Bug 44887

Summary: On <select>, setting reflected attribute size to negative number should throw exception
Product: WebKit Reporter: Aryeh Gregor <ayg>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: RESOLVED INVALID    
Severity: Minor CC: ahmad.saleem792, ap, bfulgham, rniwa, tabatkins, tkent
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Linux   
Attachments:
Description Flags
Proposed patch tkent: review-

Aryeh Gregor
Reported 2010-08-30 12:31:37 PDT
Spec: """ If a reflecting IDL attribute is an unsigned integer type (unsigned long) that is limited to only non-negative numbers greater than zero, . . . On setting, if the value is zero, the user agent must fire an INDEX_SIZE_ERR exception. """ http://www.whatwg.org/specs/web-apps/current-work/multipage/urls.html#reflecting-content-attributes-in-idl-attributes "The size IDL attribute is limited to only non-negative numbers greater than zero . . ." http://www.whatwg.org/specs/web-apps/current-work/multipage/the-button-element.html#dom-select-size Test case: <!doctype html> <script> var el = document.createElement("select"); try { el.size = 0; alert(el.size); } catch (e) { alert(e); } </script> Chrome dev on Ubuntu and Safari 5 on XP alert "1". Recentish Firefox nightly throws an exception per spec, Opera 10.60 and IE8 alert "0".
Attachments
Proposed patch (5.73 KB, patch)
2011-03-11 12:29 PST, Andreas Kling 		tkent: review-
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Andreas Kling
Comment 1 2011-03-11 12:29:49 PST
Created attachment 85512 [details] Proposed patch
Kent Tamura
Comment 2 2011-03-17 07:47:53 PDT
Andres, please see the discussion on Bug 43887.
Kent Tamura
Comment 3 2011-03-17 07:50:45 PDT
(In reply to comment #2) > Andres, please see the discussion on Bug 43887. Ah, this bug is not so related to Bug 43887. I'm sorry for the noise. Anyway, I think this change can make site compatibility issues, and we had better change the specification.
Aryeh Gregor
Comment 4 2011-03-17 10:38:51 PDT
Yeah, it turns out that the spec as written is not web-compatible: http://www.w3.org/Bugs/Public/show_bug.cgi?id=12288 The preexisting behavior in IE is to throw an exception on negative numbers but not on 0, and the preexisting behavior in all other browsers is to accept any value. The spec requires throwing an exception on negative numbers and on 0, which is not only probably not web-compatible, but also insane -- as Mounir points out, it means var select = document.createElement('select'); select.size = select.size; throws an exception. Mounir suggests that the spec be changed to match IE's behavior. If you think it should be changed to other browsers' behavior, it would be a good idea to comment on that bug.
Kent Tamura
Comment 5 2011-04-26 16:24:39 PDT
Comment on attachment 85512 [details] Proposed patch r- for comment #3 and #4.
Kent Tamura
Comment 6 2011-05-09 21:22:06 PDT
http://www.whatwg.org/specs/web-apps/current-work/multipage/the-button-element.html#dom-select-size The specification has been updated.
Aryeh Gregor
Comment 7 2011-05-11 15:33:54 PDT
Specifically, the spec now matches IE's behavior, so it still requires throwing on negative numbers -- just not 0. Firefox 4.0 now does this, in addition to IE, so it should be safe.
Ahmad Saleem
Comment 8 2022-08-06 07:31:45 PDT
From mentioned test cases in Comment 0, I changed into JSFiddle: Link - https://jsfiddle.net/japm72hv/show All browsers (Chrome Canary 106, Firefox Nightly 105 and Safari 15.6) throw "0" which was aligned with IE behavior mentioned in Comment 0. I think we can mark this as "RESOLVED CONFIGURATION CHANGED", if it is not aligned with spec still (to allow negative), appreciate if someone and can mark this bug accordingly. Link to Webkit Github source for HTMLSelectElement for setMultiple: https://github.com/WebKit/WebKit/blob/dd956d5e74249681ddf904e0bbe401f308b65e0f/Source/WebCore/html/HTMLSelectElement.cpp#L443
Sam Sneddon [:gsnedders]
Comment 9 2022-08-06 12:02:06 PDT
And this is well-tested in wpt /html/dom/reflection-forms.html (where we pass everything)
Note You need to log in before you can comment on or make changes to this bug.