366483 - XMLToXMLString namespace redeclaration omissions

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Jeff Walden [:Waldo]]

Our implementation (and I believe the E4X spec, tho I haven't taken the time to investigate fully) don't properly emit redeclarations for prefixes which are overridden with a different namespace in nested child elements.  Two examples:

// Example 1
XML.prettyPrinting = false;
default xml namespace = "a";
var x = <m/>;
default xml namespace = "";
var c = <y/>;
x.appendChild(c);
print(x.toXMLString());
print(x == XML(x.toXMLString()));

Output:
<m xmlns="a"><y/></m>
false

Note that <y/> is missing an | xmlns=""|.


// Example 2
var a = <foo xmlns:a="n_a1"><a:bar/></foo>;
var b = <a:quux xmlns:a="n_a2"/>;
b.appendChild(a.child(0));
print(b.toXMLString());
print(b == XML(b.toXMLString()));

Output:
<a:quux xmlns:a="n_a2"><a:bar/></a:quux>
false

Note that <a:bar/> is missing an | xmlns:a="n_a1"|.


I'm pretty certain there's at least a bug in E4X's ToXMLString here; I think the condition in step 10(a) is wrong and needs to be changed from:

> If there is no ans ∈ AncestorNamespaces, such that ans.uri == ns.uri and
> ans.prefix == ns.prefix

to:

> If there is no ans ∈ AncestorNamespaces, such that ans.uri == ns.uri and
> ans.prefix == ns.prefix, or if there exists an ans ∈ AncestorNamespaces,
> such that ans.prefix == ns.prefix and ans.uri != ns.uri

(In other words, when a prefix is overridden, a new namespace declaration *must* be emitted, because use of that prefix without the redeclaration will use the wrong namespace.)

When I tested this by adding the change to the patch in bug 366117, however, it failed to work.  I suspect that this is due to |if (!ns->declared) continue;| but haven't stepped through with a debugger to see for sure.

Given that both testcases use appendChild, it's possible there may be a bug lurking there as well related to omission of [[InScopeNamespaces]] updates somewhere in [[Put]], but I haven't taken the time to found out for certain.

Comment 1

[Matthias Versen [:Matti]]

E4X will be removed again from Spidermonkey (bug 788293)