Opera Crasher #219068

Tables containing a styled <colgroup> can crash Opera when manipulated via the DOM

Fixed in Opera 9.02 Final

This crasher requires the following to be true:

1. Document must contain a table
2. Table must contain a <colgroup> element
3. The <colgroup> element must have at least one applicable* CSS style applied to it
4. The table must contain a <tbody> element containing at least one row
5. The table must contain at least one other row outside of the <tbody> element
6. Removing child nodes from the <tbody> element via the DOM causes Opera to crash

The table below is a single column table with a single styled <colgroup> element. It has both a <thead> and <tbody> element, although the <thead> grouping is unnecessary for causing the crash. The <thead> and <tbody> element each contain one row containing one cell.

Clicking the "Crash!" button will activate a script which removes all child nodes from the table's <tbody> element. This causes Opera to crash.

* Styles which are ignored by the <colgroup> element do not cause a crash. In the example above, background-color is used.