Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Changing Object.prototype causes MathJax to crash #352

Tr0pe opened this issue Nov 13, 2012 · 3 comments


None yet
3 participants
Copy link

commented Nov 13, 2012

If attribute is added to Object.prototype in <head> section of HTML the MathJax will throw an error h.replace is not a function on the other hand adding attribute to Object.prototype in <body> will cause MathJax to produce: [Math Processing Error].


    <script>Object.prototype.a = function() {};</script>
    <script type="text/javascript" src=""></script>

This comment has been minimized.

Copy link

commented Nov 13, 2012

OK, thanks for the report. It turns out that there is a missing check for hasOwnProperty in the file-loading code, and that is what was causing the problem when additional method were added to the Object prototype. I will fix it in the next release.

In the meantime, you can use

<script type="text/x-mathjax-config">
MathJax.Ajax.Load = function (file,callback) {
  callback = MathJax.Callback(callback); var type;
  if (file instanceof Object) {
    for (var i in file)
      {if (file.hasOwnProperty(i)) {type = i.toUpperCase(); file = file[i]}}
  } else {type = file.split(/\./).pop().toUpperCase()}
  file = this.fileURL(file);
  if (this.loading[file]) {this.addHook(file,callback)} else {
    if (!this.head)
      {this.head = document.head||(document.getElementsByTagName("head"))[0]||document.body}
    if (this.loader[type]) {this.loader[type].call(this,file,callback)}
      else {throw Error("Can't load files of type "+type)}
  return callback;
<script type="text/javascript" src=""></script>

to load MathJax, and it will patch the problem. Since the issue is in the file-loading code and that code is used to load configuration files, you can't load the configuration file until after the patch is applied. That means you can't use the config=... option in the script the loads MathJax since that file is loaded before the text/x-mathjax-config blocks are executed. So we put the configuration file into the config array in the code sample above. That also means you have to have this code in-line in your file and can't put it into a separate configuration file (since file loading is what is affected).

The alternative would be to put off your Object modification until the so that the initial configuration file is loaded properly before that. Then you could use a configuration file of your own to store this patch. In that case, leave out the MathJax.Hub.Config call above.

dpvc pushed a commit to dpvc/MathJax that referenced this issue Nov 27, 2012

Davide P. Cervone
Use hasOwnProperty() when checking file specification object (prevent…
…s problems when Object.prototype has been modified). Resolves issue mathjax#352.

This comment has been minimized.

Copy link

commented Nov 27, 2012

The issue352 branch of my fork of MathJax should resolve this.


This comment has been minimized.

Copy link

commented Jan 5, 2013

@Tr0pe: thanks for the test case.

I'll integrate the test in my test commit:


I've verified the fix with Opera, Chrome and Firefox.

dpvc pushed a commit to dpvc/MathJax that referenced this issue Mar 20, 2013

@dpvc dpvc closed this May 17, 2013

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.