aa variable is being overwritten multiple times in the source code of friendconnect.js

[John D'Orazio]

It's hard to debug the friendconnect.js script because it's compressed, I don't know of an svn or a github repository...

But seeing that the "charAt" errors continue without being corrected I decided to take a shot at a little bit of debugging.

I've copied the code in local and put some breakpoints.

There's an "aa" variable that is being overwritten a few times. First it's defined as a function, then as an array, then as a string representing a url...

So when it's supposed to be representing a url string as in line 880:

else{if(aa.charAt(0)=="/"){af=y(s,gadgets.rpc.getOrigin(window.location.href))
}}

it's actually an object, which is why it's generating the error

Uncaught TypeError: Object #<Object> has no method 'charAt'

If I do a "console.log(aa)" at line 880, this is what I get:

friendconnect.js:879

Object

1. a: Array[1]
1. 0: "resize"
2. length: 1
3. __proto__: Array[0]
1. concat: function concat() { [native code] }
2. constructor: function Array() { [native code] }
3. every: function every() { [native code] }
4. filter: function filter() { [native code] }
5. forEach: function forEach() { [native code] }
6. indexOf: function indexOf() { [native code] }
1. arguments: null
2. caller: null
3. length: 1
4. name: "indexOf"
5. __proto__: function Empty() {}
7. join: function join() { [native code] }
8. lastIndexOf: function lastIndexOf() { [native code] }
9. length: 0
10. map: function map() { [native code] }
11. pop: function pop() { [native code] }
12. push: function push() { [native code] }
13. reduce: function reduce() { [native code] }
14. reduceRight: function reduceRight() { [native code] }
15. reverse: function reverse() { [native code] }
16. shift: function shift() { [native code] }
17. slice: function slice() { [native code] }
18. some: function some() { [native code] }
19. sort: function sort() { [native code] }
20. splice: function splice() { [native code] }
21. toLocaleString: function toLocaleString() { [native code] }
22. toString: function toString() { [native code] }
23. unshift: function unshift() { [native code] }
24. __proto__: Object
2. c: 0
3. f: "gfc_iframe_1642769180_0"
4. l: false
5. origin: "http://p7rjrrl49ose4gob99eonlvp0drmce3d-a-fc-opensocial.googleusercontent.com"
6. referer: "http://p7rjrrl49ose4gob99eonlvp0drmce3d-a-fc-opensocial.googleusercontent.com"
7. s: "subscribeEventType"
8. t: "443731538"
9. __proto__: Object

So it's clearly not representing a url querystring!

If you look at the source code, at line 716 we have:

var O=(function(){function aa(ab){return function(){S(ab+": call ignored")

So here "aa" is a function.

At line 729 we have:

var aa=A[af]||[];

If I do a console.log(A[af]), we have an "undefined", so "aa" is becoming an array here (if not A[af] then [] array).

And I don't really understand what the code is trying to do in the following lines. If in fact "aa" is becoming an empty array in line 729, then:

var aa=A[af]||[];
for(var ac=0;
ac<aa.length;
++ac){var ae=aa[ac];
ae.t=B(af);

In line 730 we have a for cycle, which has the condition "do until ac<aa.length". But guess what, if "aa" is an empty array then this cycle won't take place will it. I'm supposing that's the desired behaviour, but maybe it could take a double-check...

In line 739 "aa" is being defined as a function again:

function aa(){E=true}

In line 763 "aa" is cast as "o[ae.s] else o[P]":

var aa=(o[ae.s]||o[P]).apply(ae,ae.a);

When I console.log o[ae.s] and o[P], I see that they are both functions.

So "aa" is being defined as another function.

In line 771 "aa" is cast as "as.indexOf('/')":

var aa=ad.indexOf("/");

In line 791 "aa" is cast as a window frame:

var aa=window.frames[ac];

In line 793 "aa" is cast as a DOM element:

aa=document.getElementById(ac);

And I'm supposing that "ac" is a frame because in line 794 we have "if aa && aa.contentWindow".

Well, I console.logged document.getElementById(ac), but there was no log, so I'm supposing it's within an if statement that is not verifying as true...

In line 798 "aa" is cast as "L(ad)". Console.log(L(ad)) returns a url:

L(ad) = http://p7rjrrl49ose4gob99eonlvp0drmce3d-a-fc-opensocial.googleusercontent.com/ps/rpc_relay.html

In line 832 "aa" is cast as "T[ab]". Console.log(T[ab]) gives:

T[ab] is = http://p7rjrrl49ose4gob99eonlvp0drmce3d-a-fc-opensocial.googleusercontent.com/ps/rpc_relay.html

And in the following lines we have string operations that have to do with "aa" and the value of "aa".

In lines 869-874, "aa" is being treated as both a string and an object:

function h(aa,ac,ae,ad){if(aa===".."){var ab=ae||e.rpctoken||e.ifpctok||"";
if(window.__isgadget===true){b(ab,ad)
}else{U(ab,ac,ad)
}}else{n(aa,ac,ae,ad)
}}return{config:function(aa){if(typeof aa.securityCallback==="function"){F=aa.securityCallback
}}

First, "if aa==='..' ", then "if(typeof aa.securityCallback==='function') ". First it's expected to be a string representing a directory I'm supposing, then it's treated as an object containing the function securityCallback.

And in the following lines "aa" is referred to continuously, but it's an object containing all the elements that I posted at the beginning of this post. 

It's expected to be a url string in line 887, but it's an object. This is where all the errors are being thrown. Lines 886-888:

if(aa===".."){af=s
}else{if(aa.charAt(0)=="/"){af=y(s,gadgets.rpc.getOrigin(window.location.href))
}}

I would highly recommend that the friendconnect team look into this. There needs to be some debugging of the code. If it's not a problem in the source code then it's a problem in the way the code is being compressed, there's probably some closure that's not being closed properly and "aa" (whatever that is in the source code) is being cast multiple times in the same context.

The lines that I refer to in this post are probably one line off (incrementally), because of me adding "console.log"s to the code.

Please look into this.

[John D'Orazio]

I wonder also if:

1 -> (but this is only a conjecture) the friendconnect.js script conflicts with firebug or with Chrome's inspector, 

OR

2-> whatever the "aa Object with no method charAt" errors are, they are tied to a drag /  move / position event,

BECAUSE:

when I reposition Chrome's inspector window at the bottom of the screen, the same "object with no method charAt" errors start firing very rapidly, with just one drag of the Inspector window frame they can go up to 80 - 120 errors.