Bug 5210 - REGRESSION: for/in loop with var changes global variable instead of making local
Summary: REGRESSION: for/in loop with var changes global variable instead of making local
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P1 Major
Assignee: Darin Adler
URL: http://www.udm4.com/
Keywords: EasyFix, HasReduction, Regression
: 6389 (view as bug list)
Depends on:
Blocks:
 
Reported: 2005-09-30 17:06 PDT by Hanspeter Schaub
Modified: 2006-02-05 05:32 PST (History)
3 users (show)

See Also:

Attachments
reduction from Daniel Udey (800 bytes, text/html)
2006-01-23 11:40 PST, Darin Adler 		no flags Details
patch to fix the problem, including change log and test (7.82 KB, patch)
2006-02-04 10:37 PST, Darin Adler 		mjs: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Hanspeter Schaub 2005-09-30 17:06:53 PDT 
On the web site

http://www.udm4.com/

The dynamic menus failed to work starting two days ago (today is 9/30/05).  Only the first submenu is 
accessible.  All the other submenus are not selectable.  I use this same dynamic menu script on my own 
web page at

http://homepage.mac.com/hanspeterschaub/work/main.html

and they menus have begun to work anywore with the latest builds.  I don't program javascript myself, 
unfortunately, so I've not been able to track down which function in particular is causing this issue.
Comment 1 Hanspeter Schaub 2005-10-16 08:53:49 PDT 
These dynamic menus at

http://www.udm4.com/

used to work very well in Safari.  As of a few weeks ago, they started to fail?  The sympton that I'm seeing 
is that only the first menu item appears to have a proper sub-menu.  All other menu items only show the 
title, but don't provide access to the submenu beneath it.
Comment 2 Daniel Udey 2005-10-19 10:02:37 PDT 
The bug is indeed present in this script, whether loading off the site or locally.

This Javascript is very obfuscated, and dealing with it as it is may well prove a challenge. I have contacted 
the developers regarding this issue, in the hopes that they may be able to track this down, or provide un-
obfuscated scripts for testing purposes, or even would be willing/able to track it down themselves.
Comment 3 Joost de Valk (AlthA) 2006-01-22 04:42:37 PST 
Upping to P1 because this is a regression.
Comment 4 Darin Adler 2006-01-22 16:11:42 PST 
Looks like this was fixed on the udm4.com side back on 2005-11-10. There's now no way to reproduce the problem since we don't have a saved copy of the buggy version. So I'm closing this bug report as "INVALID". Feel free to open if we find any way to reproduce the bug.
Comment 5 Daniel Udey 2006-01-23 09:18:44 PST 
This bug has been reduced and a testcase posted at http://www.udm4.com/webkit-debug.html

The description of the testcase is available in my posting to webkit-dev from 19 January 2006:

http://www.opendarwin.org/pipermail/webkit-dev/2006-January/000671.html
Comment 6 Darin Adler 2006-01-23 11:40:59 PST 
Created attachment 5883 [details]
reduction from Daniel Udey
Comment 7 Darin Adler 2006-02-04 09:45:20 PST 
I see the problem. It's specific to "for ... in" loops.
Comment 8 Darin Adler 2006-02-04 10:37:35 PST 
Created attachment 6250 [details]
patch to fix the problem, including change log and test
Comment 9 Maciej Stachowiak 2006-02-04 13:44:44 PST 
Comment on attachment 6250 [details]
patch to fix the problem, including change log and test

r=me
Comment 10 David Kilzer (:ddkilzer) 2006-02-05 05:32:45 PST 
*** Bug 6389 has been marked as a duplicate of this bug. ***