Summary: | Acid3 reveals HTMLFormElement.elements fails to update when element name changes | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Eric Seidel (no email) <eric> | ||||
Component: | DOM | Assignee: | Darin Adler <darin> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | adele, ap, sam | ||||
Priority: | P2 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Mac | ||||||
OS: | OS X 10.4 | ||||||
Attachments: |
|
Description
Eric Seidel (no email)
2007-12-28 02:21:10 PST
The problem is JSNamedNodesCollection. It caches the nodes at time of creation, and then it's not gone from the DOM cache until a GC. Meaning if any of the nodes change, it's stale. We'll probably move to something more like a NodeList. (In reply to comment #1) > The problem is JSNamedNodesCollection. It caches the nodes at time of > creation, and then it's not gone from the DOM cache until a GC. Meaning if any > of the nodes change, it's stale. We'll probably move to something more like a > NodeList. I don't think that analysis is correct. Each call to "second" will create a unique JSNamedNodesCollection. The bug here is presumably something in HTMLCollection, not the DOM binding. Perhaps nameCache is not getting invalidated. Perhaps the DOM tree version isn't getting updated when the name is changed. This bug is specific to an HTMLFormElement that is not currently in its owner document. The bug is in the document's DOMTreeVersion mechanism. It only increments if the node is in the document. But the form collection works even for forms that are not "in" the document. The best fix for this is to remove the inDocument() checks at all the call sites for incDOMTreeVersion. Created attachment 18220 [details]
patch
Comment on attachment 18220 [details]
patch
r=me
Committed revision 29053. |