-valued properties of the string, so this but should be invalid.

/be

Comment 4

[MingHao Li]

Thank you so much! :D

It's the vice of my code.
This sould be the correct script code:
<script>
uyt={_ffa:{_4ed:'1',
_eef:'2',
_46f:'3'},
_3da:{_8d0:'4',
_0a6:'5',
_827:'6',
_11d:'7'},
_92f:{_80a:'8',
_040:'9',
_80e:'0',
_635:'1',
_171:'2'},
_ed4:{_fb2:{_377:'3',_1ff:'4'},
_d03:'5'},
_22d:'6'}
function m(h){var c='';for(i in h){if(typeof(h[i])!="object")c+=h[i];if(typeof(h[i])=="object")c+=m(h[i])}return c}
alert(m(uyt))
</script>