Closed Bug 570862 Opened 15 years ago Closed 3 years ago

window.parent.eval turns Arrays into Hashes

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED FIXED

People

(Reporter: mrj, Unassigned)

References

(
URL
)

Details

User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Build Identifier: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 When a JavaScript code string is evaluated from a child window (iframe) using parent.eval, Arrays in that string become ordinary hash-type JavaScript objects. Reproducible: Always Steps to Reproduce: 1. Create parent.html containing <body><iframe src="child.html"></iframe></body> 2. Create child.html containing <body><script>parent.eval('alert([1,2,3] instanceof Array)')</script></body> 3. Load parent.html Actual Results: Alert says "false". Expected Results: Alert says "true". It does this on all other major browsers (note that the code must be changed if the instanceof method is not supported). Use of both toSource and a JSON converter show that the Array [1,2,3] has become the Object {"0": 1, "1": 2, "2": 3}.
> Arrays in that string become ordinary hash-type JavaScript objects. No, they're still arrays. Note that using your steps to reproduce I get "true", by the way. Can you post your actual steps to reproduce (or just attach the testcase to this bug)?
Boris, try using the bug URL http://advancedcontrols.com.au/parent.html . I get "false" on the designated build.
Ah, I get false in 1.9.2 but I get true on trunk. I also get true in Google Chrome, Safari, and Opera, contrary to comment 0. Let me see what might have fixed this.
For what it's worth, in this case in 1.9.2 it looks like [1,2,3] instanceof frames[0].Array tests true, so we were just creating the array using the proto from the child frame for some reason. Presumably due to issues in terms of the global object eval should use.
Almost certainly fixed in bug 495325. Blake, care to add this testcase?
Assignee: nobody → general
Component: DOM: Core & HTML → JavaScript Engine
Depends on: 495325
QA Contact: general → general
I've confirmed that "true" is returned when http://advancedcontrols.com.au/parent.html is fetched using The 19-May-2010 Linux 64-bit Intel nightly build (Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.3a5pre) Gecko/20100608 Minefield/3.7a5pre). My JSON code also works in this build, no longer converting Arrays to hashes. Boris, due to concatenation of the bug-reporting text areas, my language wasn't clear in comment 0: I meant "It does this [Alert says "true"] on all other major browsers" (including IE when different code is used).
Ah, I see. OK, that makes sense. The JSON behavior is per JSON spec, for what it's worth; the object's prototype is examined to determine what to do with it. If you pass an array from a subframe to a parent frame and then JSON encode it there, the same thing will happen (for the same reason).
Yes, the only workaround I can come up with on 1.9.2 to have the JSON converter produce an ordinary array is to have the subframe pass the array to the parent frame as a String, which the parent evaluates before the JSON converter is run on it. Whenever an array object is defined in the sub-frame, no matter how it's passed around, it converts to a hash. This is not the case on 1.9.3a5pre.
Assignee: general → nobody
Status: UNCONFIRMED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.