Closed
Bug 859
Opened 26 years ago
Closed 26 years ago
crash with LI in table
Categories
(Core :: DOM: HTML Parser, defect, P2)
Tracking
()
VERIFIED
FIXED
People
(Reporter: buster, Assigned: rickg)
References
()
Details
see the minimized test case below. The <LI> in combination with the missing </TD> cause a TR to be inserted as a child of the LI. Frames to get created in an illegal sequence and this leads to a crash in table frames. A dump of the content at the time of the crash follows the test case. ------------ Test case ----------------- <HTML><BODY> <TABLE BORDER=1> <TR> <TD> <LI>Item 1 <LI>Item 2 <LI>Item 3 <!-- note the missing /td --> <tr> <td colspan=3>last thing in the table</td> </tr> </TABLE> </BODY></HTML> ------------ Content Dump -------------- HTML refcount=9< HEAD refcount=4< BODY refcount=7< Text refcount=3<\n> TABLE BORDER=1 refcount=5< TBODY refcount=4< TR refcount=5< TD refcount=6< Text refcount=3<\n > LI refcount=4< Bullet RefCnt=3<> Text refcount=3<Item 1\n > LI refcount=3< Bullet RefCnt=3<> Text refcount=3<Item 2\n > LI refcount=3< Bullet RefCnt=3<> Text refcount=3<Item 3\n \n\n > TR refcount=4< TD COLSPAN=3 refcount=6< Text refcount=3<last thing in the table> Text refcount=3<\n> COLGROUP refcount=4< COL refcount=4<
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•