124788 - repeatable rendering engine hang

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect, P1)

Description

[Takuo KITAME]

Checked 0.9.8 on Linux.
Mozilla (also embedding) will hangs with invalid HTML.
I attach test case HTML.

Comment 1

[Takuo KITAME]

Attachment: test case

test case.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Confirmed. We seem to get into an infinite loop in the parser
(CNavDTD::HandleDefaultStartToken (this=0x8783070, aToken=0x81a19c0, 
    aChildTag=eHTMLTag_tr, aNode=0x819d880) and the like).

Comment 3

[harishd]

Stack:

nsHTMLElement::IsBlockParent(nsHTMLTag eHTMLTag_tbody) line 1672 + 3 bytes
nsHTMLElement::CanContain(nsHTMLTag eHTMLTag_tr) line 2272 + 25 bytes
CNavDTD::CanContain(const CNavDTD * const 0x0325a780, int 100, int 107) line
2501 + 23 bytes
CNavDTD::BackwardPropagate(nsString & {""}, nsHTMLTag eHTMLTag_table, nsHTMLTag
eHTMLTag_tr) line 2815 + 20 bytes
CNavDTD::ForwardPropagate(nsString & {""}, nsHTMLTag eHTMLTag_table, nsHTMLTag
eHTMLTag_tr) line 2771 + 23 bytes
CNavDTD::CanPropagate(nsHTMLTag eHTMLTag_table, nsHTMLTag eHTMLTag_tr, int 0)
line 2637 + 29 bytes
CNavDTD::HandleDefaultStartToken(CToken * 0x01b10570, nsHTMLTag eHTMLTag_tr,
nsCParserNode * 0x01b2a1d8) line 1286 + 23 bytes
CNavDTD::HandleStartToken(CToken * 0x01b10570) line 1732 + 22 bytes
CNavDTD::HandleToken(CNavDTD * const 0x0325a780, CToken * 0x01b10570, nsIParser
* 0x032457d0) line 896 + 12 bytes
CNavDTD::BuildModel(CNavDTD * const 0x0325a780, nsIParser * 0x032457d0,
nsITokenizer * 0x0325aae0, nsITokenObserver * 0x00000000, nsIContentSink *
0x032404a0) line 526 + 20 bytes
nsParser::BuildModel() line 2010 + 34 bytes
nsParser::ResumeParse(int 1, int 0, int 1) line 1876 + 11 bytes
nsParser::OnDataAvailable(nsParser * const 0x032457d4, nsIRequest * 0x03253c10,
nsISupports * 0x00000000, nsIInputStream * 0x0325add0, unsigned int 0, unsigned
int 163) line 2499 + 21 bytes
nsDocumentOpenInfo::OnDataAvailable(nsDocumentOpenInfo * const 0x03253420,
nsIRequest * 0x03253c10, nsISupports * 0x00000000, nsIInputStream * 0x0325add0,
unsigned int 0, unsigned int 163) line 241 + 46 bytes
nsStreamListenerTee::OnDataAvailable(nsStreamListenerTee * const 0x0325ae20,
nsIRequest * 0x03253c10, nsISupports * 0x00000000, nsIInputStream * 0x03255230,
unsigned int 0, unsigned int 163) line 56 + 51 bytes
nsHttpChannel::OnDataAvailable(nsHttpChannel * const 0x03253c14, nsIRequest *
0x03256cc4, nsISupports * 0x00000000, nsIInputStream * 0x03255230, unsigned int
0, unsigned int 163) line 2493 + 57 bytes
nsOnDataAvailableEvent::HandleEvent() line 193 + 70 bytes
nsARequestObserverEvent::HandlePLEvent(PLEvent * 0x032574c4) line 116
PL_HandleEvent(PLEvent * 0x032574c4) line 590 + 10 bytes
PL_ProcessPendingEvents(PLEventQueue * 0x00b86e00) line 520 + 9 bytes
_md_EventReceiverPr

Comment 4

[harishd]

Attachment: patch v1.0

If the misplaced table content turns out to be skipped content then we need to
make sure that the rest of the table content belongs to the skipped content
until we encounter the appropriate end-skipped-content-tag ( feeling dizzy! ).

Comment 5

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Comment on attachment 69696 [details] [diff] [review]
patch v1.0

r=heikki

Comment 6

[Johnny Stenback (:jst)]

Comment on attachment 69696 [details] [diff] [review]
patch v1.0

sr=jst

Comment 7

[harishd]

fix is in.