From ec4196a2d2203d1947222a7d0e38fdf001a4d45b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= Date: Wed, 19 Oct 2022 06:30:05 +0200 Subject: [PATCH] Specify a limit for HTMLOptionsCollection's length setter This aligns with WebKit's behavior, but bumps the limit to 100k from WebKit's 10k, as per the discussion in #8337. Closes #8337. --- source | 51 ++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 38 insertions(+), 13 deletions(-) diff --git a/source b/source index ebe806db4c4..06bd03af0f6 100644 --- a/source +++ b/source @@ -8374,8 +8374,9 @@ interface HTMLOptionsCollection : HTMLCollectionWhen set to a smaller number than the existing length, truncates the number of option elements in the container corresponding to collection.

-

When set to a greater number than the existing length, adds new blank option - elements to the container corresponding to collection.

+

When set to a greater number than the existing length, if that number is less than or equal + to 100000, adds new blank option elements to the container corresponding to + collection.

element = collection.item(index)
@@ -8435,17 +8436,41 @@ interface HTMLOptionsCollection : HTMLCollectionThe object's supported property indices are as defined for HTMLCollection objects.

-

On getting, the length attribute must return the number of - nodes represented by the collection.

- -

On setting, the behavior depends on whether the new value is equal to, greater than, or less - than the number of nodes represented by the collection at that time. If the number is - the same, then setting the attribute must do nothing. If the new value is greater, then n new option elements with no attributes and no child nodes must be - appended to the select element on which the HTMLOptionsCollection is - rooted, where n is the difference between the two numbers (new value minus old - value). Mutation events must be fired as if a DocumentFragment containing the new - option elements had been inserted. If the new value is lower, then the last n nodes in the collection must be removed from their parent nodes, where n is the difference between the two numbers (old value minus new value).

+

The length getter steps are to return the + number of nodes represented by the collection.

+ +

The length setter steps are:

+ +
    +

  1. Let current be the number of nodes represented by the + collection.

    2. + +
  2. +

    If the given value is greater than current, then:

    + +
      +

    1. If the given value is greater than 100,000, then return.

      2. + +

    2. Let n be value − current.

      3. + +

    3. Append n new option elements with no attributes and no child + nodes to the select element on which this is rooted. Mutation events + must be fired as if a DocumentFragment containing the new option + elements had been inserted.

      4. +
    +
    3. + +
  3. +

    If the given value is less than current, then:

    + +
      +

    1. Let n be current − value.

      2. + +

    2. Remove the last n nodes in the collection from their parent nodes.

      3. +
    +
    4. +

Setting length never removes or adds any optgroup elements, and never adds new children to existing