294053 - Crash if javascript code is executed over a malformed table

Status: RESOLVED DUPLICATE of bug 268231

(Firefox :: General, defect)

Description

[the fly on the net]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; it-IT; rv:1.7.8) Gecko/20050511 Firefox/1.0.4
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; it-IT; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Executing javascript code that display/hide elements of a HTML table containing
an unallowed element, causes Firefox to crash.

Tested over Windows 2000 SP4 and Windows XP Professional SP2
Friends reports me that the Linux version doesn't crash.

Reproducible: Always

Steps to Reproduce:
1. Click the link "Cliccando qui Firefox va in crash" - it calls the javascript
function DoCrash( ) you see on the source code.

Actual Results:  
Firefox crashes

Expected Results:  
Change the style.display attribute of a table body

firefox.exe has generated errors and will be closed by Windows

Comment 1

[Steve England [:stevee]]

Crashes for me in Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.8)
Gecko/20050509 Firefox/1.0.4
Doesn't crash for me in Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US;
rv:1.8b2) Gecko/20050512 Firefox/1.0+ ID:2005051215

Comment 2

[Steve England [:stevee]]

Allen, could you test the crash with a nightly firefox trunk (1.1alpha) build to
see if this is still a problem; it may have been fixed by one of the 100s of bug
patches already landed.

You can get the latest trunk version at
- http://www.ftp.uni-erlangen.de/pub/mozilla.org/firefox/nightly/latest-trunk/
But I'd advise you to make a new profile for running it (ie: don't use your 1.04
profile with the trunk build).

I submitted a talkback ID for this crash but talkback then crashed itself o_O
Allen - have you submitted the crash information, and if so, what are your
talkbackIDs? You can find them by running /mozilla
firefox/components/talkback.exe - thanks!

Comment 3

[Frank Wein [:mcsmurf]]

duping per stacktrace (talkback id was TB7045997Z)

*** This bug has been marked as a duplicate of 268231 ***