645636 - Javascript array with index as ['-1'] behaves erratically and causes variable 'undefined' error

Status: VERIFIED DUPLICATE of bug 645184

(Core :: JavaScript Engine, defect)

Description

[[e-mail]]

User-Agent:       Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0) Gecko/20100101 Firefox/4.0

Javascript array with index as ['-1'] behaves erratically and causes variable 'undefined' error.

When running the following script FF4 throws errors such as 'variable undefined'. The usage of array index ['-1'] causes this error when allocating multiple new Array() objects in a loop.

<script> 
// BROKEN IN Firefox 4.0 
// Author: Jonathan Micklos ([e-mail])
// Alternatives which work: 
//   1. Create a new variable and initialize it with the value '-1'. Replace instances of '-1' with said variable. 
//   2. Replace instances of new Array() with new Object() 
//   3. Place an alert in the loop to manually stagger the loop. 

	var base = new Object();
	var testPassed = true;
	for (var x = 1; x <= 100; x++) {
		console.info("Start: ");
		console.info(base);

		if (base['-1'] == null) {
			base['-1'] = new Array();
		}

		console.info("Middle: ");
		console.info(base);

		if (base['-1'] == null) { 
			testPassed = false;
			alert("TEST FAILED: On iteration " + x + " something happened that should never happen!");
		}
		base = new Object();

		console.info("End: ");
		console.info(base);
	}
	
	if (testPassed) {
		alert("TEST PASSED!"); 
	}
</script>

Reproducible: Always

Steps to Reproduce:
1. Open the URL http://www.amazon.com/dp/B002C74BNG

Actual Results:  
The page loads with lots of javascript varibles undefined error. Hovering/Cicking some of the image tiles in the centre of the screen does not change anything on screen and makes the page un-usable

Expected Results:  
The page loads without any javascript errors. Hovering and clicking changes information on the page.

Run the script pasted in the Details section which shows exactly what use-case makes this bug reproducible

Comment 1

[Justin Dolske [:Dolske]]

Uhh, yeah, something isn't right here. The code in the loop block isn't dependent on the loop counter (x), but I hit the test failure alert at random numbers of iterations (3 - 19 from a few quick runs).

I copied the code in comment 0 to:

https://people.mozilla.com/~dolske/tmp/bug645636.html

Interesting observation... Seems the usual output in good runs is:

...
[00:36:29.562] "Middle: "
[00:36:29.564] ({'-1':[]})
...


But in the iteration before failure I get:

...
[00:38:16.763] "Middle: "
[00:36:29.779] ({'-1':#1=[], '-1':#1#})
...

WTF? How did sharpvars get in there?!

Comment 2

[Justin Dolske [:Dolske]]

Test passes if I set javascript.options.methodjit.content to false.

Comment 4

[Boris Zbarsky [:bzbarsky]]

> How did sharpvars get in there?!

Well, most obviously because there are two properties with the same value (object-identity same).  Of course they also have the same _name_, which is all broken.... ;)