Note: There are a few cases of duplicates in user autocompletion which are being worked on.

querySelector with ID attribute does not enforce "subtree" constraint

RESOLVED FIXED in mozilla14

Status

()

Core
DOM
P1
normal
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: rick, Assigned: bz)

Tracking

({regression})

10 Branch
mozilla14
x86
All
regression
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
User Agent: Mozilla/5.0 (Windows NT 5.1; rv:10.0.2) Gecko/20100101 Firefox/10.0.2
Build ID: 20120215223356

Steps to reproduce:

Element.querySelector matches the element itself if the selector contains the special case "#id" syntax. No other browser does this, earlier versions of Firefox did not do this and the Selectors API Level1 says not to do this (quote: "return the first matching Element node within the node’s subtrees").

Note, the same bug affects Element.querySelectorAll

STEPS TO REPRODUCE:
On a web page where an element exists with the id "main" (for example http://www.google.com) execute the following line of JS in Firefox:

document.getElementById("main").querySelector("#main");//this incorrectly returns the Element


You can see this is related to the special case using "#" for id. If we execute the equivalent selector using regular attribute selector syntax it works fine:

document.getElementById("main").querySelector("[id='main']");//this correctly returns null



Actual results:

In Firefox 10.0.2 the element "main" is returned if we use the special "#ID" selector syntax


Expected results:

Element.querySelector should always return null if the match is not in the Element's subtrees

Comment 1

5 years ago
Created attachment 608182 [details]
sample html

Comment 2

5 years ago
Regression window(m-c)
Works:
http://hg.mozilla.org/mozilla-central/rev/6e219763ddd0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111101 Firefox/10.0a1 ID:20111101052615
Fails:
http://hg.mozilla.org/mozilla-central/rev/cd9add22f090
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111101 Firefox/10.0a1 ID:20111101073309
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6e219763ddd0&tochange=cd9add22f090



Regression window(m-i)
Works:
http://hg.mozilla.org/integration/mozilla-inbound/rev/b4e12c6014e3
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111031 Firefox/10.0a1 ID:20111031190415
Fails:
http://hg.mozilla.org/integration/mozilla-inbound/rev/f3babd4e975f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111031 Firefox/10.0a1 ID:20111031200715
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b4e12c6014e3&tochange=f3babd4e975f

Suspected: Bug 696205
Blocks: 696205
Status: UNCONFIRMED → NEW
Component: Untriaged → DOM
Ever confirmed: true
Keywords: regression
OS: Windows XP → All
Product: Firefox → Core
QA Contact: untriaged → general
(Assignee)

Comment 3

5 years ago
Created attachment 608195 [details] [diff] [review]
When restricting to the element subtree in querySelector(All), make sure to disallow the element itself.
Attachment #608195 - Flags: review?(bugs)
(Assignee)

Comment 4

5 years ago
rick, thank you for the excellent bug report!
Assignee: nobody → bzbarsky
Whiteboard: [need review]
(Assignee)

Updated

5 years ago
Priority: -- → P1
(Reporter)

Comment 5

5 years ago
Boris :) Thank you for the awesome browser!

Updated

5 years ago
Attachment #608195 - Flags: review?(bugs) → review+
(Assignee)

Comment 6

5 years ago
http://hg.mozilla.org/integration/mozilla-inbound/rev/d51faf4c97f0

Not sure I'm going to worry about trying to backport this....
Flags: in-testsuite+
Whiteboard: [need review]
Target Milestone: --- → mozilla14
https://hg.mozilla.org/mozilla-central/rev/d51faf4c97f0
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.