[Webkit-unassigned] [Bug 17146] global variable declarations should shadow window properties from named elements

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=17146





------- Comment #5 from oliver at apple.com  2008-02-02 14:37 PDT -------
I think what you're missing is the 
"var x = 1" is not actually equivalent to "window.x = 1", it's a subtle but
important difference, it is actually equivalent to
  var x;
  x = "foo"; // where x will be on the current variable object, at the global
scope, that will be window

now this is what causes the badness:
try {
throw "my awesome exception";
var x = "foo";
} catcgh (e) {}
alert(x. toString()); //or whatever

is actually equivalent to
var x;
try {
throw "my awesome exception"
x = "foo";
} catch(e) {}
alert(x.toString());

Because all var declarations have to be moved to the beginning of the script. 
The rules for this are that the var declarations must all happen first, and
that must initialise the declared property to undefined.  So the behaviour is:
var x;  // set window.x to undefined
try {
throw "my awesome exception" // throw
} catch(e) {}
alert(foo. toString());

So when you go to use x, x will be undefined.  *Unless* there was already a
global property called x and you don't allow shadowing.  If shadowing is
allowed then var x will obliterate any existing property named x; if shadowing
is not allowed then "var x" will not convert x to null.  Voila you now
different behaviour between browsers: If you allow  shadowing "foo. toString()"
will throw due to it being undefined, and if you don't allow shadowing (and x
already existed with a defined value) you won't throw.  Woo!

The bug in google code has nothing to do with type conversion -- the bug is
that _exposeExistingLabelFields does not exist, causing projectname and
hasUppercase (and others) to not be initialised, so checkprojectname throws
immediately.   Because WebKit doesn't allow shadowing projectname is not
undefined so it throws when it tries to access hasUppercase, thus leading to
death and infamy.

The code that does "submit.disabled='disabled'" will work as expected for
entirely the wrong reasons, disabled is a bool, so standard js conversion rules
apply -- 0-length string = false, non-zero length string = true.


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.