Opened 14 years ago
Closed 14 years ago
#4670 closed bug (invalid)
Set numeric value to "value" attribute on "li" element crash IE 7
Reported by: | Fufu | Owned by: | |
---|---|---|---|
Priority: | major | Milestone: | |
Component: | core | Version: | 1.3.2 |
Keywords: | attr value li crash | Cc: | |
Blocked by: | Blocking: |
Description
This simple bit of jquery javascript crash IE 7 :
$('<li />').attr("value", "12");
Here is IE 7 error details : AppName: iexplore.exe AppVer: 7.0.6000.16827 ModName: mshtml.dll ModVer: 7.0.6000.16825 Offset: 00162757
Attachments (1)
Change History (2)
Changed 14 years ago by
Attachment: | crash_ie.html added |
---|
comment:1 Changed 14 years ago by
Resolution: | → invalid |
---|---|
Status: | new → closed |
Wow, nice bug. It's not a jQuery bug though. You can reproduce it with bare DOM functions:
var li = document.createElement("li"); li.value = "12";
IE7 immediately crashes in MSHTML.DLL trying to access memory address 0x00000000. The same crash happens with li.setAttribute("value", "12")
. Since (in HTML4 at least) the value of an <li>
element only applies if it is a child of an <ol>
element, I suspected it might be trying to access the parent node. Sure enough, this does not crash:
var ol = document.createElement("ol"); var li = document.createElement("li"); ol.appendChild(li); li.value = "12";
This bug seems to be fixed in IE8.
Sample crash file