285498 - form select elements not added correctly if index is decremented

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P2)

Description

[andrew]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8a6) Gecko/20041126
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8a6) Gecko/20041126

In a JavaScript application from shaw.ca, a form to enter start and end dates
is updated dynamically to reflect the previous 3 years and the number of
days in the selected month. Initially the options array is filled from
HTML. The options length is then zeroed, and new elements are added - 
1 through (28-31) for days and (2005-2003) for years. The days options are
presented correctly, but the years options show only one entry instead of three.
If the years are built by incrementing the index, the options show all
three years.

This page works OK in IE

Bad page: http://andrew.triumf.ca/form_customer_statement.moz2.html
Good page: http://andrew.triumf.ca/form_customer_statement.moz3.html

Reproducible: Always

Steps to Reproduce:
1. Enable scripting
2. Visit page
3. try to select previous year

Actual Results:  
only current year is shown

Expected Results:  
last 3 years should be shown

Comment 1

[Bob Clary [:bc] (inactive)]

Andrew, the Core/JavaScript Engine is for JavaScript language issues only. Your
issue is related to the Core/DOM 0.

the issues is the code

for (var threeYears = 2; threeYears >= 0; threeYears--){ 
  tYear = "" + (thisyear - threeYears);
  temp = new Option(tYear,tYear);
  tempYear.options[threeYears]=temp;
}

which fills the options nodelist in from [2],[1],[0] and results in only [0]
remaining.

Comment 2

[Erik Fabert]

Attachment: Reduced testcase for bug 285498

Comment 3

[Erik Fabert]

Confirming, I couldn't find a duplicate. Other browsers simply create empty
options (option.text == option.value == "") to fill the elisions, just like
Mozilla does if you set opts.length=4 before setting opts[3].

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: Proposed patch

Add the missing options if someone tries to set options[n] for a too-large n.

Comment 5

[Johnny Stenback (:jst)]

Comment on attachment 178401 [details] [diff] [review]
Proposed patch

r+sr=jst