Bug Tracker

Opened 11 years ago

Closed 11 years ago

#4670 closed bug (invalid)

Set numeric value to "value" attribute on "li" element crash IE 7

Reported by: Fufu Owned by:
Priority: major Milestone:
Component: core Version: 1.3.2
Keywords: attr value li crash Cc:
Blocked by: Blocking:

Description

This simple bit of jquery javascript crash IE 7 :

$('<li />').attr("value", "12");

Here is IE 7 error details : AppName: iexplore.exe AppVer: 7.0.6000.16827 ModName: mshtml.dll ModVer: 7.0.6000.16825 Offset: 00162757

Attachments (1)

crash_ie.html (457 bytes) - added by Fufu 11 years ago.
Sample crash file

Download all attachments as: .zip

Change History (2)

Changed 11 years ago by Fufu

Attachment: crash_ie.html added

Sample crash file

comment:1 Changed 11 years ago by dmethvin

Resolution: invalid
Status: newclosed

Wow, nice bug. It's not a jQuery bug though. You can reproduce it with bare DOM functions:

  var li = document.createElement("li");
  li.value = "12";

IE7 immediately crashes in MSHTML.DLL trying to access memory address 0x00000000. The same crash happens with li.setAttribute("value", "12"). Since (in HTML4 at least) the value of an <li> element only applies if it is a child of an <ol> element, I suspected it might be trying to access the parent node. Sure enough, this does not crash:

  var ol = document.createElement("ol");
  var li = document.createElement("li");
  ol.appendChild(li);
  li.value = "12";

This bug seems to be fixed in IE8.

Note: See TracTickets for help on using tickets.