Set numeric value to "value" attribute on "li" element crash IE 7

[Fufu]

This simple bit of jquery javascript crash IE 7 :

$('<li />').attr("value", "12");

Here is IE 7 error details : AppName: iexplore.exe AppVer: 7.0.6000.16827 ModName: mshtml.dll ModVer: 7.0.6000.16825 Offset: 00162757

[Fufu]

Sample crash file

[dmethvin]

Wow, nice bug. It's not a jQuery bug though. You can reproduce it with bare DOM functions:

  var li = document.createElement("li");
  li.value = "12";

IE7 immediately crashes in MSHTML.DLL trying to access memory address 0x00000000. The same crash happens with li.setAttribute("value", "12"). Since (in HTML4 at least) the value of an <li> element only applies if it is a child of an <ol> element, I suspected it might be trying to access the parent node. Sure enough, this does not crash:

  var ol = document.createElement("ol");
  var li = document.createElement("li");
  ol.appendChild(li);
  li.value = "12";

This bug seems to be fixed in IE8.