Bug 5210 – REGRESSION: for/in loop with var changes global variable instead of making local

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Hanspeter Schaub]

On the web site

http://www.udm4.com/

The dynamic menus failed to work starting two days ago (today is 9/30/05).  Only the first submenu is 
accessible.  All the other submenus are not selectable.  I use this same dynamic menu script on my own 
web page at

http://homepage.mac.com/hanspeterschaub/work/main.html

and they menus have begun to work anywore with the latest builds.  I don't program javascript myself, 
unfortunately, so I've not been able to track down which function in particular is causing this issue.

[Hanspeter Schaub]

These dynamic menus at

http://www.udm4.com/

used to work very well in Safari.  As of a few weeks ago, they started to fail?  The sympton that I'm seeing 
is that only the first menu item appears to have a proper sub-menu.  All other menu items only show the 
title, but don't provide access to the submenu beneath it.  

[Daniel Udey]

The bug is indeed present in this script, whether loading off the site or locally.

This Javascript is very obfuscated, and dealing with it as it is may well prove a challenge. I have contacted 
the developers regarding this issue, in the hopes that they may be able to track this down, or provide un-
obfuscated scripts for testing purposes, or even would be willing/able to track it down themselves.

[Joost de Valk (AlthA)]

Upping to P1 because this is a regression.

[Darin Adler]

Looks like this was fixed on the udm4.com side back on 2005-11-10. There's now no way to reproduce the problem since we don't have a saved copy of the buggy version. So I'm closing this bug report as "INVALID". Feel free to open if we find any way to reproduce the bug.

[Daniel Udey]

This bug has been reduced and a testcase posted at http://www.udm4.com/webkit-debug.html

The description of the testcase is available in my posting to webkit-dev from 19 January 2006:

http://www.opendarwin.org/pipermail/webkit-dev/2006-January/000671.html

[Darin Adler]

Created attachment 5883 [details]
reduction from Daniel Udey

[Darin Adler]

I see the problem. It's specific to "for ... in" loops.

[Darin Adler]

Created attachment 6250 [details]
patch to fix the problem, including change log and test

[Maciej Stachowiak]

Comment on attachment 6250 [details]
patch to fix the problem, including change log and test

r=me

[David Kilzer (:ddkilzer)]

*** Bug 6389 has been marked as a duplicate of this bug. ***