Crash on certain properties of OPTION, TH or TD

VERIFIED FIXED in mozilla0.8

Status

()

Core
DOM: Core & HTML
--
major
VERIFIED FIXED
18 years ago
10 years ago

People

(Reporter: bc, Assigned: jst)

Tracking

({crash, testcase})

Trunk
mozilla0.8
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [HAVE FIX])

Attachments

(3 attachments)

(Reporter)

Description

18 years ago
1.  Create an OPTION, TH, or TD Element.
    elm = document.createElement('OPTION');

2.  access property via typeof
    typeof(elm['form'])

3.  crash.

Occurs at least for 'form' in Option, 'cellIndex' in TD and TH. Note these
properties are the first properties gotten from a "for (p in elm)" iteration.

Does not occur for 'text' in Option, 'bgColor' in TD and TH.

These are the only Elements that cause this crash.

Mozilla Trunk Build/2001-02-01-04/Win2k
(Reporter)

Comment 1

18 years ago
Created attachment 24324 [details]
test case illustrating crashes and non crashes
(Reporter)

Comment 2

18 years ago
Adding testcase keyword
Keywords: testcase
(Assignee)

Comment 3

18 years ago
These crashes were due to a bunch of missing null ptr checks, I'll attach a fix.
Status: NEW → ASSIGNED
Keywords: crash
OS: Windows 2000 → All
Hardware: PC → All
Whiteboard: [HAVE FIX]
Target Milestone: --- → mozilla0.8
(Assignee)

Comment 4

18 years ago
Created attachment 24334 [details] [diff] [review]
Proposed fix.
(Assignee)

Comment 5

18 years ago
Created attachment 24341 [details] [diff] [review]
Proposed fix that even compiles :-)
(Assignee)

Comment 6

17 years ago
Fix checked in.
Status: ASSIGNED → RESOLVED
Last Resolved: 17 years ago
Resolution: --- → FIXED
Component: DOM Level 1 → DOM HTML

Comment 7

17 years ago
QA contact Update
QA Contact: janc → desale

Comment 8

17 years ago
Verified with 2001-05-22-04.
Status: RESOLVED → VERIFIED

Updated

10 years ago
Component: DOM: HTML → DOM: Core & HTML
QA Contact: desale → general
You need to log in before you can comment on or make changes to this bug.