Bug 877910 - Make HTMLSelectElement.namedItem return 'HTMLOptionElement' instead of 'object'. r=bz, a=lsblakk
authorMs2ger <ms2ger@gmail.com>
Sat, 01 Jun 2013 08:56:34 +0200
changeset 138643 a88c283671505acb7c09a2f2c7f9f18bbe6b05ba
parent 138642 9005eaf15285985eeb3fb0c5269076cb97300c0c
child 138644 392aa014b5286ccbb2a9e2fa52b70e06fcc6d5c2
push id3835
push userryanvm@gmail.com
push dateTue, 04 Jun 2013 01:26:28 +0000
treeherdermozilla-aurora@536e5dd30998 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz, lsblakk
bugs877910
milestone23.0a2
Bug 877910 - Make HTMLSelectElement.namedItem return 'HTMLOptionElement' instead of 'object'. r=bz, a=lsblakk
content/html/content/crashtests/877910.html
content/html/content/crashtests/crashtests.list
content/html/content/src/HTMLOptionsCollection.cpp
content/html/content/src/HTMLOptionsCollection.h
content/html/content/src/HTMLSelectElement.h
dom/webidl/HTMLSelectElement.webidl
new file mode 100644
--- /dev/null
+++ b/content/html/content/crashtests/877910.html
@@ -0,0 +1,1 @@
+<select><option id="foo"><script>document.querySelector("select").namedItem("foo")</script>
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@@ -47,8 +47,9 @@ load 811226.html
 load 819745.html
 pref(dom.experimental_forms,true) load 828472.html
 load 828180.html
 load 832011.html
 load 837033.html
 pref(dom.experimental_forms_range,true) load 838256-1.html
 load 862084.html
 load 865147.html
+load 877910.html
--- a/content/html/content/src/HTMLOptionsCollection.cpp
+++ b/content/html/content/src/HTMLOptionsCollection.cpp
@@ -242,23 +242,22 @@ HTMLOptionsCollection::Item(uint32_t aIn
 }
 
 Element*
 HTMLOptionsCollection::GetElementAt(uint32_t aIndex)
 {
   return ItemAsOption(aIndex);
 }
 
-static HTMLOptionElement*
-GetNamedItemHelper(nsTArray<nsRefPtr<HTMLOptionElement> > &aElements,
-                   const nsAString& aName)
+HTMLOptionElement*
+HTMLOptionsCollection::GetNamedItem(const nsAString& aName) const
 {
-  uint32_t count = aElements.Length();
+  uint32_t count = mElements.Length();
   for (uint32_t i = 0; i < count; i++) {
-    HTMLOptionElement* content = aElements.ElementAt(i);
+    HTMLOptionElement* content = mElements.ElementAt(i);
     if (content &&
         (content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name, aName,
                               eCaseMatters) ||
          content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::id, aName,
                               eCaseMatters))) {
       return content;
     }
   }
@@ -271,26 +270,26 @@ HTMLOptionsCollection::GetParentObject()
 {
   return mSelect;
 }
 
 NS_IMETHODIMP
 HTMLOptionsCollection::NamedItem(const nsAString& aName,
                                  nsIDOMNode** aReturn)
 {
-  NS_IF_ADDREF(*aReturn = GetNamedItemHelper(mElements, aName));
+  NS_IF_ADDREF(*aReturn = GetNamedItem(aName));
 
   return NS_OK;
 }
 
 JSObject*
 HTMLOptionsCollection::NamedItem(JSContext* cx, const nsAString& name,
                                  ErrorResult& error)
 {
-  nsINode* item = GetNamedItemHelper(mElements, name);
+  nsINode* item = GetNamedItem(name);
   if (!item) {
     return nullptr;
   }
   JS::Rooted<JSObject*> wrapper(cx, nsWrapperCache::GetWrapper());
   JSAutoCompartment ac(cx, wrapper);
   JS::Rooted<JS::Value> v(cx);
   if (!mozilla::dom::WrapObject(cx, wrapper, item, item, nullptr,
                                 v.address())) {
--- a/content/html/content/src/HTMLOptionsCollection.h
+++ b/content/html/content/src/HTMLOptionsCollection.h
@@ -116,16 +116,17 @@ public:
    * @param aStartIndex the index to start looking at
    * @param aForward TRUE to look forward, FALSE to look backward
    * @return the option index
    */
   nsresult GetOptionIndex(Element* aOption,
                           int32_t aStartIndex, bool aForward,
                           int32_t* aIndex);
 
+  HTMLOptionElement* GetNamedItem(const nsAString& aName) const;
   virtual JSObject* NamedItem(JSContext* aCx, const nsAString& aName,
                               ErrorResult& error);
 
   void Add(const HTMLOptionOrOptGroupElement& aElement,
            const Nullable<HTMLElementOrLong>& aBefore,
            ErrorResult& aError);
   void Remove(int32_t aIndex, ErrorResult& aError);
   int32_t GetSelectedIndex(ErrorResult& aError);
--- a/content/html/content/src/HTMLSelectElement.h
+++ b/content/html/content/src/HTMLSelectElement.h
@@ -200,20 +200,19 @@ public:
   Element* IndexedGetter(uint32_t aIdx, bool& aFound) const
   {
     return mOptions->IndexedGetter(aIdx, aFound);
   }
   HTMLOptionElement* Item(uint32_t aIdx) const
   {
     return mOptions->ItemAsOption(aIdx);
   }
-  JSObject* NamedItem(JSContext* aCx, const nsAString& aName,
-                      ErrorResult& aRv) const
+  HTMLOptionElement* NamedItem(const nsAString& aName) const
   {
-    return mOptions->NamedItem(aCx, aName, aRv);
+    return mOptions->GetNamedItem(aName);
   }
   void Add(const HTMLOptionElementOrHTMLOptGroupElement& aElement,
            const Nullable<HTMLElementOrLong>& aBefore,
            ErrorResult& aRv);
   // Uses XPCOM Remove.
   void IndexedSetter(uint32_t aIndex, HTMLOptionElement* aOption,
                      ErrorResult& aRv)
   {
--- a/dom/webidl/HTMLSelectElement.webidl
+++ b/dom/webidl/HTMLSelectElement.webidl
@@ -26,18 +26,17 @@ interface HTMLSelectElement : HTMLElemen
   [Pure]
   readonly attribute DOMString type;
 
   [Constant]
   readonly attribute HTMLOptionsCollection options;
   [SetterThrows, Pure]
            attribute unsigned long length;
   getter Element? item(unsigned long index);
-  [Throws]
-  object? namedItem(DOMString name);
+  HTMLOptionElement? namedItem(DOMString name);
   [Throws]
   void add((HTMLOptionElement or HTMLOptGroupElement) element, optional (HTMLElement or long)? before = null);
   void remove(long index);
   [Throws]
   setter creator void (unsigned long index, HTMLOptionElement? option);
 
 // NYI:  readonly attribute HTMLCollection selectedOptions;
   [SetterThrows, Pure]