From 06c2cdb2a4f30783fd73ffe034f9f8f9d87f65a5 Mon Sep 17 00:00:00 2001
From: Ms2ger <ms2ger@gmail.com>
Date: Sat, 1 Jun 2013 08:56:34 +0200
Subject: [PATCH] Bug 877910 - Make HTMLSelectElement.namedItem return
 'HTMLOptionElement' instead of 'object'; r=bz

---
 content/html/content/crashtests/877910.html        |  1 +
 content/html/content/crashtests/crashtests.list    |  1 +
 content/html/content/src/HTMLOptionsCollection.cpp | 13 ++++++-------
 content/html/content/src/HTMLOptionsCollection.h   |  1 +
 content/html/content/src/HTMLSelectElement.h       |  5 ++---
 dom/webidl/HTMLSelectElement.webidl                |  3 +--
 6 files changed, 12 insertions(+), 12 deletions(-)
 create mode 100644 content/html/content/crashtests/877910.html

diff --git a/content/html/content/crashtests/877910.html b/content/html/content/crashtests/877910.html
new file mode 100644
index 000000000000..d454c4478bdb
--- /dev/null
+++ b/content/html/content/crashtests/877910.html
@@ -0,0 +1 @@
+<select><option id="foo"><script>document.querySelector("select").namedItem("foo")</script>
diff --git a/content/html/content/crashtests/crashtests.list b/content/html/content/crashtests/crashtests.list
index b7c3b2806a6f..d9bb85c3a574 100644
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@@ -52,3 +52,4 @@ load 837033.html
 pref(dom.experimental_forms_range,true) load 838256-1.html
 load 862084.html
 load 865147.html
+load 877910.html
diff --git a/content/html/content/src/HTMLOptionsCollection.cpp b/content/html/content/src/HTMLOptionsCollection.cpp
index ff49188106f5..aa7ed7842086 100644
--- a/content/html/content/src/HTMLOptionsCollection.cpp
+++ b/content/html/content/src/HTMLOptionsCollection.cpp
@@ -247,13 +247,12 @@ HTMLOptionsCollection::GetElementAt(uint32_t aIndex)
   return ItemAsOption(aIndex);
 }
 
-static HTMLOptionElement*
-GetNamedItemHelper(nsTArray<nsRefPtr<HTMLOptionElement> > &aElements,
-                   const nsAString& aName)
+HTMLOptionElement*
+HTMLOptionsCollection::GetNamedItem(const nsAString& aName) const
 {
-  uint32_t count = aElements.Length();
+  uint32_t count = mElements.Length();
   for (uint32_t i = 0; i < count; i++) {
-    HTMLOptionElement* content = aElements.ElementAt(i);
+    HTMLOptionElement* content = mElements.ElementAt(i);
     if (content &&
         (content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name, aName,
                               eCaseMatters) ||
@@ -276,7 +275,7 @@ NS_IMETHODIMP
 HTMLOptionsCollection::NamedItem(const nsAString& aName,
                                  nsIDOMNode** aReturn)
 {
-  NS_IF_ADDREF(*aReturn = GetNamedItemHelper(mElements, aName));
+  NS_IF_ADDREF(*aReturn = GetNamedItem(aName));
 
   return NS_OK;
 }
@@ -285,7 +284,7 @@ JSObject*
 HTMLOptionsCollection::NamedItem(JSContext* cx, const nsAString& name,
                                  ErrorResult& error)
 {
-  nsINode* item = GetNamedItemHelper(mElements, name);
+  nsINode* item = GetNamedItem(name);
   if (!item) {
     return nullptr;
   }
diff --git a/content/html/content/src/HTMLOptionsCollection.h b/content/html/content/src/HTMLOptionsCollection.h
index 873fb72cfba0..762dfc143c2c 100644
--- a/content/html/content/src/HTMLOptionsCollection.h
+++ b/content/html/content/src/HTMLOptionsCollection.h
@@ -122,6 +122,7 @@ public:
                           int32_t aStartIndex, bool aForward,
                           int32_t* aIndex);
 
+  HTMLOptionElement* GetNamedItem(const nsAString& aName) const;
   virtual JSObject* NamedItem(JSContext* aCx, const nsAString& aName,
                               ErrorResult& error) MOZ_OVERRIDE;
 
diff --git a/content/html/content/src/HTMLSelectElement.h b/content/html/content/src/HTMLSelectElement.h
index 7df1259e0578..695cbab41fbc 100644
--- a/content/html/content/src/HTMLSelectElement.h
+++ b/content/html/content/src/HTMLSelectElement.h
@@ -206,10 +206,9 @@ public:
   {
     return mOptions->ItemAsOption(aIdx);
   }
-  JSObject* NamedItem(JSContext* aCx, const nsAString& aName,
-                      ErrorResult& aRv) const
+  HTMLOptionElement* NamedItem(const nsAString& aName) const
   {
-    return mOptions->NamedItem(aCx, aName, aRv);
+    return mOptions->GetNamedItem(aName);
   }
   void Add(const HTMLOptionElementOrHTMLOptGroupElement& aElement,
            const Nullable<HTMLElementOrLong>& aBefore,
diff --git a/dom/webidl/HTMLSelectElement.webidl b/dom/webidl/HTMLSelectElement.webidl
index 7a88d42e906f..89f410a0597d 100644
--- a/dom/webidl/HTMLSelectElement.webidl
+++ b/dom/webidl/HTMLSelectElement.webidl
@@ -31,8 +31,7 @@ interface HTMLSelectElement : HTMLElement {
   [SetterThrows, Pure]
            attribute unsigned long length;
   getter Element? item(unsigned long index);
-  [Throws]
-  object? namedItem(DOMString name);
+  HTMLOptionElement? namedItem(DOMString name);
   [Throws]
   void add((HTMLOptionElement or HTMLOptGroupElement) element, optional (HTMLElement or long)? before = null);
   void remove(long index);