738108 - querySelector with ID attribute does not enforce "subtree" constraint

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[rick]

User Agent: Mozilla/5.0 (Windows NT 5.1; rv:10.0.2) Gecko/20100101 Firefox/10.0.2
Build ID: 20120215223356

Steps to reproduce:

Element.querySelector matches the element itself if the selector contains the special case "#id" syntax. No other browser does this, earlier versions of Firefox did not do this and the Selectors API Level1 says not to do this (quote: "return the first matching Element node within the node’s subtrees").

Note, the same bug affects Element.querySelectorAll

STEPS TO REPRODUCE:
On a web page where an element exists with the id "main" (for example http://www.google.com) execute the following line of JS in Firefox:

document.getElementById("main").querySelector("#main");//this incorrectly returns the Element


You can see this is related to the special case using "#" for id. If we execute the equivalent selector using regular attribute selector syntax it works fine:

document.getElementById("main").querySelector("[id='main']");//this correctly returns null



Actual results:

In Firefox 10.0.2 the element "main" is returned if we use the special "#ID" selector syntax


Expected results:

Element.querySelector should always return null if the match is not in the Element's subtrees

Comment 1

[Alice0775 White]

Attachment: sample html

Comment 2

[Alice0775 White]

Regression window(m-c)
Works:
http://hg.mozilla.org/mozilla-central/rev/6e219763ddd0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111101 Firefox/10.0a1 ID:20111101052615
Fails:
http://hg.mozilla.org/mozilla-central/rev/cd9add22f090
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111101 Firefox/10.0a1 ID:20111101073309
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6e219763ddd0&tochange=cd9add22f090



Regression window(m-i)
Works:
http://hg.mozilla.org/integration/mozilla-inbound/rev/b4e12c6014e3
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111031 Firefox/10.0a1 ID:20111031190415
Fails:
http://hg.mozilla.org/integration/mozilla-inbound/rev/f3babd4e975f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111031 Firefox/10.0a1 ID:20111031200715
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b4e12c6014e3&tochange=f3babd4e975f

Suspected: Bug 696205

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: When restricting to the element subtree in querySelector(All), make sure to disallow the element itself.

Comment 4

[Boris Zbarsky [:bzbarsky]]

rick, thank you for the excellent bug report!

Comment 5

[rick]

Boris :) Thank you for the awesome browser!

Comment 6

[Boris Zbarsky [:bzbarsky]]

http://hg.mozilla.org/integration/mozilla-inbound/rev/d51faf4c97f0

Not sure I'm going to worry about trying to backport this....

Comment 7

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/d51faf4c97f0