927796 - After removing attribute "selected" from first option in <select size=1> (combobox), selection can no longer be changed using JS

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Sebastian Leske]

Attachment: Testcase to demonstrate problem with option selection

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:27.0) Gecko/20100101 Firefox/27.0 (Beta/Release)
Build ID: 20131016030202

Steps to reproduce:

1)
Create an HTML document with a <select> element:
    <select size="1" id="myselect">
        <option selected="selected">One</option>
        <option>Two</option>
        <option>or Three</option>
    </select>

2) 
Call 
option1.removeAttribute('selected')
on the first option element.

3)
Call
option2.selected=true
on the second option element.


Actual results:

After 1), select.value is "One", as expected (where select is the DOM element for the <select>).

After 2), option.selected is "false" for *all* option elements. select.value is still "One", and the browser shows value "One" in the dropdown control.

After 3), option.selected is "true" for the second option element (as expected), however select.value is still "One", and the browser still shows value "One" in the dropdown control.


Expected results:

After 2), selection should revert to option one, i.e.: option.selected==true for option one, and select.value="One".

After 3), selection should change to option two, i.e.: option.selected==true for option two, and select.value="Two".

It looks like Firefox gets confused by removing the "selected" attribute, and the selection "sticks" at option one.

The bug is only reproducible if all of the following conditions are met:

* The size attribute of the <select> must be 0 or 1, or missing.
* The option with selected="selected" must be the first option.
* Selecting a dropdown option manually, or selecting the first option by calling option.selected=true causes the selection to become "unstuck".

I attached a testcase. Click the buttons to reproduce the bug.

Comment 1

[Sebastian Leske]

In both Chrome V30.0 and IE 9 the problem does not occur:

Both keep option One selected after removing the attribute, and allow changing the selection by setting option.selected=true.

Comment 2

[Sebastian Leske]

This problem looks vaguely similar to bug 395107 - "Not updating UI after selection attribute removed from option inside SELECT element".

Comment 3

[Mats Palmgren (inactive)]

The stated problems also occurs in Nightly on Linux64.

Comment 4

[Alice0775 White]

Regression window:
Good:
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9b2pre) Gecko/2007120405 Firefox/3.0b2pre ID:2007120405
Bad:
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9b2pre) Gecko/2007120505 Firefox/3.0b2pre ID:2007120505

Bonsai log:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-12-04+05%3A00%3A00&maxdate=2007-12-05+05%3A00%3A00&cvsroot=%2Fcvsroot

Triggered by: Bug 395107

Comment 5

[Boris Zbarsky [:bzbarsky]]

So the real bug is that options[0].selected becomes false in this case, even though for a combobox that's not a valid state to be in.  This is why everything works ok for a listbox, for which that _is_ a valid state.

The problem is that HTMLOptionElement always sets itself to "selected not changed" when its defaultSelected changes, which is bogus in the case when we take the "select something" codepath in HTMLSelectElement.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Attachment: I think this is the right thing to do

Comment 7

[Boris Zbarsky [:bzbarsky]]

Sebastian, thank you for the excellent testcase!

Comment 8

[Boris Zbarsky [:bzbarsky]]

https://tbpl.mozilla.org/?tree=Try&rev=55792fec7e3a

Comment 9

[Mats Palmgren (inactive)]

(In reply to Boris Zbarsky [:bz] from comment #5)
> even though for a combobox that's not a valid state to be in.

Not in general; it is a valid state to be in after select.selectedIndex = -1

Comment 10

[Boris Zbarsky [:bzbarsky]]

Speaking of, Mats, do you want to review?  I flipped a coin between you and sicking, but I bet you'd get to it sooner.  ;)

Comment 11

[Boris Zbarsky [:bzbarsky]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7a04c52fe9d4

Comment 12

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/7a04c52fe9d4

Comment 13

[Sebastian Leske]

Just tested this on Nightly, it's fixed. Thanks for the quick work everyone!

Comment 14

[Boris Zbarsky [:bzbarsky]]

Thank you for the excellent bug report!