Bug Tracker

Ticket #11109 (closed bug: fixed)

Opened 3 years ago

Last modified 3 years ago

Sizzle: Expr.relative truncates prematurely

Reported by: gibson042 Owned by: timmywil
Priority: high Milestone: 1.8
Component: selector Version: 1.7.1
Keywords: Cc:
Blocking: Blocked by:

Description

Work on #10868 revealed this error in oldSizzle:  http://jsfiddle.net/JBBM8/

Because Sizzle.selectors.relative functions "return" only a single match, Sizzle can be trapped into a false negative with respect to preceding parts of the full selector when the relative selector tests against multiple elements (e.g., "~" and "").

I'm pretty sure that fixing this will require changing the Sizzle.selectors.relative Extension API to allow "returning" arrays, so I will hold off working on this until the core team weighs in with their comments/approval.

Change History

comment:1 Changed 3 years ago by gibson042

Technical explanation: Given a query like "A + B ~ C", Sizzle:

  1. Gets a set of all C, then
  2. Uses Sizzle.selectors.relative["~"] to replace each element with the first preceding sibling element matching B (or false if nonexistent), then
  3. Uses Sizzle.selectors.relative["+"] to replace each element with the preceding sibling element if it matches A (or false if it doesn't), then
  4. Returns all elements from the set at step 1 that stayed non-false through all subsequent steps

The problem here is that step 2 fails to report back all preceding siblings matching B, erroneously restricting the input set for subsequent step 3.

comment:2 Changed 3 years ago by dmethvin

  • Status changed from new to closed
  • Resolution set to duplicate

Can you coordinate with timmywil on this? He's got #10697. I'll mark this one as a dup but really it seems like this should be filed as a Sizzle bug.

comment:3 Changed 3 years ago by dmethvin

Duplicate of #10697.

comment:4 Changed 3 years ago by timmywil

  • Priority changed from undecided to high
  • Resolution duplicate deleted
  • Status changed from closed to reopened
  • Component changed from unfiled to selector
  • Milestone changed from None to 1.next

Reopening as this was not addressed in the rewrite. Here is another test case that i think is related:

 http://jsfiddle.net/timmywil/a6E3V/3/

Also see:

 http://javascript.nwbox.com/NWMatcher/release/test/css3-compat/sibling-test.html

comment:5 Changed 3 years ago by timmywil

  • Owner set to timmywil
  • Status changed from reopened to assigned

comment:6 Changed 3 years ago by timmywil

OK, it seems the sibling issues from nwbox are already fixed, so those aren't related. However, there is still an issue with deeper levels. The fiddles are still valid.

comment:7 Changed 3 years ago by timmywil

  • Milestone changed from 1.next to 1.8

A combination combinator fiddle for the masses:  http://jsfiddle.net/timmywil/WSrGh/. Working on it.

comment:8 Changed 3 years ago by timmywil

  • Status changed from assigned to closed
  • Resolution set to fixed

comment:9 Changed 3 years ago by timmywil

Update Sizzle. Fixes #11109.

Changeset: 8763bec032bc2dc10bf0d6686b820b731b525091

comment:10 Changed 3 years ago by timmywil

#11079 is a duplicate of this ticket.

Note: See TracTickets for help on using tickets.