Closed Bug 859 Opened 26 years ago Closed 26 years ago

crash with LI in table

Categories

(Core :: DOM: HTML Parser, defect, P2)

x86
Windows NT
defect

Tracking

()

VERIFIED FIXED

People

(Reporter: buster, Assigned: rickg)

References

()

Details

see the minimized test case below.  The <LI> in combination with the missing
</TD> cause a TR to be inserted as a child of the LI.  Frames to get created in
an illegal sequence and this leads to a crash in table frames.  A dump of the
content at the time of the crash follows the test case.

------------ Test case -----------------

<HTML><BODY>
<TABLE BORDER=1>
  <TR>
    <TD>
      <LI>Item 1
      <LI>Item 2
      <LI>Item 3
      <!-- note the missing /td -->

  <tr>
    <td colspan=3>last thing in the table</td>
  </tr>
</TABLE>

</BODY></HTML>


------------ Content Dump --------------
HTML refcount=9<
  HEAD refcount=4<
  BODY refcount=7<
    Text refcount=3<\n>
    TABLE BORDER=1 refcount=5<
      TBODY refcount=4<
        TR refcount=5<
          TD refcount=6<
            Text refcount=3<\n      >
            LI refcount=4<
              Bullet RefCnt=3<>
              Text refcount=3<Item 1\n      >
            LI refcount=3<
              Bullet RefCnt=3<>
              Text refcount=3<Item 2\n      >
            LI refcount=3<
              Bullet RefCnt=3<>
              Text refcount=3<Item 3\n      \n\n  >
              TR refcount=4<
                TD COLSPAN=3 refcount=6<
                  Text refcount=3<last thing in the table>
              Text refcount=3<\n>
      COLGROUP refcount=4<
        COL refcount=4<
Status: NEW → ASSIGNED
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
LI's now correctly autoclose.
Status: RESOLVED → VERIFIED
above test page URL doesn't crash anymore...
You need to log in before you can comment on or make changes to this bug.