536468 - "TypeError: (void 0) is not a constructor" when adding properties to web page "window" from chrome.

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Michael Bolin]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.38 Safari/532.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 (.NET CLR 3.5.30729)

I am one of the maintainers of the Chickenfoot extension. I think that one of the recent security updates must have changed some of the behavior around wrappedJSObject (as the security updates often do).

Oftentimes I want to make a trusted function that I created in the chrome available to a web page (as I am using that web page for its UI). If the reference to the window in the web page is "win", I would do something like this:

// win is the 'wrappedJSObject' version of window.
win['functionName'] = function() {
  // this can access the Chrome
};

This type of thing previously worked in Chickenfoot. Now it fails (sort of) by throwing the following cryptic error:

"TypeError: (void 0) is not a constructor"

What is especially interesting is that the property is added to win, but the error halts execution. My current workaround is to just catch the error:

var exportFunction = function(win, name, trustedFunction) {
  try {
    win[name] = trustedFunction;
  } catch (e) {
    // OK
  }
};

exportFunction(win, 'functionName', function() {
  // this can access the Chrome
});

I have no idea what the intended behavior is, but clearly this is wrong. Either there is some security vulnerability that the exception is trying to prevent (which it isn't because I have found a workaround) OR this exception is a bug and I should be able to write code as I was able to before.

I certainly hope it's the latter because it seems valid for extension developers (or anyone who is using the chrome of the browser) to use the web as the UI for their creations. To that end, developers must be able to create connections between UI events in the page and business logic in the chrome.


Reproducible: Always

Steps to Reproduce:
Install Chickenfoot in Firefox.

In Chickenfoot, run the following script:

window.wrappedJSObject.onunload = function() {
  output('unloaded');  
};

Actual Results:  
You will get:

"TypeError: (void 0) is not a constructor"

in the Chickenfoot Output console.

Expected Results:  
It should have overwritten the onload handler for the current web page.


Interestingly, the following does not cause an error:

window.wrappedJSObject.onunload = 42;

But this does:

window.wrappedJSObject.onunload = {a: 1, b: 2};

So clearly whatever logic is involved makes a distinction between primitives and objects, presumably because primitives are immutable.


I believe this is a regression -- I'm currently using Firefox 3.5.6, but I swear my Chickenfoot scripts were working in earlier versions of the 3.5.x series.

Comment 1

[Ria Klaassen (not reading all bugmail)]

It seems fixed on trunk, recently on 19 Nov 2009, and also on 3.6.
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla-central/