Closed Bug 688 Opened 26 years ago Closed 26 years ago

crash destroying content when there is a font tag inside a select form element

Categories

(Core :: DOM: Core & HTML, defect, P1)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: buster, Assigned: karnaze)

References

(
URL
)

Details

load the URL, or the tiny test case provided below for your pleasure. Go to any other document. Crash in nsHTMLContainer destrucutor. Stack provided below. =============== test case =============== <HTML><BODY> <FORM ACTION="post"> <SELECT NAME=""> <font size=-2> <OPTION VALUE="Loves">Loves </font> </SELECT> </FORM> </BODY></HTML> ===================== stack ========================= nsHTMLContainer::~nsHTMLContainer() line 85 + 9 bytes nsHTMLContainer::`scalar deleting destructor'() + 20 bytes nsHTMLContent::Release(nsHTMLContent * const 0x0104f920) line 164 + 149 bytes nsHTMLTagContent::Release(nsHTMLTagContent * const 0x0104f920) line 185 + 9 bytes nsHTMLContainer::~nsHTMLContainer() line 85 + 12 bytes nsInput::~nsInput() line 75 + 24 bytes nsSelect::~nsSelect() line 413 + 13 bytes nsSelect::`scalar deleting destructor'() + 20 bytes nsInput::Release(nsInput * const 0x0104ee50) line 164 + 38 bytes nsHTMLContainer::~nsHTMLContainer() line 85 + 12 bytes BodyPart::~BodyPart() line 175 + 13 bytes BodyPart::`scalar deleting destructor'() + 20 bytes BodyPart::Release(BodyPart * const 0x0105f7f0) line 185 + 38 bytes nsHTMLContainer::~nsHTMLContainer() line 85 + 12 bytes RootPart::~RootPart() line 638 + 13 bytes RootPart::`scalar deleting destructor'() + 20 bytes nsHTMLContent::Release(nsHTMLContent * const 0x0105a490) line 164 + 149 bytes nsHTMLTagContent::Release(nsHTMLTagContent * const 0x0105a490) line 185 + 9 bytes nsDocument::~nsDocument() line 188 + 31 bytes nsMarkupDocument::~nsMarkupDocument() line 46 + 13 bytes nsHTMLDocument::~nsHTMLDocument() line 109 + 43 bytes nsHTMLDocument::`scalar deleting destructor'() + 20 bytes nsDocument::Release(nsDocument * const 0x010442c0) line 247 + 108 bytes nsHTMLDocument::Release(nsHTMLDocument * const 0x010442c0) line 143 + 9 bytes nsEventStateManager::~nsEventStateManager() line 36 + 31 bytes nsEventStateManager::`scalar deleting destructor'() + 20 bytes nsEventStateManager::Release(nsEventStateManager * const 0x01058ea0) line 41 + 102 bytes nsPresContext::~nsPresContext() line 92 + 40 bytes GalleyContext::~GalleyContext() line 40 + 13 bytes GalleyContext::`scalar deleting destructor'() + 20 bytes nsPresContext::Release(nsPresContext * const 0x0104d3d0) line 108 + 38 bytes PresShell::~PresShell() line 318 + 31 bytes PresShell::`scalar deleting destructor'() + 20 bytes PresShell::Release(PresShell * const 0x01054ac0) line 279 + 32 bytes DocumentViewerImpl::~DocumentViewerImpl() line 201 + 18 bytes DocumentViewerImpl::`scalar deleting destructor'() + 20 bytes DocumentViewerImpl::Release(DocumentViewerImpl * const 0x0104c850) line 143 + 105 bytes nsWebShell::Embed(nsWebShell * const 0x01036680, nsIContentViewer * 0x0104f3d0, char * 0x00000000, nsISupports * 0x00000000) line 484 + 31 bytes nsDocumentBindInfo::OnStartBinding(nsDocumentBindInfo * const 0x01049240, nsIURL * 0x01049120, char * 0x0104c200) line 957 + 36 bytes NET_NGLayoutConverter(int 38, void * 0x00000000, URL_Struct_ * 0x01059bf0, MWContext_ * 0x01058240) line 666 + 32 bytes NET_StreamBuilder(int 38, URL_Struct_ * 0x01059bf0, MWContext_ * 0x01058240) line 243 + 24 bytes net_setup_file_stream(_ActiveEntry * 0x01058a70) line 762 + 25 bytes net_ProcessFile(_ActiveEntry * 0x01058a70) line 1234 + 9 bytes NET_ProcessNet(PRFileDesc * 0x00000000, int 1) line 3302 + 13 bytes NET_PollSockets() line 162 + 9 bytes nsNetlibService::NetPollSocketsCallback(nsITimer * 0x01048d50, void * 0x010148e0) line 530 TimerImpl::Fire(unsigned long 2056265753) line 321 + 17 bytes TimerImpl::ProcessTimeouts(unsigned long 2056265753) line 199 FireTimeout(void * 0x00000000, unsigned int 275, unsigned int 13907, unsigned long 2056265753) line 103 + 9 bytes USER32! 77e7128c() main(int 2, char * * 0x00ff61d0) line 95 mainCRTStartup() line 338 + 17 bytes KERNEL32! 77f1b304()
Priority: P1
Component: Unknown → Content Model
setting component field
Status: NEW → ASSIGNED
Status: ASSIGNED → RESOLVED
Closed: 26 years ago
Resolution: --- → FIXED
Status: RESOLVED → VERIFIED
doesn't crash anymore...
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.