Closed Bug 275912 Opened 20 years ago Closed 20 years ago

Firefox crashes on malformed HTML [@ js3250.dll ]

Categories

(Firefox :: General, defect)

Product:
Firefox
Component:
General
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: pavel.penaz, Assigned: timeless)

References

Details

(Keywords: crash, stackwanted, testcase)

Crash Data

Attachments

(2 files, 1 obsolete file)

testcase (crash)
27 bytes, text/html
Details
stack trace
8.65 KB, text/plain
Details 
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041224 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20041224 Firefox/1.0+

Firefox crashes when I click the testcase.

Reproducible: Always

Steps to Reproduce:
Attached file testcase (crash) — 
Crashes Firefox..
I could not obtain talkback data because I cannot find downloadable talkback.xpi
working with Firefox Tinderbox builds.
Blocks: Zalewski
Keywords: crash, testcase
WFM, no crash, 20041222 PC/WinXP
TB2732184 with 20041223
Keywords: stackwanted
Summary: Firefox crashes on malformed HTML → Firefox crashes on malformed HTML [@ js3250.dll ]
Confirmed on Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6)
Gecko/20041224 Firefox/1.0+ (stipe)
Status: UNCONFIRMED → NEW
Ever confirmed: true
I can't dup with ff 1.0 but I crash with recent trunk. Could it be the recent
e4x checkin? it seems to crash if you feed the js engine the * character. ie
<script>*</script> will cause a crash. Sounds familiar, though I can't remember
if there is a dup...
WFM with zip trunk build from 20041222, crashes with 20041223..
cc'ing brendan
Attached file stack trace — 

    
    

    
  

      
      
      
      

        Attached patch
          
          
        change test to match use (obsolete)
        — 
          — Splinter Review
      

    


  
Assignee: firefox → timeless
Status: NEW → ASSIGNED

        Attachment #169603 -
        Flags: review?(brendan)

    
    

    
  
Thanks for patching, timeless (typo in patch, but it reminded me that I had a
patch for this too, over under dom/ -- I forgot to land it when at shaver's
behest I enabled E4X).  Fixed.

/be
Status: ASSIGNED → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED

    
    

    
  
Comment on attachment 169603 [details] [diff] [review]
change test to match use

bah, the version i had neil test didn't include a typo

        Attachment #169603 -
        Attachment is obsolete: true

        Attachment #169603 -
        Flags: review?(brendan)

    
    

    
  
WFM with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6)
Gecko/20050101 Firefox/1.0+
Status: RESOLVED → VERIFIED

    
    

    
  
dom/src/base/crashtests/275912-1.html
http://hg.mozilla.org/mozilla-central/rev/b0337b6287f3
Flags: in-testsuite+
Crash Signature: [@ js3250.dll ]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: