74431 - crash when mousing over javascripted buttons

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Russell Belfer]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; 0.8.1)
BuildID:    2001032904

There is a row of red buttons near the top of the page reading: "Dedicated
Hosting" "Complex Hosting" "Why Rackspace" etc.  The browser crashes when I move
the mouse back and forth over these buttons.

Page appears to use some Macromedia menuing system.  The buttons seem to make up
some menu (not that I can view it correctly).  Here is sample HTML for one of
the buttons in the menu:

<a href="/dedicated/dedicated_overview.php"
onMouseOver="MM_swapImage('menu_dedicated_hosting_bttn','','/images/menu_dedicated_hosting_on.gif',1);RS_enterMenu('dedicatedMenu');MM_showHideLayers('dedicatedMenu','','show','complexMenu','','hide','whyrsMenu','','hide','supportMenu','','hide','infrastructureMenu','','hide','aboutusMenu','','hide','partnersMenu','','hide','searchPopup','','hide')"
onMouseOut="MM_swapImgRestore();RS_leaveMenu('dedicatedMenu');">
<img src="/images/menu_dedicated_hosting.gif"
width=115 height=17 border=0 name="menu_dedicated_hosting_bttn"
alt="[Dedicated Hosting]">
</a>

When I move the mouse off of a button, the browser crashes.


Reproducible: Always
Steps to Reproduce:
1. go to http://www.rackspace.com
2. site will redirect to http://www.rackspace.com/index.php
3. move mouse over red button labelled "Dedicated Hosting"
4. move mouse to right off of button and onto "Complex Hosting" button
5. browser will crash


Actual Results:  I get a Windows NT crash box.

Expected Results:  I think it should display an alternate image for the
moused-over button and possibly some sort of javascript popup menu, but I'm not
certain.

I'm running Windows NT 4.0 SP 3 and a relatively recent build of mozilla.
I'm sorry I can't fill in the module in which mozilla crashed, but if I go to
the page to recreate the crash now, I will lose all of the text that I've typed
into this form.

Comment 1

[Johnny Stenback (:jst)]

Wow, I'm amazed we didn't run into this sooner, this is a regression caused by
ma a few weeks ago, here's the fix:

Index: html/document/src/nsHTMLDocument.cpp
===================================================================
RCS file: /cvsroot/mozilla/content/html/document/src/nsHTMLDocument.cpp,v
retrieving revision 3.323.2.2
diff -u -r3.323.2.2 nsHTMLDocument.cpp
--- nsHTMLDocument.cpp	2001/04/01 10:30:36	3.323.2.2
+++ nsHTMLDocument.cpp	2001/04/02 21:27:34
@@ -3406,7 +3406,7 @@
 
   nsIContent *e = NS_STATIC_CAST(nsIContent *, mIdHashTable.Get(&key));
 
-  if (e) {
+  if (e && e != ELEMENT_NOT_IN_TABLE) {
     nsCOMPtr<nsIAtom> tag;
     e->GetTag(*getter_AddRefs(tag));
 
Eric, r=?, Vidur, sr=?

Comment 2

[Eric Pollmann]

r=[e-mail] - check it in!  :)

Comment 3

[vidur (gone)]

sr=vidur.

Comment 4

[Johnny Stenback (:jst)]

Fix checked in.

Comment 5

[Blake Ross]

marking fixed.

Comment 6

[Prashant Desale]

Verified with 2001-05-22-04.