Bug 1059030 - Do not crash when an element has the same @id as a @name of a radiogroup. r=bz
authorGiovanni Sferro <agi.novanta@gmail.com>
Mon, 06 Oct 2014 21:51:00 -0400
changeset 209160 9e7dff9e44045775d6e852d4d249346dc2290aa9
parent 209159 5884c9f92f3d4e8503f02319c9bf6472185530d9
child 209161 33b673fb5f993d18009f638f4ba13e8fe2f51c74
push id1
push userroot
push dateMon, 20 Oct 2014 17:29:22 +0000
reviewersbz
bugs1059030
milestone35.0a1
Bug 1059030 - Do not crash when an element has the same @id as a @name of a radiogroup. r=bz
content/html/content/src/HTMLFormElement.cpp
content/html/content/test/forms/test_input_radio_radiogroup.html
--- a/content/html/content/src/HTMLFormElement.cpp
+++ b/content/html/content/src/HTMLFormElement.cpp
@@ -2062,24 +2062,25 @@ HTMLFormElement::GetNextRadioButton(cons
       if (--index < 0) {
         index = numRadios -1;
       }
     }
     else if (++index >= (int32_t)numRadios) {
       index = 0;
     }
     radio = HTMLInputElement::FromContentOrNull(radioGroup->Item(index));
-    if (!radio)
+    isRadio = radio && radio->GetType() == NS_FORM_INPUT_RADIO;
+    if (!isRadio) {
       continue;
+    }
 
-    isRadio = radio->GetType() == NS_FORM_INPUT_RADIO;
-    if (!isRadio)
-      continue;
-
-  } while ((radio->Disabled() && radio != currentRadio) || !isRadio);
+    nsAutoString name;
+    radio->GetName(name);
+    isRadio = aName.Equals(name);
+  } while (!isRadio || (radio->Disabled() && radio != currentRadio));
 
   NS_IF_ADDREF(*aRadioOut = radio);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLFormElement::WalkRadioGroup(const nsAString& aName,
                                 nsIRadioVisitor* aVisitor,
--- a/content/html/content/test/forms/test_input_radio_radiogroup.html
+++ b/content/html/content/test/forms/test_input_radio_radiogroup.html
@@ -9,35 +9,62 @@ https://bugzilla.mozilla.org/show_bug.cg
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=343444">Mozilla Bug 343444</a>
 <p id="display"></p>
 <form>
-  <input type="radio" name="testradio" id="start"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
+  <fieldset id="testradio">
+    <input type="radio" name="testradio" id="start"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+  </fieldset>
+
+  <fieldset>
+    <input type="radio" name="testtwo" id="start2"></input>
+    <input type="radio" name="testtwo"></input>
+    <input type="radio" name="error" id="testtwo"></input>
+    <input type="radio" name="testtwo" id="end"></input>
+  </fieldset>
+
+  <fieldset>
+    <input type="radio" name="testthree" id="start3"></input>
+    <input type="radio" name="errorthree" id="testthree"></input>
+  </fieldset>
 </form>
 <script class="testbody" type="text/javascript">
 /** Test for Bug 343444 **/
 document.getElementById("start").focus();
 var count=0;
 while (count < 2) {
   sendKey("DOWN");
-  ok(document.activeElement.type == "radio", "radioGroup should ignore non-radio input fields");
+  is(document.activeElement.type, "radio", "radioGroup should ignore non-radio input fields");
   if (document.activeElement.id == "start") {
     count++;
   }
 }
+
+document.getElementById("start2").focus();
+count = 0;
+while (count < 3) {
+  is(document.activeElement.name, "testtwo",
+     "radioGroup should only contain elements with the same @name")
+  sendKey("DOWN");
+  count++;
+}
+
+document.getElementById("start3").focus();
+sendKey("DOWN");
+is(document.activeElement.name, "testthree", "we don't have an infinite-loop");
 </script>
 </pre>
 </body>
 </html>