85907 - problem with unterminated framesets

Status: RESOLVED DUPLICATE of bug 43464

(Core :: DOM: HTML Parser, defect)

Description

[jap3003]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:0.9.1+) Gecko/20010613
BuildID:    2001061304

If you examine it under Internet Exploitable 6, the above URL looks fine.  With
mozilla, you get two frames: http://www.phys.ksu.edu/people/frame1.html and
http://www.phys.ksu.edu/people/white.html

Upon examining the code, you find that the author left out a </frameset> tag. 
What reads:
====
 <frameset COLS="100%" BORDER="0">
<frame NAME="frame1" noresize SCROLLING="no" SRC="frame1.html">
<frameset COLS="200,*" BORDER="0">
====
should read:
====
    <FRAMESET COLS="100%" BORDER="0">
      <FRAME NAME="frame1" noresize SCROLLING="no"
SRC="http://www.phys.ksu.edu./people/frame1.html">
    </FRAMESET>
    <FRAMESET COLS="200,*" BORDER="0">
====
[Indeed, I verified this myself, and it worked.  I also wrote the department to
fix their HTML.  Unfortunately, since we're slowly converting to an all-Mc$oft
shop and IE works fine, I don't know whether they'll fix it or not.  *sigh*]

Bottom line: IE guesses right this time, Mozilla guesses wrong.  I *think* we
should guess based on the fact that the frameset in question already had all of
its frames declared (one, at 100% of the columns) and *assume* that, since all
declared frames have been implemented, that the author really wanted a
</frameset> tag there.

As an addition, it might be nice to have a browser console like the JavaScript
and Java consoles, to help authors see where their code is munged.  Furthermore,
it'd be nice (maybe) to give users the ability to turn the above functionality
off, since we might end up guessing wrong on occasion.

Reproducible: Always
Steps to Reproduce:
1.Creatively munge a frameset by not terminating it appropriately
2.Sit back and enjoy the fracas.
3.

Comment 1

[David Einstein]

The page also displays correctly on NS 4.77.  
The component should probably be parser.

Comment 2

[timeless]

can someone verify that this page is handled in navquirks mode?

Comment 3

[Boris Zbarsky [:bzbarsky]]

Looks like it is.... When I run with a debug build, the console messages claim
that the quirk stylesheet is enabled.

Comment 4

[bsharma]

Verified on
build: 2001-06-27-04-Trunk
platform: Win NT

The page's content is not complete. It renders fine in NS 4.7.

Comment 5

[harishd]

Attachment: Testcase [ make sure that frame1.html,frame2.html,frame3.html,frame4.html exist in your cwd ]

Comment 6

[harishd]

The source for the above testcase looks like this:

<HTML>
<HEAD><TITLE>People</TITLE></HEAD>
  <FRAMESET ROWS="108, *" BORDER="0">
    <FRAMESET COLS="100%" BORDER="0">
      <FRAME NAME="frame1" noresize SCROLLING="no" SRC="frame1.html">
      <FRAMESET COLS="200,*" BORDER="0">
        <FRAME NAME="frame2" noresize SCROLLING="no" SRC="frame2.html">
        <FRAMESET ROWS="58,*" BORDER="0">
          <FRAME NAME="frame3" noresize SCROLLING="no" SRC="frame3.html">
          <FRAME NAME="frame4" noresize SCROLLING="auto" SRC="frame4.html">
        </FRAMESET>
      </FRAMESET>
    </FRAMESET>
  </FRAMESET>
</HTML>

Note: Removing <FRAME NAME="frame1" noresize SCROLLING="no" SRC="frame1.html">
causes other frames to render!

Comment 7

[harishd]

Here is the content model:

docshell=01366E80
html@02EE5E90 refcount=3<
  head@02EE5DA0 refcount=2<
    title@02EF4C40 refcount=2<
      Text@02EF4BE0 refcount=2<People>
    >
  >
  Text@02EF17E0 refcount=3<\n>
  frameset@02EF3F30 rows=108, * border=0 refcount=4<
    frameset@02EF3CA0 cols=100% border=0 refcount=3<
      frame@02EF3980 name=frame1 noresize= scrolling=No src=frame1.html refcount
=4<>
      frameset@02EF3720 cols=200,* border=0 refcount=2<
        frame@02EF3490 name=frame2 noresize= scrolling=No src=frame2.html refcou
nt=2<>
        frameset@02EF3230 rows=58,* border=0 refcount=2<
          frame@02EEA4E0 name=frame3 noresize= scrolling=No src=frame3.html refc
ount=2<>
          frame@02EFDFC0 name=frame4 noresize= scrolling=Auto src=frame4.html re
fcount=2<>
        >
      >
    >
  >
>

Comment 8

[harishd]

This is probably a frameset bug rather than a parser bug. Handing over to Eric.

Comment 9

[Eric Pollmann]

Yep, this is a dup of bug 43464.  It is pretty hard to handle in just layout -
we'll probably need to also tweak at least the content sink...  Marking dup.

*** This bug has been marked as a duplicate of 43464 ***