Set numeric value to "value" attribute on "li" element crash IE 7

This simple bit of jquery javascript crash IE 7 :

$('<li />').attr("value", "12");

Here is IE 7 error details :

AppName: iexplore.exe AppVer: 7.0.6000.16827 ModName: mshtml.dll

ModVer: 7.0.6000.16825 Offset: 00162757

Attachments (1)

crash_ie.html (0.4 KB) - added by Fufu May 19, 2009 02:58PM UTC.

Sample crash file

Change History (1)

resolution:	→ invalid
status:	new → closed

Wow, nice bug. It's not a jQuery bug though. You can reproduce it with bare DOM functions:

  var li = document.createElement("li");
  li.value = "12";

IE7 immediately crashes in MSHTML.DLL trying to access memory address 0x00000000. The same crash happens with

li.setAttribute("value", "12")

. Since (in HTML4 at least) the value of an

<li>

element only applies if it is a child of an

<ol>

element, I suspected it might be trying to access the parent node. Sure enough, this does not crash:

  var ol = document.createElement("ol");
  var li = document.createElement("li");
  ol.appendChild(li);
  li.value = "12";

This bug seems to be fixed in IE8.

Side navigation