I had some XML that looked like: <html:select multiple="true"> <html:option>MLK</option> <html:option>FMM</option> </html:select> note that the close tag is "</option> not "</html:option>" - this of course caused a parse error in the XML but it confused the heck out of the select widget and made it crash in two different places because we're dereferencing a null pointer. I've attached the patch for both crashes. I've put assertions in because I don't believe this state should ever have been reached, but I can't get work done when it's crashing.

This is an expat error, methinks.

I'm testing with the patch in my tree right now. Will post a checkin message once I'm done. This bug raises an interesting issue. The HTML element code makes the assumption that the HTML parser is going to fix invalid markup. This assumption is untrue for the case when the HTML element code gets called from the XML content sink. There are undoubtedly other bugs lurking around that belong to this class of "invalid HTML in XML" bugs. One possible solution for this problem is that if an error occurs in XML, only the error token is propagated to the XML content sink by the XML DTD. All other tokens get ignored. This is essentially what IE 5.0 does: invalid XML documents are not displayed at all, only the error message is displayed. Ccing Rickg, Harish, Troy, and Vidur for comments.

The patch is checked in as of now. Thanks Alec.

nisheeth, so can this bug be marked Resolved/Fixed now? ;-)

nisheeth, so can this bug be marked Resolved/Fixed now? ;-)

Yup. HTML in XML should really follow the rules set by the XHTML DTDs. Specifically, it's fine for us to gracefully fail if the HTML is invalid or not well-formed.

Changing the status of this bug to reflect that we do not crash any more.

Checked in code, yesterday, that would allow parser to respond to errors from XML,PICS, etc.. So, when an XML error occurs only the error token is propagated to the content sink and after which the parser stops parsing. This fix should take care of the above "crashes" mentioned. Marking the bug fixed.

Fixed in the June 14th Build.