IE 9 JavaScript engine crash - by bedney

Status : 

  Fixed<br /><br />
		This item has been fixed in the current or upcoming version of this product.<br /><br />
		A more detailed explanation for the resolution of this particular item may have been provided in the comments section.


ID 543793 Comments
Status Closed Workarounds
Type Bug Repros 1
Opened 3/22/2010 1:49:05 PM
Access Restriction Public

Description

The relationship between 'window' objects and Object.prototype must be different now in IE9.

I've attached a file which shows how a Function object gets placed on Object.prototype, and is actually alerted when the page first loads. But when the button is clicked to 'run the test' and the same property is (re)defined on the 'window' object, the entire browser crashes before the alert() in the runTest() function.

Note that this *only* occurs if the IE9 Preview is in IE9 mode. I've placed a <meta> tag at the top to ensure that it is.

Cheers,

- Bill
Sign in to post a comment.
Posted by Adam [MSFT] on 5/5/2010 at 6:14 PM
Thank you for your feedback.

The issue was resolved in the IE 9 Platform Preview Build released on 5/5/2010. Please verify and file a new bug if the problem persists.

Best regards,

The IE Team
Posted by Adam [MSFT] on 5/5/2010 at 7:44 AM
Thank you for your feedback.

The issue was resolved in the IE 9 Platform Preview released on 5/5/2010. Please verify and file a new bug if the problem persists.

Best regards,

The IE Team
Posted by Adam [MSFT] on 3/30/2010 at 8:19 PM
Thank you for your feedback. We were able to reproduce the issue and are investigating this.

Best regards,

The IE Team
Posted by bedney on 3/22/2010 at 2:54 PM
So this bug is even stranger than I first thought when I filed it. As a workaround, I tried to 'delete' the slot from Object.prototype, set the same named slot on the window (as before) and then put the slot on Object.prototype back to its previous value, that window is also seeing that value instead of the 'local' value placed on it.

The second attached file demonstrates this behavior. Note that I had to comment out the first alert() that pops when the page first loads, since it seems like even touching the 'foo' slot on the window causes the attempted hack-workaround to not work at all (i.e. we're back to the behavior first reported of crashing).

It seems that if a slot with the same name (i.e. 'foo') is defined on both the window and Object.prototype that the lookup machinery is ignoring the local value that window has and is only finding the one on Object.prototype, even when the 'window.foo' syntax is used.