The default bug view has changed. See this FAQ.

querySelector with ID attribute does not enforce "subtree" constraint

RESOLVED FIXED in mozilla14

Status

()

Core
DOM
P1
normal
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: rick, Assigned: bz)

Tracking

({regression})

10 Branch
mozilla14
x86
All
regression
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
User Agent: Mozilla/5.0 (Windows NT 5.1; rv:10.0.2) Gecko/20100101 Firefox/10.0.2
Build ID: 20120215223356

Steps to reproduce:

Element.querySelector matches the element itself if the selector contains the special case "#id" syntax. No other browser does this, earlier versions of Firefox did not do this and the Selectors API Level1 says not to do this (quote: "return the first matching Element node within the node’s subtrees").

Note, the same bug affects Element.querySelectorAll

STEPS TO REPRODUCE:
On a web page where an element exists with the id "main" (for example http://www.google.com) execute the following line of JS in Firefox:

document.getElementById("main").querySelector("#main");//this incorrectly returns the Element


You can see this is related to the special case using "#" for id. If we execute the equivalent selector using regular attribute selector syntax it works fine:

document.getElementById("main").querySelector("[id='main']");//this correctly returns null



Actual results:

In Firefox 10.0.2 the element "main" is returned if we use the special "#ID" selector syntax


Expected results:

Element.querySelector should always return null if the match is not in the Element's subtrees

Comment 1

5 years ago
Created attachment 608182 [details]
sample html

Comment 2

5 years ago
Regression window(m-c)
Works:
http://hg.mozilla.org/mozilla-central/rev/6e219763ddd0
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111101 Firefox/10.0a1 ID:20111101052615
Fails:
http://hg.mozilla.org/mozilla-central/rev/cd9add22f090
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111101 Firefox/10.0a1 ID:20111101073309
Pushlog:
http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=6e219763ddd0&tochange=cd9add22f090



Regression window(m-i)
Works:
http://hg.mozilla.org/integration/mozilla-inbound/rev/b4e12c6014e3
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111031 Firefox/10.0a1 ID:20111031190415
Fails:
http://hg.mozilla.org/integration/mozilla-inbound/rev/f3babd4e975f
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:10.0a1) Gecko/20111031 Firefox/10.0a1 ID:20111031200715
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=b4e12c6014e3&tochange=f3babd4e975f

Suspected: Bug 696205
Blocks: 696205
Status: UNCONFIRMED → NEW
Component: Untriaged → DOM
Ever confirmed: true
Keywords: regression
OS: Windows XP → All
Product: Firefox → Core
QA Contact: untriaged → general
Created attachment 608195 [details] [diff] [review]
When restricting to the element subtree in querySelector(All), make sure to disallow the element itself.
Attachment #608195 - Flags: review?(bugs)
rick, thank you for the excellent bug report!
Assignee: nobody → bzbarsky
Whiteboard: [need review]
Priority: -- → P1
(Reporter)

Comment 5

5 years ago
Boris :) Thank you for the awesome browser!
Attachment #608195 - Flags: review?(bugs) → review+
http://hg.mozilla.org/integration/mozilla-inbound/rev/d51faf4c97f0

Not sure I'm going to worry about trying to backport this....
Flags: in-testsuite+
Whiteboard: [need review]
Target Milestone: --- → mozilla14
https://hg.mozilla.org/mozilla-central/rev/d51faf4c97f0
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.