Reference to offsetParent from HTML node causes segfault

VERIFIED FIXED

Status

()

P3
critical
VERIFIED FIXED
19 years ago
10 years ago

People

(Reporter: matchen, Assigned: jst)

Tracking

({crash, testcase})

Trunk
x86
Windows NT
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

19 years ago
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT)
BuildID:    2000022820

From JavaScript, if I access certain HTML DOM nodes and try to access the 
offsetParent property, Mozilla segfaults.  This seems to happen for <HTML>, 
<HEAD>, and <TITLE> nodes...so far.

Reproducible: Always
Steps to Reproduce:
Load the following:

<html>
  <head>
    <title></title>
    <script type="text/javascript">
      function go()
      {
        var node = document.documentElement;
        alert(node.offsetParent);
      }
    </script>
  </head>
  <body onload="go();">
    <h1>Hello, world!</h1>
  </body>
</html>

Actual Results:  Mozilla goes away and I get an exception popup.

Expected Results:  Mozilla shouldn't go away and give me an exception screen.

Comment 1

19 years ago
Confirming bug. Successfully reproduced on PC/Linux
with build 2000-04-10-08. Adding crash keyword.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: crash, testcase

Comment 2

19 years ago
Created attachment 7522 [details]
The testcase reported by the author.
(Assignee)

Comment 3

19 years ago
I just checked in a fix for this, marking FIXED.
Status: NEW → RESOLVED
Last Resolved: 19 years ago
Resolution: --- → FIXED

Comment 4

19 years ago
Verified with 2000-02-22-08.

Comment 5

19 years ago
Verified with 2000-02-22-08.
Status: RESOLVED → VERIFIED

Comment 6

10 years ago
Plenty of tests covering offsetParent, no need to add this testcase.
Flags: in-testsuite+
You need to log in before you can comment on or make changes to this bug.