Last Comment Bug 738108 - querySelector with ID attribute does not enforce "subtree" constraint
: querySelector with ID attribute does not enforce "subtree" constraint
Status: RESOLVED FIXED
: regression
Product: Core
Classification: Components
Component: DOM (show other bugs)
: 10 Branch
: x86 All
: P1 normal (vote)
: mozilla14
Assigned To: Boris Zbarsky [:bz]
:
Mentors:
Depends on:
Blocks: 696205
  Show dependency treegraph
 
Reported: 2012-03-21 18:21 PDT by rick
Modified: 2012-03-22 18:10 PDT (History)
4 users (show)
bzbarsky: in‑testsuite+
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
sample html (408 bytes, text/html)
2012-03-21 19:01 PDT, Alice0775 White
no flags Details
When restricting to the element subtree in querySelector(All), make sure to disallow the element itself. (4.42 KB, patch)
2012-03-21 19:25 PDT, Boris Zbarsky [:bz]
bugs: review+
Details | Diff | Splinter Review

Description rick 2012-03-21 18:21:01 PDT
User Agent: Mozilla/5.0 (Windows NT 5.1; rv:10.0.2) Gecko/20100101 Firefox/10.0.2
Build ID: 20120215223356

Steps to reproduce:

Element.querySelector matches the element itself if the selector contains the special case "#id" syntax. No other browser does this, earlier versions of Firefox did not do this and the Selectors API Level1 says not to do this (quote: "return the first matching Element node within the node’s subtrees").

Note, the same bug affects Element.querySelectorAll

STEPS TO REPRODUCE:
On a web page where an element exists with the id "main" (for example http://www.google.com) execute the following line of JS in Firefox:

document.getElementById("main").querySelector("#main");//this incorrectly returns the Element


You can see this is related to the special case using "#" for id. If we execute the equivalent selector using regular attribute selector syntax it works fine:

document.getElementById("main").querySelector("[id='main']");//this correctly returns null



Actual results:

In Firefox 10.0.2 the element "main" is returned if we use the special "#ID" selector syntax


Expected results:

Element.querySelector should always return null if the match is not in the Element's subtrees
Comment 1 Alice0775 White 2012-03-21 19:01:47 PDT
Created attachment 608182 [details]
sample html
Comment 2 Alice0775 White 2012-03-21 19:03:41 PDT
Regression window(m-c)
Works:
http://hg.mozilla.org/mozilla-central/rev/6e219763ddd0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111101 Firefox/10.0a1 ID:20111101052615
Fails:
http://hg.mozilla.org/mozilla-central/rev/cd9add22f090
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111101 Firefox/10.0a1 ID:20111101073309
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6e219763ddd0&tochange=cd9add22f090



Regression window(m-i)
Works:
http://hg.mozilla.org/integration/mozilla-inbound/rev/b4e12c6014e3
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111031 Firefox/10.0a1 ID:20111031190415
Fails:
http://hg.mozilla.org/integration/mozilla-inbound/rev/f3babd4e975f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111031 Firefox/10.0a1 ID:20111031200715
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b4e12c6014e3&tochange=f3babd4e975f

Suspected: Bug 696205
Comment 3 Boris Zbarsky [:bz] 2012-03-21 19:25:44 PDT
Created attachment 608195 [details] [diff] [review]
When restricting to the element subtree in querySelector(All), make sure to disallow the element itself.
Comment 4 Boris Zbarsky [:bz] 2012-03-21 19:29:29 PDT
rick, thank you for the excellent bug report!
Comment 5 rick 2012-03-21 19:38:29 PDT
Boris :) Thank you for the awesome browser!
Comment 6 Boris Zbarsky [:bz] 2012-03-22 00:14:06 PDT
http://hg.mozilla.org/integration/mozilla-inbound/rev/d51faf4c97f0

Not sure I'm going to worry about trying to backport this....
Comment 7 Marco Bonardo [::mak] 2012-03-22 18:10:15 PDT
https://hg.mozilla.org/mozilla-central/rev/d51faf4c97f0

Note You need to log in before you can comment on or make changes to this bug.