106505 - <AHREF="foo.. crashes browser

Status: VERIFIED DUPLICATE of bug 106527

(Core :: Layout, defect)

Description

[Tom]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i586; en-US; rv:0.9.5+) Gecko/20011024
BuildID:    2001102408

http://newsforge.com has a <AHREF="foo..> instead of <A HREF="foo..> and this is
crashing the browser. See TB37128868Z. This problem began with Build ID
2001102406 and continues with Build ID 2001102408.

Reproducible: Always

Comment 1

[Christopher Aillon (sabbatical, not receiving bugmail)]

Attachment: simple testcase to crash you

Comment 2

[Christopher Aillon (sabbatical, not receiving bugmail)]

Sounds like parser or layout but possibly something else.  FWIW, my TBID is
TB37129995Z

Comment 3

[Sterling Bates]

Testcase does not crash on Mozilla Win2k build 2001102203.  Renders "Foo" in
normal times roman.

Comment 4

[Ashley Bischoff (blog at handcoding.com)]

CC: [e-mail], for talkback retrieval, please (TB37129995Z)

Comment 5

[R.K.Aa.]

hmm that site hasn't crashed before... is it bug 106527?

Comment 6

[[e-mail] (gone - use [e-mail] instead)]

Incident ID 37129995
Stack Signature HTMLAttributesImpl::SetAttributeName() d983bfef
Bug ID
Trigger Time 2001-10-24 11:34:05
Email Address [e-mail]
URL visited
User Comments Viewing page with <ahref instead of <a href
Build ID 2001102408
Product ID MozillaTrunk
Platform ID LinuxIntel
Trigger Reason SIGSEGV: Segmentation Fault: (signal 11)
Stack Trace
HTMLAttributesImpl::SetAttributeName()
HTMLAttributesImpl::SetAttributeFor()
HTMLStyleSheetImpl::SetAttributeFor()
nsGenericHTMLElement::SetAttr()
HTMLContentSink::AddAttributes()
SinkContext::OpenContainer()
HTMLContentSink::OpenContainer()
CNavDTD::OpenContainer()
CNavDTD::HandleDefaultStartToken()
CNavDTD::HandleStartToken()
CNavDTD::HandleToken()
CNavDTD::BuildModel()
nsParser::BuildModel()
nsParser::ResumeParse()
nsParser::OnDataAvailable()
nsDocumentOpenInfo::OnDataAvailable()
nsStreamListenerTee::OnDataAvailable()
nsHttpChannel::OnDataAvailable()
nsOnDataAvailableEvent::HandleEvent()
nsARequestObserverEvent::HandlePLEvent()
PL_HandleEvent()
PL_ProcessEventsBeforeID()
processQueue()
nsVoidArray::EnumerateForwards()
nsAppShell::ProcessBeforeID()
handle_gdk_event()
libgdk-1.2.so.0 + 0x17de4 (0x4033bde4)
libglib-1.2.so.0 + 0x10c26 (0x4036dc26)
libglib-1.2.so.0 + 0x11253 (0x4036e253)
libglib-1.2.so.0 + 0x1141c (0x4036e41c)
libgtk-1.2.so.0 + 0x9285c (0x4028685c)
nsAppShell::Run()
nsAppShellService::Run()
main1()
main()
libc.so.6 + 0x1cbaf (0x404b6baf) 

Comment 7

[Markus Gerstel]

seeing w/ current cvs debug build linux. backtrace pending...

Comment 8

[Markus Gerstel]

Attachment: gdb backtrace

Comment 9

[Christopher Aillon (sabbatical, not receiving bugmail)]

Based on the backtrace and stack duping to 106527 as rkaa noted.

*** This bug has been marked as a duplicate of 106527 ***

Comment 10

[R.K.Aa.]

verified dup.

I crashed with a build from before the checkin for bug 106527.
Pulled and built again immediately after the checkin: no more crash.