[Webkit-unassigned] [Bug 44886] Reflected attribute input.size wraps on negative values (Chrome), or returns them (Safari)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=44886


Darin Adler <darin at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #108602|review?, commit-queue?      |review-, commit-queue-
               Flag|                            |




--- Comment #9 from Darin Adler <darin at apple.com>  2011-09-25 18:54:00 PST ---
(From update of attachment 108602)
View in context: https://bugs.webkit.org/attachment.cgi?id=108602&action=review

Thanks for taking this approach.

> Source/WebCore/html/HTMLInputElement.cpp:779
> +        if (!attr->isNull()) {
> +            int value = attr->value().toInt();
> +            m_size = value > 0 ? value : defaultSize;
> +        }

The way this is written, it means that if the attribute is removed, m_size will keep its old value. That’s wrong. We want m_size to get set to defaultSize in that case. Given that 0 turns into defaultSize, we can just remove the isNull check entirely, since toInt will return 0 in that case.

We should make sure we have a test case for the transition from an attribute to not having an attribute, since that test case would have revealed this mistake.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.