Closed Bug 4112 Opened 26 years ago Closed 26 years ago

setting BR display type to block causes crash

Categories

(Core :: Layout, defect, P1)

Product:
Core
Component:
Layout
Platform:
x86
Windows 95
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: johnlar, Assigned: buster)

Details

Mozilla crashes with APPRUNNER caused an invalid page fault in module RAPTORHTML.DLL at 0137:00fd633d. Registers: EAX=0076cb00 CS=0137 EIP=00fd633d EFLGS=00010246 EBX=0076cc04 SS=013f ESP=0076cad8 EBP=0076cbb0 ECX=00000000 DS=013f ESI=00000000 FS=4387 EDX=00a33e30 ES=013f EDI=000009ab GS=0000 Bytes at CS:EIP: 89 56 24 8b 80 90 00 00 00 0f b6 40 03 3b c1 75 Stack dump: 00000000 00fe8e90 00a33e34 00a21a60 0076cc44 0076cb00 0076ccb0 008edf10 0076dce8 00000001 0076df54 00a33e30 00000000 00000000 000021cf 40000000 It does this when you load a page that has css values assigned to tags that do not exist, which oviously is the fault of whoever made the page but still annoying to have it crash.. also will crash if you assign values to BR which makes sense because its not encapsulating but still
Priority: P1
Please provide a sample URL or HTML/CSS document. Nonexistent tags are generally not a problem.
From submitter: I discovered this problem when messing with the page my company is building the buggy page is http://www.how-toresource.com/temp4.html which uses temp4.css I fixed it an te fixed page is at http://www.how-toresource.com/main.html which uses temp.css you will notice the only difference between these two pages is in temp.css line 20 and 25 have been changed and BR and KDB have been removed respectivly
Assignee: peterl → kipp
Component: Style System → Layout
Summary: crashes on bad style sheet → setting BR display type to block causes crash
Here's a reduced case: <style> br {display: block} </style> <body> text<br>moretext </body>
Status: NEW → ASSIGNED
Weird additional Bug, If I highlight the above reduced case: My browser will crash, with about the same message as the initial I assume this is a strange associated bug, half dealing witht he current bug, half dealing with the selector thinking a bit too much
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
Fixed. I updated the BR frame code to cope.
Status: RESOLVED → VERIFIED
Using 3/26 build with reduced case from 3/25 comments - no crash. Verified fixed.
Using 3/26 build with reduced case from 3/25 comments - no crash. Verified fixed.
You need to log in before you can comment on or make changes to this bug.