294984 - Crash on data URI with unclosed iframe

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Boris Zbarsky [:bzbarsky]]

The URL in the URL field crashes today's build quite reliably.

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

I suck. There's an early return in ConsumeStartTag that doesn't enforce the
invarients that I try to.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: patch v1

The early return was causing us to not create the text token and end tag, so my
assumptions in CNavDTD were being violated. This patch fixes the early return.
Note that Consume[Parsed]CharacterData() is protected from this case and deals
properly.

Comment 3

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 184145 [details] [diff] [review]
patch v1

This fixes a recent crash regression.

Comment 4

[chris hofmann]

Comment on attachment 184145 [details] [diff] [review]
patch v1

a=chofmann

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked in. Sorry for the inconvenience.

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED with build 2005-05-22-06 on Windows XP Seamonkey trunk.

Testcase: data:text/html,<iframe