Bug 105775 – [JSC] REGRESSION(r135093): A form control with name=length overrides length property on form.elements

• Status: RESOLVED
• Resolution: FIXED
• Component: Forms

[Ryosuke Niwa]

Named getters should not override builtin properties on HTMLCollection and any of their subclasses as specified by DOM4:
http://www.w3.org/TR/2012/WD-dom-20121206/#interface-htmlcollection

and HTML5:
http://www.whatwg.org/specs/web-apps/current-work/multipage/common-dom-interfaces.html#collections-0

<rdar://problem/12929985>

[Ryosuke Niwa]

Created attachment 180762 [details]
Demo

[Sam Weinig]

Oh, thanks for filing this Ryosuke.  When I made the reduction, I meant to file it but forgot :(.

[Ryosuke Niwa]

Quoting Sam:

It looks like the issue is that in JSHTMLFormControlsCollection::getOwnPropertySlot, we are looking up in the name getter before we have a chance to lookup the "length" builtin propert.  This was not an issue when we returned an HTMLCollection, because HTMLCollection is the interface that contains a length property, so the early call to:

    const HashEntry* entry = JSHTMLFormControlsCollectionTable.entry(exec, propertyName);
    if (entry) {
        slot.setCustom(thisObject, entry->propertyGetter());
        return true;
    }

(which in HTMLCollection replaces JSHTMLFormControlsCollectionTable with JSHTMLCollectionTable) gets the length property.  

The fix is probably to make that call also chain up to any parents (as is done in getStaticValueSlot), or just to move the call to getStaticValueSlot earlier.  I say probably, as we should test what other browsers do and make sure this in line with WebIDL.

[Ryosuke Niwa]

Created attachment 182031 [details]
Fixes the bug

[WebKit Review Bot]

Attachment 182031 [details] did not pass style-queue:

Failed to run "['Tools/Scripts/check-webkit-style', '--diff-files', u'LayoutTests/ChangeLog', u'LayoutTests/fast..." exit_code: 1
Source/WebCore/ChangeLog:16:  Line contains tab character.  [whitespace/tab] [5]
Total errors found: 1 in 6 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Ryosuke Niwa]

Committed r139278: <http://trac.webkit.org/changeset/139278>