Closed Bug 586761 Opened 10 years ago Closed 3 years ago

Longs in reflected attributes treat -2147483648 as out of range

Categories

(Core :: DOM: Core & HTML, defect, minor)

defect
Not set
minor

Tracking

()

RESOLVED DUPLICATE of bug 1271126

People

(Reporter: ayg, Unassigned)

References

Details

Attachments

(1 file)

Test case:

<!doctype html>
<script>
    var el = document.createElement("ol");
    el.setAttribute("start", -2147483648);
    alert(el.start);
</script>

Alerts "-1" in Firefox 4.0 Beta 3; "-2147483648" in IE8, Chrome dev, Safari 5, Opera 10.60.  The specs imply that it should be in range, so alert -2147483648.
Yeah, nsAttrValue only stores 28 bit integers (and 4 bits of tag).
OS: Linux → All
Hardware: x86 → All
Depends on: 669578
Is comment 1 still true?  The testcase works (in current nightly) if I offset the value by 1, to get -2147483647 (which is -(2^31 - 1)).

Perhaps we're parsing the number as if it were a positive 32-bit integer (for which 2147483647 *is* the maximum representable value), and then negating it?
Also, incidentally, the testcase in comment 0 now alerts 1 (not -1) in Firefox nightly.
Attached file testcase
Expected rendering of testcase:
 -2147483647 is parsed as -2147483647
 -2147483648 is parsed as -2147483648
 2147483647 is parsed as 2147483647
 2147483648 is parsed as [either 1 or -1]
(This is the Google Chrome dev-channel rendering.)

In Firefox nightly, the second line says:
  -2147483648 is parsed as 1
nsAttrValue::StringToInteger does in fact compute a value first based on just the digits and then negates it if the first char was '-'.
Status: NEW → RESOLVED
Closed: 3 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 1271126
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.