Closed Bug 51204 Opened 24 years ago Closed 24 years ago

combination of tags causes crash

Categories

(Core :: Layout, defect, P3)

Product:
Core
Component:
Layout
Type:
defect

Tracking

()

Status:
VERIFIED DUPLICATE of bug 50994

People

(Reporter: tarahim, Assigned: harishd)

Details

(Keywords: crash) 

The following HTML caused crash in M18-2000090110
<HTML lang="ja">
<HEAD>
</HEAD>
<BODY >
<UL>
<LI>
<LI>
</UL>
</BODY>
</HTML>

It seems the combination of <UL> and <LI> is the cause.
Maybe related to 50852.
Can't confirm on Linux 2000-09-02-08.
50852 is also Mac only.  But www.abcsports.go.com does not have <LI> tag in its 
source.

Works for me, Mac 2000-09-03-08 on OS9... maybe it's some localisation issue?
I'll try with 8.6 and I'll followup if it hurts me (otherwise, assume it doesn't).
Keywords: crash
Sorry, I omitted a line in the offending HTML.  Here is the correct one that crashes M18-2000090408.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN">
 <HEAD>
</HEAD>
<BODY >
<UL>
<LI>
<LI>
</UL>
</BODY>
</HTML>

Verified on MacOS 9.0.4 using Build 2000-09-04-08 (English).  Regressed to 2000-
08-28-08 and it didn't fail there.  Also, tried putting in content to <LI> lines:

<UL> 
<LI> testing 1
<LI> testing 2
</UL> 

Also tried:
<OL TYPE = "i"> 
<LI> testing 1
<LI> testing 2
</OL> 

Just to make sure it didn't act funny there-since 2000-08-28-08 build shows only 
*one* item instead of two.  That didn't help-all cases crashed the app.  Changing 
to NEW status.
Status: UNCONFIRMED → NEW
Ever confirmed: true
attempting to triage Clayton's bugs

Confirmed on NT. Looks like a parser problem, assigning to 
harishd@netscape.com. Changing platform to all. Here's the stack trace:

nsCParserNode::GetNodeType() line 232 + 12 bytes
HTMLContentSink::CloseContainer(HTMLContentSink * const 0x00f47300, const 
nsIParserNode & {...}) line 3091 + 11 bytes
CElement::CloseContainer(nsIParserNode * 0x027a2f60, nsHTMLTag eHTMLTag_li, 
nsDTDContext * 0x027635b0, nsIHTMLContentSink * 0x00f47300) line 322
CElement::CloseContainerInContext(nsIParserNode * 0x027a2f60, nsHTMLTag 
eHTMLTag_li, nsDTDContext * 0x027635b0, nsIHTMLContentSink * 0x00f47300) line 
350
CElement::HandleStartToken(nsIParserNode * 0x027a2db0, nsHTMLTag eHTMLTag_li, 
nsDTDContext * 0x027635b0, nsIHTMLContentSink * 0x00f47300) line 2773
CLIElement::HandleStartToken(nsIParserNode * 0x027a2db0, nsHTMLTag eHTMLTag_li, 
nsDTDContext * 0x027635b0, nsIHTMLContentSink * 0x00f47300) line 997
COtherDTD::HandleStartToken(CToken * 0x0285a058) line 784 + 33 bytes
COtherDTD::HandleToken(COtherDTD * const 0x027639b0, CToken * 0x0285a058, 
nsIParser * 0x00f44670) line 584 + 12 bytes
COtherDTD::BuildModel(COtherDTD * const 0x027639b0, nsIParser * 0x00f44670, 
nsITokenizer * 0x027633e0, nsITokenObserver * 0x00000000, nsIContentSink * 
0x00f47300) line 479 + 20 bytes
nsParser::BuildModel() line 1978 + 34 bytes
nsParser::ResumeParse(int 1, int 0) line 1859 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x00f44678, nsIChannel * 0x02b310a0, 
nsISupports * 0x00000000, nsIInputStream * 0x02b34e40, unsigned int 0, unsigned 
int 119) line 2309 + 19 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x02b35520, 
nsIChannel * 0x02b310a0, nsISupports * 0x00000000, nsIInputStream * 0x02b34e40, 
unsigned int 0, unsigned int 119) line 251 + 46 bytes
nsFileChannel::OnDataAvailable(nsFileChannel * const 0x02b310a8, nsIChannel * 
0x02b31630, nsISupports * 0x00000000, nsIInputStream * 0x02b34e40, unsigned int 
0, unsigned int 119) line 673 + 49 bytes
nsOnDataAvailableEvent::HandleEvent(nsOnDataAvailableEvent * const 0x02b32760) 
line 400 + 47 bytes
nsStreamListenerEvent::HandlePLEvent(PLEvent * 0x02b32710) line 97 + 12 bytes
PL_HandleEvent(PLEvent * 0x02b32710) line 589 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00f1cf50) line 526 + 9 bytes
_md_EventReceiverProc(HWND__ * 0x0992028a, unsigned int 49406, unsigned int 0, 
long 15847248) line 1059 + 9 bytes
USER32! 77e7124c()
00f1cf50()
Assignee: clayton → harishd
OS: Mac System 8.6 → All
Hardware: Macintosh → All

*** This bug has been marked as a duplicate of 50994 ***
Status: NEW → RESOLVED
Closed: 24 years ago
Resolution: --- → DUPLICATE
Ok verified dupe of fixed bug 50994: "Crashing in nsCParserNode::GetNodeType,
with strict DOCTYPE and unclosed tags"
Tested with linux 2000090708. Now it works.
Status: RESOLVED → VERIFIED
SPAM. HTML Element component deprecated, changing component to Layout. See bug
88132 for details.
Component: HTML Element → Layout
You need to log in before you can comment on or make changes to this bug.