Bug 118139 – NodeList allows element IDs to override standard DOM accessor

• Component: DOM
• Status: RESOLVED FIXED

[Chris Adams]

As per DOM 1-3, NodeLists are accessed by index using the item() method. As tested in Safari and Chrome, the WebKit browsers have an undocumented feature which also allows property-style access based on the element IDs which would be a minor curiosity except that it breaks the item() accessor if the NodeList happens to contain element with the ID "item".

This test page shows that this behaviour is specific to Chrome and Safari; Firefox and IE8-10 follow the standard behaviour:

http://jsbin.com/ihofev/2/

[Chris Adams]

Chrome fixed this bug at some point in the past year

[Andreas Kling]

Looks like the issue here is that item() is on NodeList's prototype, so by overriding "item" on an instance of NodeList, we choose that instead of looking into the prototype chain.

I think the fix here is to let the prototype chain take precedence over named getters.

[Ryosuke Niwa]

Chris, didn't we fix this bug?

[Chris Dumez]

Result in Safari 9:
typeof(document.querySelectorAll("li").item)) = object
nodelist length 2
nodelist[1] [object HTMLLIElement]

Result in Safari Technology preview:
typeof(document.querySelectorAll("li").item)) = function
nodelist length 2
nodelist[1] [object HTMLLIElement]

Result in Firefox 45:
typeof(document.querySelectorAll("li").item)) = function
nodelist length 2
nodelist[1] [object HTMLLIElement]

Result in Chrome 49:
typeof(document.querySelectorAll("li").item)) = function
nodelist length 2
nodelist[1] [object HTMLLIElement]

So it looks to me that the bug was fixed in Safari 9 already and that all browsers are fully aligned on this test starting with Safari Technology preview.