67563 - Crash on certain properties of OPTION, TH or TD

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Bob Clary [:bc] (inactive)]

1.  Create an OPTION, TH, or TD Element.
    elm = document.createElement('OPTION');

2.  access property via typeof
    typeof(elm['form'])

3.  crash.

Occurs at least for 'form' in Option, 'cellIndex' in TD and TH. Note these
properties are the first properties gotten from a "for (p in elm)" iteration.

Does not occur for 'text' in Option, 'bgColor' in TD and TH.

These are the only Elements that cause this crash.

Mozilla Trunk Build/2001-02-01-04/Win2k

Comment 1

[Bob Clary [:bc] (inactive)]

Attachment: test case illustrating crashes and non crashes

Comment 2

[Bob Clary [:bc] (inactive)]

Adding testcase keyword

Comment 3

[Johnny Stenback (:jst)]

These crashes were due to a bunch of missing null ptr checks, I'll attach a fix.

Comment 4

[Johnny Stenback (:jst)]

Attachment: Proposed fix.

Comment 5

[Johnny Stenback (:jst)]

Attachment: Proposed fix that even compiles :-)

Comment 6

[Johnny Stenback (:jst)]

Fix checked in.

Comment 7

[Prashant Desale]

QA contact Update

Comment 8

[Prashant Desale]

Verified with 2001-05-22-04.