434071 - Adding innerHTML to a TT element creates additional TT elements.

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[Max Katz]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14

Adding innerHTML containing a <div> to a TT element in JavaScript creates additional TT elements.  Discovered while adding innerHTML to all TT elements in the page with a loop -- the result crashed the browser completely, without detecting the runaway JavaScript.  Code that initiates the bug can be found at http://www.deluxecode.com/mozillabug/index.html

WARNING: It may crash your browser outright.  View source before clicking on anything.

Reproducible: Always

Steps to Reproduce:
1. Traverse <tt> elements on the page.
2. Add innerHTML containing a <div> with text in it to each.  i.e.: <div>txt</div>
3. Profit!
Actual Results:  
Perpetual hang; total crash.  Entire system performance suffered for several minutes before killing the process.

Expected Results:  
Split the <tt> into two lines with a <div> element in the middle containing text.

The only tag I can reproduce this with so far is <tt>.  Also tried <cite> & undefined tags (i.e. <mytag>) without reproducing results.  However, other tags may still exist with the same properties.  Specifically, I haven't tested <pre> yet, which has a similar effect on formatting and may suffer from the same bug.

Comment 1

[u88484]

This bug was reported using a version of Firefox that security and stability updates are no longer provided for.  All users are strongly encouraged to upgrade to Firefox 3 by selecting 'Check for Updates' in the Help menu or by going to http://www.mozilla.com/en-US/firefox/firefox.html

If you can no longer reproduce this bug using the latest Firefox 3.0.x version, please change the status of this bug to 'RESOLVED' 'WORKSFORME'.

If you can still reproduce this bug, please provide additional details to help resolve this issue.

Comment 2

[Tanner M. Young [:tmyoung]]

Max: The link for the page is an HTTP/404 File Not Found.

Since this is for FF 2.0, Resolving as WORKSFORME.  If the issue appears in Firefox 3.5, we will reopen this bug.

If you can reproduce it on 3.5, please add a stack trace for the crash so we can analyze it, and provide a link with the testcase you had earlier.

Thank you.