Table cell access using described method crashes browser.

VERIFIED FIXED in M15

Status

()

P3
normal
VERIFIED FIXED
19 years ago
18 years ago

People

(Reporter: taras.tielkes, Assigned: vidur)

Tracking

({crash})

Trunk
crash
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [HAVE FIX], URL)

Attachments

(2 attachments)

(Reporter)

Description

19 years ago
Here is a sample HTML file:

There are three different methods user to access the cell value
(commented as 1,2,3). All three work in IE5/WinNT.

 (1) will crash Mozilla nightly build Feb19 (ID: 20000 21808)
 (2) works fine (this is the right way I guess)
 (3) will not work is Mozilla (and should not work IMHO)

I believe (1) is right and should work.(Or at least not crash)
--------------------------------------------------
<html>
<head>
<script>
function fnTable()
{
	var oTable = document.getElementById("oTable");
	//var oCellValue = oTable.rows.item(0).cells.item
(0).firstChild.nodeValue; // ** (1)
	//var oCellValue = oTable.rows[0].cells
[0].firstChild.nodeValue;           // ** (2)
	//var oCellValue = oTable.rows(0).cells
(0).firstChild.nodeValue;           // ** (3)
	alert(oCellValue);
}
</script>
</head>
<body>
<TABLE ID="oTable" WIDTH="75%" BORDER=1 CELLSPACING=0 CELLPADDING=0 
background="" style="WIDTH: 75%" onclick="fnTable()">
	<TR ID="oRow">
		<TD>1</TD>
		<TD>2</TD>
		<TD>3</TD>
		<TD>4</TD>
		<TD>5</TD>
	</TR>
</TABLE>
</body>
</html>
------------------------------------
(Reporter)

Comment 1

19 years ago
var oCellValue = oTable.rows.item(0).nodeName;
----------------------------------------------
Above line will also produce a crash.(Instead of the string "TR")

Comment 2

19 years ago
I can not see the crash in Windows 2000. The only thing I get with a current 
build (from this night) is the following message on the console.

JavaScript Error: TypeError: (0).firstChild has no properties
URL: file:///j|/mozilla/bug28489.html
LineNo: 8

Comment 3

19 years ago
I forgot to say that I get the message when clicking in a table cell.
(Reporter)

Comment 4

19 years ago
Yes, the JavaScript code is in the "onclick" handler for the table.

Using a nightly build (ID 20000 21916) I still have a crash running the code at 
(1).
Found the problem, fixed the problem. I'll attach the patch and I'll try to get
the patch checked in for M15. The crash happend when accessing an uninitialized
pointer.
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
OS: Windows NT → All
Hardware: PC → All
Whiteboard: [HAVE FIX]
Target Milestone: M15

Comment 7

19 years ago
changing qa contact
(has this patch gone in yet?)
QA Contact: gerardok → janc

Comment 8

19 years ago
I don't get this crash on any platform.
I'll mark it verified if someone will mark it fixed...
(Reporter)

Comment 9

19 years ago
Created attachment 6653 [details]
Simple testcase for the desc. behaviour with a March18 beta 1 nightly build
(Reporter)

Comment 10

19 years ago
Actually the button handlers try to access diffrent cells, but the text on the 
buttons doesn't reflect this.
I just checked in the attached patch, the patch does the right thing even if
this crash isn't reproduceable right now. Marking FIXED.

t.r.tiekes@zap.a2000.nl, I tested your testcase and the two first work but IMO
the third should *not* work, even if it does so in IE.
Status: ASSIGNED → RESOLVED
Last Resolved: 19 years ago
Resolution: --- → FIXED
(Reporter)

Comment 12

19 years ago
jst@netscape.com, I agree.

(1) and (2) working, and (3) not working is the behaviour I would expect.

Comment 13

19 years ago
Adding crash keyword
Keywords: crash
(Reporter)

Comment 14

19 years ago
It seems that the third syntax, using xxx.rows(r).cells(c).xxx now also works 
in Mozilla.

Since some people mentioned that the syntax is incorrect, I'm in doubt here. 
Anyone care to comment?
(Assignee)

Comment 15

19 years ago
I'd be surprised if (3) returns the right results. It would only work correctly 
if row and cell were functions and they are not. Does the () syntax for 
indexing come from VB? If so, that's probably why IE allows it.
(Reporter)

Comment 16

19 years ago
Vidur, I stand corrected. 

Simply a case of a wrong browser window.(Using IE5)

Comment 17

19 years ago
verified fixed
2000-08-18-06-M18 : Linux
2000-08-18-08-M18 : Win32
2000-08-18-08-M18 : Mac
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.