Closed Bug 280079 Opened 20 years ago Closed 20 years ago

hang when webpage has missing ">" character in "</html>"

Categories

(Core :: DOM: HTML Parser, defect)

Product:
Core
Component:
DOM: HTML Parser
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: ptw, Assigned: mrbkap)

References

(
URL
)

Details

(Keywords: hang, regression, testcase)

Attachments

(2 files)

Testcase
14 bytes, text/html
Details
patch v1
1.41 KB, patch
jst
: review+
jst
: superreview+
Details | Diff | Splinter Review
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b) Gecko/20050125 Firefox/1.0+ Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b) Gecko/20050125 Firefox/1.0+ I'v found libcgi.sf.net to crash my browser. Stripping down the site focused my attention to code, which tries to hang Firefox: <html></html Closing '>' character ich missing. Subtags or any other content of <html> does not have any matter. Reproducible: Always Steps to Reproduce: 1. Go to libcgi.sf.net website Actual Results: Firefox crashed.
Can you post Talkback ID "firefox/components/talkback/talkback" or a GDB stacktrace if you built Firefox yourself for this crash ? Firefox 1.0 on WinXP doesn't crash but doesn't show the source right: </html></<html> instead of </html perhaps because of bug 57717. Use http://web-sniffer.net/ to see the real HTML sent.
URL: http://libcgi.sf.net → http://libcgi.sourceforge.net/
Keywords: crash, stackwanted
different behavior on my mozilla 1.8a6 nightly build 2005011906 Win XP: while loading that url the browser hangs, nothing is being displayed, and there's no way to restore the control on mozilla but it doesn't crash. Task manager says the application is not responding and the cpu usage is at 99% (but memory usage is not growing). There's nothing that can be done other than to manually kill the mozilla process.
(In reply to comment #2) > different behavior on my mozilla 1.8a6 ops, i mean 1.8b Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050119
Attached file Testcase —
The testcase just consists of: <html> </html and that makes my 2004-01-27 trunk build become unresponsive taking 100% cpu.
Component: General → HTML: Parser
Product: Firefox → Core
Version: unspecified → Trunk
Assignee: firefox → parser
Status: UNCONFIRMED → NEW
Ever confirmed: true
Keywords: testcase
QA Contact: general → mrbkap
The bug does not occur in: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8a6) Gecko/20050111 Firefox/1.0+ But the bug does occur in: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b) Gecko/20050116 Firefox/1.0+ My guess is this is a regression from the fix for bug 274786.
Keywords: regression
Taking. I'll attach a patch in a couple of hours (I know what's causing this).
Assignee: parser → mrbkap
Attached patch patch v1 — — Splinter Review
I missed an early return, so we were not adding the second token (and returning kEOF from ConsumeEndTag). This meant that when my last-ditch attempt to consume all content took effect, we were calling CTextToken::Consume() with the scanner already at the end of the document, the first thing that CTextToken::Consume() does is to set the position to one past the current, causing bad things to happen. I've added an assert to catch related problems (which shouldn't exist).
Attachment #172635 - Flags: review?(jst)
Tweaking summary and keywords to reflect that this is a *hang*, not a crash. (I've also removed stackwanted since I know what's happening).
Keywords: crash, stackwanted → hang
Summary: crash when webpage has missing ">" character in "</html>" → hang when webpage has missing ">" character in "</html>"
*** Bug 280564 has been marked as a duplicate of this bug. ***
Comment on attachment 172635 [details] [diff] [review] patch v1 r+sr=jst
Attachment #172635 - Flags: superreview+
Attachment #172635 - Flags: review?(jst)
Attachment #172635 - Flags: review+
Fix checked in. Sorry for the inconvenience!
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
*** Bug 280690 has been marked as a duplicate of this bug. ***
The testcase https://bugzilla.mozilla.org/attachment.cgi?id=172622 now works fine for me with build 2005-02-01-06 using Seamonkey trunk on Windows XP. Verified FIXED.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: