32782 - Brouser crashed against a bad table tag.

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect, P3)

Description

[YONEMURA Kaoru]

At http://www.f-o-rainbow.com/temp/crash2.html, while mozilla saw a bad tag 
</BR> in a table between two <tr></tr>s, Mozilla always crashes.
While I was trying to identify this bug, I could find another -or the same- 
bug, which is demonstrated at http://www.f-o-rainbow.com/temp/crash.html .
Just after clicking other window to move focus on after opening the crash.html, 
Mozilla crashes everytime.
In crash.html, there is a teble tagged with <table><tr>...</tr></BR></table>.

BuildID:2000032109(maybe, 2000032108... I saw their difference in the installer 
and the browser)

Comment 1

[YONEMURA Kaoru]

I checked it again and again at 
buildID: 2000032211,2000032309,2000032409,2000032509,2000032516...

Comment 2

[Gervase Markham [:gerv]]

-> Parser.

Gerv

Comment 3

[Gervase Markham [:gerv]]

Still crashing in 2000-04-14:

MOZILLA caused an invalid page fault in
module <unknown> at 0000:ffffe673.
Registers:
EAX=603292a3 CS=015f EIP=ffffe673 EFLGS=00010206
EBX=00000001 SS=0167 ESP=0068f710 EBP=0068f728
ECX=0068f72c DS=0167 ESI=0068f72c FS=12bf
EDX=00752b34 ES=0167 EDI=00a91060 GS=0000
Bytes at CS:EIP:

Stack dump:
60321b75 0000006a 00a91060 00000000 01ca52f0 01ca5418 0068f74c 603292a3 00000001 
0000006a 00000003 01ca52f0 00000064 00000000 00000001 0068f774 

Confirming.

Gerv

Comment 4

[rickg]

Table crash for you.

Comment 5

[Gervase Markham [:gerv]]

Minimal test case attached; here's another (perhaps more informative) crash 
report:

MOZILLA caused an invalid page fault in
module GKPARSER.DLL at 015f:60321b72.
Registers:
EAX=00000000 CS=015f EIP=60321b72 EFLGS=00010206
EBX=00000001 SS=0167 ESP=0068f75c EBP=0068f770
ECX=0068f7c4 DS=0167 ESI=0068f7c4 FS=0daf
EDX=0073be5c ES=0167 EDI=00a924a0 GS=0000
Bytes at CS:EIP:
ff 50 04 e9 a2 01 00 00 8d 43 ff 83 f8 0e 0f 87 
Stack dump:
00000000 00a924a0 00a92460 01839440 01875f70 0068f838 60322ab4 00000001 00000000 
00000000 01839440 01875f70 007b0dd0 60357d58 00770000 0eaa0050 

Gerv

Comment 6

[Gervase Markham [:gerv]]

Attachment: test case (distilled from those in comments)

Comment 7

[harishd]

<BR> token was getting recycled twice. FIXED now.

Comment 8

[leger]

Adding crash keyword

Comment 9

[Jan Carpenter]

Verified
2000-07-07-10-M17