I Steps: Go to http://bf.sina.com.cn/sinarc_php/piclist.php?aid=105&from=403 II Issue: In the left nav bar, try to click on "+" or "-". the tree doesn't expand or collapse on clicking + or - III Conclusion: Webkit doesn't create an array for all the elements found for the "id" in document.all("id") IV Other browsers: IE7: ok FF3: not ok Opera9.24: ok V Nightly tested: 31386
Created attachment 20174 [details] reduction
This is not a bug about JS arrays, it is about DOM collections. Geoff mentioned that we have added this for other collections.
Interesting. JSHTMLAllCollection inherits from JSHTMLCollection which implements the funky IE emulating call notation. I wonder why it is not getting hit.
This is a pretty bizarre bug. I can verify with GDB that the correct code in JSHTMLCollection is being called from JITStubs::cti_op_call_NotJSFunction() and a correct value is being returned, but it also reenters JITStubs::cti_op_call_NotJSFunction() and then thinks that the value is not a function.
Oh, I was just misreading things because I was tired. Doing document.all returns a JSHTMLAllCollection, and indexing by id in that collection returns a JSNamedNodesCollection, which does not support the function call syntax.
Ah, I made the same mistake as well. I thought the bug was in the HTMLAllCollection not supporting call notation.
No browser alive passes the reduced test case so changing this would almost definitely be counterproductive at this point.