REGRESSION(r122345): HTMLCollection::length() sometimes returns a wrong value
https://bugs.webkit.org/show_bug.cgi?id=91587
Reviewed by Benjamin Poulain.
Source/WebCore:
The bug was caused by my douchey code that set the length cache to be the *offset*
of the last item in a HTMLCollection. Clearly, the length of a collection that contains
the last item at offset n is n + 1. Fixed that.
Also removed the call to setLengthCache in HTMLCollection::length since it must have set
by previous calls to itemBeforeOrAfterCachedItem already. This will allow us to catch
regressions like this in ports that use JSC bindings as well.
Test: fast/dom/htmlcollection-length-after-item.html
* html/HTMLCollection.cpp:
(WebCore::HTMLCollection::length):
(WebCore::HTMLCollection::itemBeforeOrAfterCachedItem):
LayoutTests:
Add a regression test. It only fails on Chromium port before the patch is applied because JSC binding code
has a bug (?) that it always checks index > length() to throw an exception before accessing an item in HTMLCollection.
* fast/dom/htmlcollection-length-after-item-expected.txt: Added.
* fast/dom/htmlcollection-length-after-item.html: Added.
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@122930
268f45cc-cd09-0410-ab3c-
d52691b4dbfc