document.all("id") doesn't create a collection that supports indexing with round braces

[jasneet]

I Steps:
Go to 
http://bf.sina.com.cn/sinarc_php/piclist.php?aid=105&from=403

II Issue:
In the left nav bar, try to click on "+" or "-". the tree doesn't expand or collapse on clicking + or -

III Conclusion:
Webkit doesn't create an array for all the elements found for the  "id" in document.all("id")

IV Other browsers:
IE7: ok
FF3: not ok
Opera9.24: ok

V Nightly tested: 31386

[jasneet]

Created attachment 20174 [details]
reduction

[Cameron Zwarich (cpst)]

This is not a bug about JS arrays, it is about DOM collections. Geoff mentioned that we have added this for other collections.

[Sam Weinig]

Interesting.  JSHTMLAllCollection inherits from JSHTMLCollection which implements the funky IE emulating call notation.  I wonder why it is not getting hit.

[Cameron Zwarich (cpst)]

This is a pretty bizarre bug. I can verify with GDB that the correct code in JSHTMLCollection is being called from JITStubs::cti_op_call_NotJSFunction() and a correct value is being returned, but it also reenters JITStubs::cti_op_call_NotJSFunction() and then thinks that the value is not a function.

[Cameron Zwarich (cpst)]

Oh, I was just misreading things because I was tired. Doing document.all returns a JSHTMLAllCollection, and indexing by id in that collection returns a JSNamedNodesCollection, which does not support the function call syntax.

[Sam Weinig]

Ah, I made the same mistake as well.  I thought the bug was in the HTMLAllCollection not supporting call notation.

[Anne van Kesteren]

No browser alive passes the reduced test case so changing this would almost definitely be counterproductive at this point.