# Bug Report — 2026-04-16

## Critical Bugs

| # | File | Line | Issue |
|---|------|------|-------|
| 1 | `core/AppOne.js` | 68 | `Ctrl.name` accessed inside `if (!Ctrl)` — `Ctrl` is null/undefined here, so this crashes instead of showing the intended error message |
| 2 | `core/lib/HTTPClient.js` | 218 | `new URL(url, answer.res.headers.location)` — arguments are **reversed**; should be `new URL(location, url)` |
| 3 | `core/lib/HTTPClientFetch.js` | 162 | Same reversed `new URL()` argument order as above |
| 4 | `core/lib/BrowserStorage.js` | 26 | `value === NaN` is **always false** — NaN is never equal to itself; needs `isNaN(value)` |
| 5 | `core/lib/HTTPClient.js` | 492 | `splited[1].trim()` — no null check; crashes on malformed headers |
| 6 | `core/lib/HTTPClientFetch.js` | 359 | Same `splited[1].trim()` crash risk as above |

## Logic Errors

| # | File | Line | Issue |
|---|------|------|-------|
| 7 | `core/mvc/View.js` | 60 | `elem.nextSibling.setAttribute(...)` — no null check; `nextSibling` can be `null` or a text node |
| 8 | `core/mvc/Dd.js` | 685 | Inverted condition: `if (!elem.getAttribute('style')) { removeAttribute(...) }` — removes when style is **absent**, not when present |
| 9 | `core/misc/Router.js` | 235 | `split('=')` loses data when query value contains `=` (e.g. base64 tokens); should use `split('=', 2)` or split with limit |
| 10 | `core/misc/Router.js` | 237 | `eqParts[1]` can be `undefined` for query params without values (e.g. `?key`) |
| 11 | `core/misc/Router.js` | 209 | `.indexOf('.')` called without checking if `value` is a string — crashes on non-strings |

## Minor / Dead Code

| # | File | Line | Issue |
|---|------|------|-------|
| 12 | `core/lib/Form.js` | 54 | `val?.includes()` — `.includes()` called on potentially non-array; should add `Array.isArray(val)` guard |
| 13 | `core/lib/Form.js` | 224, 290 | `if (!elems)` after `querySelectorAll()` — **unreachable** dead code; `querySelectorAll` never returns null |
| 14 | `core/mvc/Auxiliary.js` | 557 | `val += ctrlVal` where `ctrlVal` can be `undefined` — produces `"text undefined"` strings |
| 15 | `core/mvc/DdListeners.js` | 177 | Debug message says `dd-set` but the attribute is `dd-model` |