Bug 862084 - Mark HTMLSelectElement.{item,namedItem} as potentially returning null to fix a crash; r=bz
authorMs2ger <ms2ger@gmail.com>
Sun, 21 Apr 2013 08:41:54 +0200
changeset 141142 2c13322af7766afd03d2255576b38668f067a562
parent 141141 ffd56766e73d013a7c196882bb9294d692049850
child 141143 0d2e8dcbec44ddb883c613c5b331b174fafd0600
push id350
push userbbajaj@mozilla.com
push dateMon, 29 Jul 2013 23:00:49 +0000
treeherdermozilla-release@064965b37dbd [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbz
bugs862084
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 862084 - Mark HTMLSelectElement.{item,namedItem} as potentially returning null to fix a crash; r=bz
content/html/content/crashtests/862084.html
content/html/content/crashtests/crashtests.list
dom/webidl/HTMLSelectElement.webidl
new file mode 100644
--- /dev/null
+++ b/content/html/content/crashtests/862084.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<select></select>
+<script>
+var select = document.getElementsByTagName("select");
+select.item(0);
+select[0];
+select.namedItem("x")
+select["x"]
+</script>
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@@ -45,9 +45,9 @@ load 795221-5.xml
 load 798802-1.html
 load 811226.html
 load 819745.html
 pref(dom.experimental_forms,true) load 828472.html
 load 828180.html
 load 832011.html
 load 837033.html
 pref(dom.experimental_forms_range,true) load 838256-1.html
-
+load 862084.html
--- a/dom/webidl/HTMLSelectElement.webidl
+++ b/dom/webidl/HTMLSelectElement.webidl
@@ -25,19 +25,19 @@ interface HTMLSelectElement : HTMLElemen
 
   [Pure]
   readonly attribute DOMString type;
 
   [Constant]
   readonly attribute HTMLOptionsCollection options;
   [SetterThrows, Pure]
            attribute unsigned long length;
-  getter Element item(unsigned long index);
+  getter Element? item(unsigned long index);
   [Throws]
-  object namedItem(DOMString name);
+  object? namedItem(DOMString name);
   [Throws]
   void add((HTMLOptionElement or HTMLOptGroupElement) element, optional (HTMLElement or long)? before = null);
   void remove(long index);
   [Throws]
   setter creator void (unsigned long index, HTMLOptionElement? option);
 
 // NYI:  readonly attribute HTMLCollection selectedOptions;
   [SetterThrows, Pure]