Bug 877910 - Make HTMLSelectElement.namedItem return 'HTMLOptionElement' instead of 'object'; r=bz

content/html/content/crashtests/877910.html

@@ -0,0 +1 @@
+<select><option id="foo"><script>document.querySelector("select").namedItem("foo")</script>

content/html/content/crashtests/crashtests.list

@@ -52,3 +52,4 @@ load 837033.html
 pref(dom.experimental_forms_range,true) load 838256-1.html
 load 862084.html
 load 865147.html
+load 877910.html

content/html/content/src/HTMLOptionsCollection.cpp

@@ -247,13 +247,12 @@ HTMLOptionsCollection::GetElementAt(uint32_t aIndex)
   return ItemAsOption(aIndex);
 }
 
-static HTMLOptionElement*
-GetNamedItemHelper(nsTArray<nsRefPtr<HTMLOptionElement> > &aElements,
-                   const nsAString& aName)
+HTMLOptionElement*
+HTMLOptionsCollection::GetNamedItem(const nsAString& aName) const
 {
-  uint32_t count = aElements.Length();
+  uint32_t count = mElements.Length();
   for (uint32_t i = 0; i < count; i++) {
-    HTMLOptionElement* content = aElements.ElementAt(i);
+    HTMLOptionElement* content = mElements.ElementAt(i);
     if (content &&
         (content->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name, aName,
                               eCaseMatters) ||
@@ -276,7 +275,7 @@ NS_IMETHODIMP
 HTMLOptionsCollection::NamedItem(const nsAString& aName,
                                  nsIDOMNode** aReturn)
 {
-  NS_IF_ADDREF(*aReturn = GetNamedItemHelper(mElements, aName));
+  NS_IF_ADDREF(*aReturn = GetNamedItem(aName));
 
   return NS_OK;
 }
@@ -285,7 +284,7 @@ JSObject*
 HTMLOptionsCollection::NamedItem(JSContext* cx, const nsAString& name,
                                  ErrorResult& error)
 {
-  nsINode* item = GetNamedItemHelper(mElements, name);
+  nsINode* item = GetNamedItem(name);
   if (!item) {
     return nullptr;
   }

content/html/content/src/HTMLOptionsCollection.h

@@ -122,6 +122,7 @@ public:
                           int32_t aStartIndex, bool aForward,
                           int32_t* aIndex);
 
+  HTMLOptionElement* GetNamedItem(const nsAString& aName) const;
   virtual JSObject* NamedItem(JSContext* aCx, const nsAString& aName,
                               ErrorResult& error) MOZ_OVERRIDE;
 

content/html/content/src/HTMLSelectElement.h

@@ -206,10 +206,9 @@ public:
   {
     return mOptions->ItemAsOption(aIdx);
   }
-  JSObject* NamedItem(JSContext* aCx, const nsAString& aName,
-                      ErrorResult& aRv) const
+  HTMLOptionElement* NamedItem(const nsAString& aName) const
   {
-    return mOptions->NamedItem(aCx, aName, aRv);
+    return mOptions->GetNamedItem(aName);
   }
   void Add(const HTMLOptionElementOrHTMLOptGroupElement& aElement,
            const Nullable<HTMLElementOrLong>& aBefore,

dom/webidl/HTMLSelectElement.webidl

@@ -31,8 +31,7 @@ interface HTMLSelectElement : HTMLElement {
   [SetterThrows, Pure]
            attribute unsigned long length;
   getter Element? item(unsigned long index);
-  [Throws]
-  object? namedItem(DOMString name);
+  HTMLOptionElement? namedItem(DOMString name);
   [Throws]
   void add((HTMLOptionElement or HTMLOptGroupElement) element, optional (HTMLElement or long)? before = null);
   void remove(long index);