REGRESSION(r122345): HTMLCollection::length() sometimes returns a wrong value
authorrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 18 Jul 2012 08:16:31 +0000 (08:16 +0000)
committerrniwa@webkit.org <rniwa@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 18 Jul 2012 08:16:31 +0000 (08:16 +0000)
commitd45a42225ac5026236ee8d2a1306e8bdac0b0179
tree1958ff61cc3f37183dafc4ddff58dca4be2249c4
parent6c23d199864d06f41396390b6b0d89047bd6759b
REGRESSION(r122345): HTMLCollection::length() sometimes returns a wrong value
https://bugs.webkit.org/show_bug.cgi?id=91587

Reviewed by Benjamin Poulain.

Source/WebCore:

The bug was caused by my douchey code that set the length cache to be the *offset*
of the last item in a HTMLCollection. Clearly, the length of a collection that contains
the last item at offset n is n + 1. Fixed that.

Also removed the call to setLengthCache in HTMLCollection::length since it must have set
by previous calls to itemBeforeOrAfterCachedItem already. This will allow us to catch
regressions like this in ports that use JSC bindings as well.

Test: fast/dom/htmlcollection-length-after-item.html

* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::length):
(WebCore::HTMLCollection::itemBeforeOrAfterCachedItem):

LayoutTests:

Add a regression test. It only fails on Chromium port before the patch is applied because JSC binding code
has a bug (?) that it always checks index > length() to throw an exception before accessing an item in HTMLCollection.

* fast/dom/htmlcollection-length-after-item-expected.txt: Added.
* fast/dom/htmlcollection-length-after-item.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@122930 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/fast/dom/htmlcollection-length-after-item-expected.txt [new file with mode: 0644]
LayoutTests/fast/dom/htmlcollection-length-after-item.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/html/HTMLCollection.cpp