13570 - Object tag: appending a child node causes a crash

Status: VERIFIED FIXED

(Core :: Layout, defect, P3)

Description

[Michael Schumann]

appending a child node to an HTML Object tag causes a crash.

Test script is:

var theObject = <a reference to an Object object>
var text = document.createTextNode("hello");
theObject appendChild(text);

I also tried using the insertAdjacentHTML script and get a similar crash even
when inserting "afterEnd".

Comment 1

[troy]

I need an actual HTML test case that shows:
1. when the JavaScript runs, e.g., in the on load handler or in a on click
handler
2. how the OBJECT tag is defined

That way I know I'm looking at the same problem, and I can be sure the problem
you describe is really fixed

Marking INVALID. Please reopen with the test case

Comment 2

[Michael Schumann]

I ceated a test case at the attached URL, but it looks like the problem has
been fixed in the 9/10/99 build. Not sure what should be done with the bug at
this point, so I am reopening it.

Comment 3

[troy]

Thanks for the test case. I'll test it out with my build and if it works for me,
too, then I'll mark it WORKSFORME.

Comment 4

[troy]

It doesn't crash for me either, but it does hit an assert and there is a real
problem that needs to get fixed

Comment 5

[troy]

Fixed. No assert in debug mode and the underlying problem is corrected

Comment 6

[Chris Petersen]

Fixed in the Sept 16th build.