457798 - regression: Function.toString(), Function.toSource() and uneval() return wrong JavaScript code if the function includes "for ... in" roop

Status: RESOLVED DUPLICATE of bug 457093

(Core :: JavaScript Engine, defect)

Description

[YUKI "Piro" Hiroshi]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.9.0.2) Gecko/2008091620 Firefox/3.0.2
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.8.1.17) Gecko/20080829 Firefox/2.0.0.17

Function.toString(), Function.toSource() and uneval() return wrong JavaScript code if the function includes "for ... in" roop. And, if the roop includes "try ... catch" code, NS_ERROR_XPC_BAD_CONVERT_JS exception appears when we get JavaScript code from the function.

Reproducible: Always

Steps to Reproduce:
1. Run following codes:
-----------------------------------------
function func1() { 
  for (var i = 0; i < obj.length; i++) {}
}
alert(func1);

function func2() {
  for (var i in obj) {}
}
alert(func2);

window.func3 = function() {
  for (var i in obj) {
    try {}
    catch (e) {}
  }
}
alert(window.func3);
-----------------------------------------

Actual Results:  
Two messages appear. In the second message, the part "for (var i in obj)" unexpectedly becomes "while (obj)". In the Error Console, an exception appears instead of the third message: [Exception... "Could not convert JavaScript argument"  nsresult: "0x80570009 (NS_ERROR_XPC_BAD_CONVERT_JS)"  location: "JS frame :: chrome://ctxextensions/content/extFunc.js :: anonymous :: line 877"  data: no]


Expected Results:  
Three messages appear. All of messages are just same to definitions of functions.

I tested it on Firefox 2.0.0.17, Thunderbird 2.0.0.17 and Firefox 3.0.3. The problem appears only on Fx 2.0.0.17 and Tb 2.0.0.17. To reproduce it, I installed "ContextMenu Extensions" http://piro.sakura.ne.jo/xul/ctxextensions/index.html.en and run the code from JavaScript Panel: "Tools" > "JavaScript Panel".

Some extensions dynamically re-define Firefox functions by eval(). This problem breaks them seriously.