aa variable is being overwritten multiple times in the source code of friendconnect.js

Skip to first unread message

John D'Orazio

Jun 28, 2011, 10:36:58 AM6/28/11
to google-friend-co...@googlegroups.com
It's hard to debug the friendconnect.js script because it's compressed, I don't know of an svn or a github repository...
But seeing that the "charAt" errors continue without being corrected I decided to take a shot at a little bit of debugging.
I've copied the code in local and put some breakpoints.

There's an "aa" variable that is being overwritten a few times. First it's defined as a function, then as an array, then as a string representing a url...

So when it's supposed to be representing a url string as in line 880:
it's actually an object, which is why it's generating the error

Uncaught TypeError: Object #<Object> has no method 'charAt'
If I do a "console.log(aa)" at line 880, this is what I get:

  1. aArray[1]
    1. 0"resize"
    2. length1
    3. __proto__Array[0]
      1. concatfunction concat() { [native code] }
      2. constructorfunction Array() { [native code] }
      3. everyfunction every() { [native code] }
      4. filterfunction filter() { [native code] }
      5. forEachfunction forEach() { [native code] }
      6. indexOffunction indexOf() { [native code] }
        1. argumentsnull
        2. callernull
        3. length1
        4. name"indexOf"
        5. __proto__function Empty() {}
      7. joinfunction join() { [native code] }
      8. lastIndexOffunction lastIndexOf() { [native code] }
      9. length0
      10. mapfunction map() { [native code] }
      11. popfunction pop() { [native code] }
      12. pushfunction push() { [native code] }
      13. reducefunction reduce() { [native code] }
      14. reduceRightfunction reduceRight() { [native code] }
      15. reversefunction reverse() { [native code] }
      16. shiftfunction shift() { [native code] }
      17. slicefunction slice() { [native code] }
      18. somefunction some() { [native code] }
      19. sortfunction sort() { [native code] }
      20. splicefunction splice() { [native code] }
      21. toLocaleStringfunction toLocaleString() { [native code] }
      22. toStringfunction toString() { [native code] }
      23. unshiftfunction unshift() { [native code] }
      24. __proto__Object
  2. c0
  3. f"gfc_iframe_1642769180_0"
  4. lfalse
  5. origin"http://p7rjrrl49ose4gob99eonlvp0drmce3d-a-fc-opensocial.googleusercontent.com"
  6. referer"http://p7rjrrl49ose4gob99eonlvp0drmce3d-a-fc-opensocial.googleusercontent.com"
  7. s"subscribeEventType"
  8. t"443731538"
  9. __proto__Object
So it's clearly not representing a url querystring!

If you look at the source code, at line 716 we have:

var O=(function(){function aa(ab){return function(){S(ab+": call ignored")
So here "aa" is a function.

At line 729 we have:

var aa=A[af]||[];
If I do a console.log(A[af]), we have an "undefined", so "aa" is becoming an array here (if not A[af] then [] array).

And I don't really understand what the code is trying to do in the following lines. If in fact "aa" is becoming an empty array in line 729, then:
var aa=A[af]||[];
for(var ac=0;
++ac){var ae=aa[ac];
In line 730 we have a for cycle, which has the condition "do until ac<aa.length". But guess what, if "aa" is an empty array then this cycle won't take place will it. I'm supposing that's the desired behaviour, but maybe it could take a double-check...

In line 739 "aa" is being defined as a function again:
function aa(){E=true}
In line 763 "aa" is cast as "o[ae.s] else o[P]":
var aa=(o[ae.s]||o[P]).apply(ae,ae.a);
When I console.log o[ae.s] and o[P], I see that they are both functions.
So "aa" is being defined as another function.

In line 771 "aa" is cast as "as.indexOf('/')":
var aa=ad.indexOf("/");
In line 791 "aa" is cast as a window frame:
var aa=window.frames[ac];
In line 793 "aa" is cast as a DOM element:
And I'm supposing that "ac" is a frame because in line 794 we have "if aa && aa.contentWindow".
Well, I console.logged document.getElementById(ac), but there was no log, so I'm supposing it's within an if statement that is not verifying as true...

In line 798 "aa" is cast as "L(ad)". Console.log(L(ad)) returns a url:
In line 832 "aa" is cast as "T[ab]". Console.log(T[ab]) gives:
And in the following lines we have string operations that have to do with "aa" and the value of "aa".

In lines 869-874, "aa" is being treated as both a string and an object:
function h(aa,ac,ae,ad){if(aa===".."){var ab=ae||e.rpctoken||e.ifpctok||"";
}}return{config:function(aa){if(typeof aa.securityCallback==="function"){F=aa.securityCallback
First, "if aa==='..' ", then "if(typeof aa.securityCallback==='function') ". First it's expected to be a string representing a directory I'm supposing, then it's treated as an object containing the function securityCallback.

And in the following lines "aa" is referred to continuously, but it's an object containing all the elements that I posted at the beginning of this post. 

It's expected to be a url string in line 887, but it's an object. This is where all the errors are being thrown. Lines 886-888:
I would highly recommend that the friendconnect team look into this. There needs to be some debugging of the code. If it's not a problem in the source code then it's a problem in the way the code is being compressed, there's probably some closure that's not being closed properly and "aa" (whatever that is in the source code) is being cast multiple times in the same context.

The lines that I refer to in this post are probably one line off (incrementally), because of me adding "console.log"s to the code.

Please look into this.

John D'Orazio

Jun 28, 2011, 2:00:24 PM6/28/11
to google-friend-co...@googlegroups.com
I wonder also if:

1 -> (but this is only a conjecture) the friendconnect.js script conflicts with firebug or with Chrome's inspector, 


2-> whatever the "aa Object with no method charAt" errors are, they are tied to a drag /  move / position event,


when I reposition Chrome's inspector window at the bottom of the screen, the same "object with no method charAt" errors start firing very rapidly, with just one drag of the Inspector window frame they can go up to 80 - 120 errors.
Reply all
Reply to author
0 new messages