Steps to reproduce the issue

Create a form for a table in a component where the functionality is to allow the user to make a selection when creating a new entry, but having that selection set to read-only when the entry is edited. Then have some field(s) whose visibility depends on the selection made. I've got a little sample here:

<field
  name        = "handedness"
  description = "Specify if you're left-handed or right-handed"
  type        = "list"
  required    = "true"
  >
  <option value="1">LEFT</option>
  <option value="2">RIGHT</option>
</field>

<field
  name        = "incidents"
  description = "How many incidents did you suffer because of lefthandedness?"
  type        = "number"
  showon      = "handedness:1"
/>

The code to make sure that the field handedness is read-only when editing the form e.g. add the code in the view or model

  $form->setFieldAttribute('handedness', 'readonly', 'true');

Create a new entry and observe that it all works as expected.
Now save the new entry (and make sure to set the handedness to RIGHT) and edit it. This is where the fun starts

Expected result

The expected result is that when a new record is created the field incidents will be visible depending on the selection of handedness and that the field will not be visible when editing an existing record and the user selected RIGHT

Actual result

The field incidents is shown regardless of the chosen value for handedness. This is due to the fact that when a list-field is read-only, Joomla! adds a hidden <input ...> element that holds the selected value. It also juggles the name and id attributes of the field:

It assigns the id and a blank name attribute the the list (the <select ...> element) and it assigns no id and the original name of the field to the hidden input field. Something like this:

<select name="" id="jform_handedness" disabled="disabled">
  <option value="1">LEFT</option>
  <option value="2">RIGHT</option>
</select>
<input type="hidden" name="jform[handedness]" value="2">

The showon.js script that handles the dynamic visibility of fields expects the name and the id to be part of the same field otherwise it throws a (silent) exception and the form will not work properly.

System information (as much as possible)

Additional comments

A quick-fix for (simple) select fields is to change this line:

$html[] = HTMLHelper::_('select.genericlist', $options, '', trim($attr), 'value', 'text', $value, false);

and this line:

$html[] = '<input type="hidden" id="'.$id.'" name="' . $name . '" value="' . htmlspecialchars($value, ENT_COMPAT, 'UTF-8') . '">';

But this might break other scenarios!

Better would be to not generate a hidden field, but there must be a reason why its done. If it is done to preventing tampering with the form data then it doesn't make much sense IMHO. That would be security by obscurity (and limited at that) because if the user is smart enough to make the field editbable the user is also smart enough to change the value of the hidden field...

Another remark: I've been going over this form implementation and the showon.js (and my hacked requireon.js equivalent) seem very messy. I'm not a very proficient developer, but the whole form and fields section could use some improvements. As developer its quite hard to get it to work nicely...