293533 - Tag parsing crash bug in FF 1.0.3

Status: VERIFIED DUPLICATE of bug 228557

(Core :: Layout, defect)

Description

[M. LaPlante]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3

I've been using the HTML Manglizer from
http://lcamtuf.coredump.cx/soft/mangleme.tgz to test my 1.0.3 FireFox
installation on Windows XP SP2.  I came across a page which results in a
crash bug.  As soon as the page is loaded, FireFox crashes.  This is 100%
reproducable for me.  I don't have details on the source of the problem.  

I uploaded the page to http://www.cs.rpi.edu/~laplam/crash1.htm so you can view
it live.  I've also attached the source code for the page, so
hopefully someone with greater knowledge can locate the source of the problem.

Talkback reports filed as a result of this:
TB5703978W, TB5704527E, TB5704472Z

Reproducible: Always

Steps to Reproduce:

Comment 1

[M. LaPlante]

Attachment: HTML source that crashes FireFox (tarred).

To test, untar the source file and load it into FF.

Comment 2

[Peter van der Woude [:Peter6]]

Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.8b2) Gecko/20050509
Firefox/1.0+

WFM (no crash)

Comment 3

[Jaime Mitchell (use [e-mail] for email)]

TB5703978W suggests this is a dupe of bug 228557

Comment 4

[Matthias Versen [:Matti]]

*** This bug has been marked as a duplicate of 228557 ***