205160 - Mouseover link with onMouseOver="document.write()" crashes mozilla [@ nsIFrame::GetFrameState]

Status: VERIFIED DUPLICATE of bug 204781

(Core :: Layout, defect)

Description

[Lorenzo Colitti]

User-Agent:       Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.4b) Gecko/20030507
Build Identifier: Mozilla/5.0 (Windows; U; Win 9x 4.90; en-US; rv:1.4b) Gecko/20030507

If you mouseover a href which has onMouseOver=document.write(), mozilla will
crash every time.

This is sufficient to crash mozilla, if you mouseover it:

<a href="#" onMouseOver="document.write('hello');">Mouseover to crash</a>

I tested whis with 1.4b (2003050714) on WinME and today's trunk build on WinXP.

Reproducible: Always

Steps to Reproduce:
1. Load testcase
Actual Results:  
Crash in gklayout.dll

Expected Results:  
No crash

Comment 1

[Lorenzo Colitti]

Attachment: testcase

Mouseover link to crash

Comment 2

[Lorenzo Colitti]

I would add a Talkback ID, but Talkback seems to be down.

Comment 3

[Lorenzo Colitti]

Talkback ID TB19955920M

Comment 4

[Christian :Biesinger (don't email me, ping me on IRC)]

Attachment: Stacktrace (Linux)

Comment 5

[Christian :Biesinger (don't email me, ping me on IRC)]

|this| is null at nsIFrame::GetFrameState

Comment 6

[Hermann Schwab]

TB19957293M Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4b) Gecko/20030509
Talkback is working again, showing details about what is sent.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Dup based on stack.

*** This bug has been marked as a duplicate of 204781 ***

Comment 8

[Lorenzo Colitti]

Verified: now attachment 122882 [details] [diff] [review] is checked in, this is fixed.