Bug 29135 - window.frames[i] interprets the type of "i" incorrectly
Summary: window.frames[i] interprets the type of "i" incorrectly
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore JavaScript (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (Intel) OS X 10.5
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-09-10 11:55 PDT by Grant Gayed
Modified: 2009-12-01 12:21 PST (History)
2 users (show)

See Also:


Attachments
test case (354 bytes, text/html)
2009-09-11 16:36 PDT, Alexey Proskuryakov
no flags Details
test case (734 bytes, application/zip)
2009-09-14 09:00 PDT, Grant Gayed
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Grant Gayed 2009-09-10 11:55:12 PDT
- observed in Safari 4.0.3 (5531.9)

- view the page below
- navigate to some other page, which invokes the current page's onbeforeunload
- this prints the names of the frames in the window.frames array, and observe that the array is 1-based instead of the expected 0-based: frame "1" is in array positions 0 and 1 (instead of just position 0), and frame "2" is in array position 2 (instead of position 1)

<html>
<head>
<script>
function closeIt()
{
  for (var i = 0; i <= window.frames.length; i++) {
	alert('frame name: ' + window.frames[i].name + ' i=' + i);
  }
}
window.onbeforeunload = closeIt;
</script>
</head>
<frameset cols="50%,50%">
  <frame name="1" src="http://www.asdf.com">
  <frame name="2" src="http://www.qwerty.com">
</frameset>
</html>
Comment 1 Sam Weinig 2009-09-10 12:29:20 PDT
I believe what you are seeing is that window.frames[] is overloaded for both number and name.  So, since you named the frames "1" and "2", they are getting picked up.
Comment 2 Grant Gayed 2009-09-10 12:39:44 PDT
You're right, that's what's happening.  I guess this is by design, so I'll close the report.  Thanks for the quick response!
Comment 3 Grant Gayed 2009-09-11 06:53:37 PDT
Revisiting, I think I closed this too hastily.  Comment 1 does explain what's happening, but it still seems wrong.  JS knows the difference between a number and a string, so it should know whether the frame's name or its index is being provided.  The other browsers don't get this case confused.
Comment 4 Alexey Proskuryakov 2009-09-11 16:36:10 PDT
Created attachment 39489 [details]
test case

Same test case, as an attachment.
Comment 5 Alexey Proskuryakov 2009-09-11 16:40:49 PDT
This test doesn't work in Firefox at all, because trying to access a frame with another origin fails with an exception. It isn't too informative in Safari either, as the window name comes back as "undefined".

Do you have a test that shows difference between Safari and other browsers?
Comment 6 Grant Gayed 2009-09-14 09:00:22 PDT
Created attachment 39546 [details]
test case

This test case shows the difference, just load test.html and wait two seconds.  The browser behaviours are:

- IE6, IE8, Firefox 3.5.3 on Windows and Linux: i=0 has name=1, i=1 has name=2
- Firefox 3.5.3 on OSX 10.5.8: does not show this dialog
- Safari 4.0.3 (5531.9) on OSX 10.5.8: i=0 has name=1, i=1 has name=1, i=2 has name=2

I don't know why Firefox on OSX doesn't match Firefox on Windows and Linux, maybe something is set differently?  Regardless, the difference can be seen with the other configurations.
Comment 7 Alexey Proskuryakov 2009-09-14 11:24:31 PDT
Thank you!

Confirmed with r48314.