Closed Bug 586761 Opened 10 years ago Closed 3 years ago
Longs in reflected attributes treat -2147483648 as out of range
Test case: <!doctype html> <script> var el = document.createElement("ol"); el.setAttribute("start", -2147483648); alert(el.start); </script> Alerts "-1" in Firefox 4.0 Beta 3; "-2147483648" in IE8, Chrome dev, Safari 5, Opera 10.60. The specs imply that it should be in range, so alert -2147483648.
Yeah, nsAttrValue only stores 28 bit integers (and 4 bits of tag).
Is comment 1 still true? The testcase works (in current nightly) if I offset the value by 1, to get -2147483647 (which is -(2^31 - 1)). Perhaps we're parsing the number as if it were a positive 32-bit integer (for which 2147483647 *is* the maximum representable value), and then negating it?
Also, incidentally, the testcase in comment 0 now alerts 1 (not -1) in Firefox nightly.
Expected rendering of testcase: -2147483647 is parsed as -2147483647 -2147483648 is parsed as -2147483648 2147483647 is parsed as 2147483647 2147483648 is parsed as [either 1 or -1] (This is the Google Chrome dev-channel rendering.) In Firefox nightly, the second line says: -2147483648 is parsed as 1
nsAttrValue::StringToInteger does in fact compute a value first based on just the digits and then negates it if the first char was '-'.
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1271126
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.