Bug 118139 - NodeList allows element IDs to override standard DOM accessor
Summary: NodeList allows element IDs to override standard DOM accessor
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-06-27 08:34 PDT by Chris Adams
Modified: 2016-04-11 08:25 PDT (History)
6 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Adams 2013-06-27 08:34:42 PDT
As per DOM 1-3, NodeLists are accessed by index using the item() method. As tested in Safari and Chrome, the WebKit browsers have an undocumented feature which also allows property-style access based on the element IDs which would be a minor curiosity except that it breaks the item() accessor if the NodeList happens to contain element with the ID "item".

This test page shows that this behaviour is specific to Chrome and Safari; Firefox and IE8-10 follow the standard behaviour:

http://jsbin.com/ihofev/2/
Comment 1 Chris Adams 2014-06-30 11:56:50 PDT
Chrome fixed this bug at some point in the past year
Comment 2 Andreas Kling 2014-07-01 12:30:37 PDT
Looks like the issue here is that item() is on NodeList's prototype, so by overriding "item" on an instance of NodeList, we choose that instead of looking into the prototype chain.

I think the fix here is to let the prototype chain take precedence over named getters.
Comment 3 Ryosuke Niwa 2016-04-11 00:56:32 PDT
Chris, didn't we fix this bug?
Comment 4 Chris Dumez 2016-04-11 08:25:12 PDT
Result in Safari 9:
typeof(document.querySelectorAll("li").item)) = object
nodelist length 2
nodelist[1] [object HTMLLIElement]

Result in Safari Technology preview:
typeof(document.querySelectorAll("li").item)) = function
nodelist length 2
nodelist[1] [object HTMLLIElement]

Result in Firefox 45:
typeof(document.querySelectorAll("li").item)) = function
nodelist length 2
nodelist[1] [object HTMLLIElement]

Result in Chrome 49:
typeof(document.querySelectorAll("li").item)) = function
nodelist length 2
nodelist[1] [object HTMLLIElement]

So it looks to me that the bug was fixed in Safari 9 already and that all browsers are fully aligned on this test starting with Safari Technology preview.