Expando Collision Possible With noConflict()

[SlexAxton]

If a page has two copies of jQuery, the jQuery expando property can still collide between these two copies even if noConflict is called. This has always been the case, but it hasn't really been feasible until some of the new V8 builds.

The expando is based off of the current millisecond:

var expando = "jQuery" + now()

This reference is available on the jQuery object, but private references exist, so it's not entirely patchable at this point, from the outside.

This would presumably be bad anywhere that unique expandos are necessary.

Test Case Here: ​http://jsbin.com/ifone

Proof that it's getting too close to ignore: ​http://slexaxton.com/pix/afe1.png

[john]

Any suggestions as to an alternative? The random number generator may get us part of the way there - but I don't like having a continued random chance of a collision happening.

It might also be worthwhile to change the 'jQuery' bit to something like 'jq' + jQuery.fn.jquery to help differentiate between versions of jQuery.

[SlexAxton]

Replying to john:

Any suggestions as to an alternative? The random number generator may get us part of the way there - but I don't like having a continued random chance of a collision happening.

It might also be worthwhile to change the 'jQuery' bit to something like 'jq' + jQuery.fn.jquery to help differentiate between versions of jQuery.

This really only matters during the use of noConflict (otherwise a lot more than this can conflict...), so perhaps changing up noConflict a bit to accept a custom expando prefix.

var my$ = jQuery.noConflict(true, 'mycoolprefix');

valid option?

[cowboy]

You could do something like this, instead of var expando = "jQuery" + now():

var jq = window.jQuery || window.$,
  expando = "jQuery" + (
    ( jq && jq.expando && +jq.expando.replace( /\D/g, "" ) || 0 ) + 1
  );

[SlexAxton]

I'd love for the solution to not be susceptible to collisions, even though they are even more rare than this one.

The problem with your solution, Ben, is that if someone has done noConflict(true), then a conflict is still possible. That's pretty rare, but I have run into it.

[SlexAxton]

I have submitted a patch for this on github: ​http://github.com/jquery/jquery/pull/29

[SlexAxton]

The most recent pull request after github discussion is here:

​https://github.com/jquery/jquery/pull/50

[Alex Sexton]

Changed the expando string to use a random number instead of the time, so collisions become less likely. Also added jQuery version to instantly differentiate separate versions of jQuery (a common use case for noConflict, etc, when two jQuery instances are on the page). Fixes #6842.

Changeset: faabb2c31883deabaddd5642eb5e708b5802f2b0

[Alex Sexton]

Changed the expando string to use a random number instead of the time, so collisions become less likely. Also added jQuery version to instantly differentiate separate versions of jQuery (a common use case for noConflict, etc, when two jQuery instances are on the page). Fixes #6842.

Changeset: faabb2c31883deabaddd5642eb5e708b5802f2b0