14986 - Browser crashes when I create <p> element with 'style' attribute.

Status: VERIFIED FIXED

(Core :: DOM: CSS Object Model, defect, P2)

Description

[Ramakrishna Reddy Kandula]

Please look at the following code.

HTMLElement.prototype.insertAdjacentHTML = function (sWhere, sText) {
  var r = document.createRange();
  switch (sWhere) {
   case "beforeBegin":
    r.setStartBefore(this);
    this.parentNode.insertBefore(r.createContextualFragment(sText), this);
    break;

   case "afterBegin":
    r.setStartBefore(this.firstChild);
    this.insertBefore(r.createContextualFragment(sText), this.firstChild);
    break;

   case "beforeEnd":
    r.setStartAfter(this.lastChild);
    this.appendChild(r.createContextualFragment(sText));
    break;

   case "afterEnd":
    r.setStartAfter(this);
    this.parentNode.insertBefore(r.createContextualFragment(sText),
this.nextSibling);

    break;
  }
}

var s = '<p>Hello<br>';
var d = document.getElementById("Marker");
d.insertAdjacentHTML("afterEnd", s);

Look at the above code. It works fine as it is.
But if I say
var s = '<p style="color: #FF0000">Hello</p>'
mozilla crashes.

I am using nightly build of 09/24/1999.
This 'style' setting seems to be creating problem.

Element with id "Marker" is as follows.

<hr>
<div id="Marker" style="background-color: black; color: white">
<p>Hello</p>
</div>
<address><a href="mailto:[e-mail]">ramky</a></address>

--
ramky.

Comment 1

[vidur (gone)]

The crash is a result of a missing null-check in
nsGenericHTMLElement::SetAttribute. The code attempts to dereference the
mDocument field which is null because the element hasn't yet been added to the
document. Adding in the null-check isn't quite enough since the style
information will never be incorporated into the inline style sheet.

Handing this one to peterl, since the real fix is style related.

Comment 2

[leger]

Adding crash keyword

Comment 3

[Hixie (not reading bugmail)]

Taking QA Contact on all open or unverified DOM Style bugs...

Comment 4

[Hixie (not reading bugmail)]

can no longer reproduce crash