649912 - nsContentUtils::BelongsInForm looks very fishy

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P5)

Description

[Boris Zbarsky [:bzbarsky]]

In particular, it looks for things after empty forms.  So this testcase:

  <form name="x"></form>
  <img name="y">
  <script>
    alert(document.forms["x"].y);
  </script>

alerts an element.  I bet that's to deal with the table stuff, but does the spec call for this?  What do other browsers do?  I'd love it if we could nix this PositionIsBefore hackery.

Comment 1

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

The spec tells us to look at form.elements.y first, and that returns undefined.

This should all be handled in the parser, in particular

http://mxr.mozilla.org/mozilla-central/source/parser/html/nsHtml5TreeBuilder.cpp#3604
http://mxr.mozilla.org/mozilla-central/source/parser/html/nsHtml5TreeBuilderCppSupplement.h#222
http://mxr.mozilla.org/mozilla-central/source/parser/html/nsHtml5TreeOperation.cpp#512

Comment 2

[Boris Zbarsky [:bzbarsky]]

> The spec tells us to look at form.elements.y first

Yes, we do that.  But we also look for things that are not in elements (like <img> inside the form, say).  Do other browsers not do this?  In my testing, they sure seem to.

I guess I'll file a spec bug.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Hmm.  So every browser _except_ IE exposes named <img> inside <form> in form's namegetter.  Is the fact that IE doesn't good enough for us to drop this?

Note that Opera has behavior much like ours, while WebKit exposes the <img> in the form.elements namegetter too.

I guess I'll post to public-html and see what other implementors say.

Comment 4

[Boris Zbarsky [:bzbarsky]]

http://lists.w3.org/Archives/Public/public-html/2011Apr/0389.html

Comment 5

[Boris Zbarsky [:bzbarsky]]

This function is long-gone.  It went away in bug 870787, when we made <img> form-associated-ish.