Bug 1059030 - Do not crash when an element has the same @id as a @name of a radiogroup. r=bz, a=bkerensa
authorGiovanni Sferro <agi.novanta@gmail.com>
Mon, 06 Oct 2014 21:51:00 -0400
changeset 200514 766a8abd842fab2ae599f8499ae380e38f7ae6d6
parent 200513 db219b061ce240b0e38e84e08b031b21a7e7adbd
child 200515 7788753adc658a85336f6c03806d43d24d456240
push id167
push userryanvm@gmail.com
push dateFri, 16 Jan 2015 14:42:58 +0000
treeherdermozilla-esr31@413dc6c6f4ad [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz, bkerensa
bugs1059030
milestone31.4.0
Bug 1059030 - Do not crash when an element has the same @id as a @name of a radiogroup. r=bz, a=bkerensa
content/html/content/src/HTMLFormElement.cpp
content/html/content/test/forms/test_input_radio_radiogroup.html
--- a/content/html/content/src/HTMLFormElement.cpp
+++ b/content/html/content/src/HTMLFormElement.cpp
@@ -2051,24 +2051,25 @@ HTMLFormElement::GetNextRadioButton(cons
       if (--index < 0) {
         index = numRadios -1;
       }
     }
     else if (++index >= (int32_t)numRadios) {
       index = 0;
     }
     radio = HTMLInputElement::FromContentOrNull(radioGroup->Item(index));
-    if (!radio)
+    isRadio = radio && radio->GetType() == NS_FORM_INPUT_RADIO;
+    if (!isRadio) {
       continue;
+    }
 
-    isRadio = radio->GetType() == NS_FORM_INPUT_RADIO;
-    if (!isRadio)
-      continue;
-
-  } while ((radio->Disabled() && radio != currentRadio) || !isRadio);
+    nsAutoString name;
+    radio->GetName(name);
+    isRadio = aName.Equals(name);
+  } while (!isRadio || (radio->Disabled() && radio != currentRadio));
 
   NS_IF_ADDREF(*aRadioOut = radio);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLFormElement::WalkRadioGroup(const nsAString& aName,
                                 nsIRadioVisitor* aVisitor,
--- a/content/html/content/test/forms/test_input_radio_radiogroup.html
+++ b/content/html/content/test/forms/test_input_radio_radiogroup.html
@@ -9,35 +9,62 @@ https://bugzilla.mozilla.org/show_bug.cg
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
 <body>
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=343444">Mozilla Bug 343444</a>
 <p id="display"></p>
 <form>
-  <input type="radio" name="testradio" id="start"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="radio" name="testradio"></input>
-  <input type="text"  name="testradio"></input>
+  <fieldset id="testradio">
+    <input type="radio" name="testradio" id="start"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="radio" name="testradio"></input>
+    <input type="text"  name="testradio"></input>
+  </fieldset>
+
+  <fieldset>
+    <input type="radio" name="testtwo" id="start2"></input>
+    <input type="radio" name="testtwo"></input>
+    <input type="radio" name="error" id="testtwo"></input>
+    <input type="radio" name="testtwo" id="end"></input>
+  </fieldset>
+
+  <fieldset>
+    <input type="radio" name="testthree" id="start3"></input>
+    <input type="radio" name="errorthree" id="testthree"></input>
+  </fieldset>
 </form>
 <script class="testbody" type="text/javascript">
 /** Test for Bug 343444 **/
 document.getElementById("start").focus();
 var count=0;
 while (count < 2) {
   sendKey("DOWN");
-  ok(document.activeElement.type == "radio", "radioGroup should ignore non-radio input fields");
+  is(document.activeElement.type, "radio", "radioGroup should ignore non-radio input fields");
   if (document.activeElement.id == "start") {
     count++;
   }
 }
+
+document.getElementById("start2").focus();
+count = 0;
+while (count < 3) {
+  is(document.activeElement.name, "testtwo",
+     "radioGroup should only contain elements with the same @name")
+  sendKey("DOWN");
+  count++;
+}
+
+document.getElementById("start3").focus();
+sendKey("DOWN");
+is(document.activeElement.name, "testthree", "we don't have an infinite-loop");
 </script>
 </pre>
 </body>
 </html>