Bug 596496 - IsTooLong shouldn't compare maxlength and text length if maxlength isn't set. r=bz a=blocking2.0

content/html/content/src/nsHTMLInputElement.cpp

@@ -3711,17 +3711,23 @@ nsHTMLInputElement::SetCustomValidity(const nsAString& aError)
 PRBool
 nsHTMLInputElement::IsTooLong()
 {
-  if (!GET_BOOLBIT(mBitField, BF_VALUE_CHANGED)) {
+  if (!HasAttr(kNameSpaceID_None, nsGkAtoms::maxlength) ||
+      !GET_BOOLBIT(mBitField, BF_VALUE_CHANGED)) {
     return PR_FALSE;
   }
 
   PRInt32 maxLength = -1;
-  PRInt32 textLength = -1;
-
   GetMaxLength(&maxLength);
+
+  // Maxlength of -1 means parsing error.
+  if (maxLength == -1) {
+    return PR_FALSE;
+  }
+
+  PRInt32 textLength = -1;
   GetTextLength(&textLength);
 
-  return maxLength >= 0 && textLength > maxLength;
+  return textLength > maxLength;
 }
 
 PRBool

content/html/content/src/nsHTMLTextAreaElement.cpp

@@ -1177,17 +1177,22 @@ nsHTMLTextAreaElement::SetCustomValidity(const nsAString& aError)
 PRBool
 nsHTMLTextAreaElement::IsTooLong()
 {
-  if (!mValueChanged) {
+  if (!HasAttr(kNameSpaceID_None, nsGkAtoms::maxlength) || !mValueChanged) {
     return PR_FALSE;
   }
 
   PRInt32 maxLength = -1;
-  PRInt32 textLength = -1;
-
   GetMaxLength(&maxLength);
+
+  // Maxlength of -1 means parsing error.
+  if (maxLength == -1) {
+    return PR_FALSE;
+  }
+
+  PRInt32 textLength = -1;
   GetTextLength(&textLength);
 
-  return maxLength >= 0 && textLength > maxLength;
+  return textLength > maxLength;
 }
 
 PRBool