29157 - createCaption(); crashes mozilla

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Jan Carpenter]

Overview Description: 
createCaption(); crashes mozilla 

Steps to Reproduce: 
- see attached testcase
  - test crashes as soon as it hits
      var t=document.getElementById("TABLE1");
      document.write(t);
      t.createCaption();

Actual Results: 
crashes browser.  see talkback report below.

Build Date & Platform Bug Found: 
Win98 2000022308

Additional Builds and Platforms Tested On: 
Linux
Mac
Win95


Additional Information:
Talkback Report


Incident ID 5856749 
 Trigger Time 
            2000-02-24 15:58:15 
 Email Address 
            [e-mail] 
 User Comments 
            DOM1's createCaption(); is crashing mozilla 
 Build ID
            2000022409 
 Product ID
            Communicator5.0 
 Platform ID
            Win32 
 Stack Trace

nsTableFrame::SetInitialChildList
[d:\builds\seamonkey\mozilla\layout\html\table\src\nsTableFrame.cpp, line 326] 
nsCSSFrameConstructor::ConstructTableCaptionFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 1403] 
nsCSSFrameConstructor::ConstructFrameByDisplayType
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 5037] 
nsCSSFrameConstructor::ConstructFrame
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 5535] 
nsCSSFrameConstructor::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\style\src\nsCSSFrameConstructor.cpp, 
line 6135] 
StyleSetImpl::ContentAppended 
[d:\builds\seamonkey\mozilla\layout\base\src\nsStyleSet.cpp,
line 957] 
PresShell::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\base\src\nsPresShell.cpp, line 2587] 
nsDocument::ContentAppended
[d:\builds\seamonkey\mozilla\layout\base\src\nsDocument.cpp, line 1591] 
nsHTMLDocument::ContentAppended
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLDocument.cpp, line 
1120] 
nsGenericHTMLContainerElement::AppendChildTo
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsGenericHTMLElement.cpp, 
line 3369] 
nsHTMLTableElement::CreateCaption
[d:\builds\seamonkey\mozilla\layout\html\content\src\nsHTMLTableElement.cpp, 
line 659] 
HTMLTableElementCreateCaption
[d:\builds\seamonkey\mozilla\dom\src\html\nsJSHTMLTableElement.cpp, line 783] 
js_Invoke [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 666] 
js_Interpret [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 2293] 
js_Execute [d:\builds\seamonkey\mozilla\js\src\jsinterp.c, line 838] 
JS_EvaluateUCScriptForPrincipals [d:\builds\seamonkey\mozilla\js\src\jsapi.c, 
line 2742] 
nsJSContext::EvaluateString
[d:\builds\seamonkey\mozilla\dom\src\base\nsJSEnvironment.cpp, line 293] 
HTMLContentSink::EvaluateScript
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp, 
line 4080] 
HTMLContentSink::ProcessSCRIPTTag
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp, 
line 4272] 
HTMLContentSink::AddLeaf
[d:\builds\seamonkey\mozilla\layout\html\document\src\nsHTMLContentSink.cpp, 
line 2952] 
CNavDTD::AddLeaf [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 
3219] 
CNavDTD::HandleScriptToken 
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line
1845] 
CNavDTD::OpenContainer [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, 
line
2903] 
CNavDTD::HandleDefaultStartToken
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line 1077] 
CNavDTD::HandleStartToken 
[d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, line
1387] 
CNavDTD::HandleToken [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, 
line 778] 
CNavDTD::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\CNavDTD.cpp, 
line 509] 
nsParser::BuildModel [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, 
line 1219] 
nsParser::ResumeParse [d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, 
line 1135]

nsParser::OnDataAvailable 
[d:\builds\seamonkey\mozilla\htmlparser\src\nsParser.cpp, line
1513]

Comment 1

[Jan Carpenter]

Attachment: attaching testcase

Comment 2

[gerardok]

Changed to critical P1, and added crash and beta1 keywords.

Comment 3

[Phil Peterson]

PDT+. Would like to have an ETA.

Comment 4

[vidur (gone)]

Why is this PDT+? I don't understand why it's so critical. No wonder the PDT+ 
numbers aren't going down - this is not a beta showstopper by any means.

Comment 5

[vidur (gone)]

To clarify - this is DOM Level 1 method. No existing pages depend on its 
existence or correctness.

Comment 6

[vidur (gone)]

Please reconsider PDT+ designation.

Comment 7

[vidur (gone)]

The crash occurs because the frame constructor calls SetInitialChildList on the 
inner table frame rather than the outer. Chris mentioned that he fixed this in 
his local tree while helping Harish deal with bug 26488. Forwarding this bug to 
him to close out when he gets his change in.

Comment 8

[leger]

Putting on PDT- radar for beta1.

Comment 9

[Antti Näyhä]

The bug is there on WinNT4 SP6a build (2000022808) as well.

Verifying the bug report as valid and definitive & adding testcase keyword.

Comment 10

[karnaze (gone)]

Fixed.

Comment 11

[Antti Näyhä]

Verifying Fixed.

Comment 13

[Jesse Ruderman]

Crashtest added as part of http://hg.mozilla.org/mozilla-central/rev/5a6def05ccbc