Nightly Webkit and Chrome builds introduce a regression causing the temperature input box (left of Helium) on ptable.com to reset to 0. Site does some elaborate cloneNode operations to animate the slider and input box.
Bug does not occur in Safari 5.1 or Chrome 14. Initial load of the site should show "273" in input box rather than 0.
Regression occurred between r94213 and r94287.
Thanks for finding the regression range!
Not sure what change is the cause, maybe <http://trac.webkit.org/changeset/94252>?
Further reduced to r94273-94287, so it's not r94252.
There aren't many suspicious changes in this range, the most related being <http://trac.webkit.org/changeset/94274>.
Created attachment 109379 [details]
Here's a reduction. The third text field has the value 999 on Chrome 14 but has 0 on ToT WebKit.
Created attachment 109381 [details]
somewhat refined reduction
In this version, you can see that the last input element has the value "999" but what's shown on the scree is "0".
Looking at the bug and the regression range, this is definitely a regression from r94274.
Created attachment 109390 [details]
Here's a complete reduction.
The problem is that we're not copying the value stored separately from the value content attribute (default value) in cloneNode(true).
(In reply to comment #8)
> The problem is that we're not copying the value stored separately from the value content attribute (default value) in cloneNode(true).
Well, this isn't true. m_valueIfDirty is properly copied in copyNonAttributeProperties. The problem is that this function is not updating inner element text. Will upload a patch in a minute.
Created attachment 109539 [details]
fixes the bug
Wow, that was quick! Thanks for the review, Darin.
Committed r96552: <http://trac.webkit.org/changeset/96552>