213295 - To many unclosed option tag's in RTL schema lead to lockup

Status: RESOLVED WORKSFORME

(Core :: Layout: Block and Inline, defect)

Description

[Ruslan Ismailov]

Working on bug 213245 I found, that form on that page locked my Mozilla down. I
simplify page and found, that source of locking up is to manu unclosed <option>
tag's in RTL direction. If number of unclosed <option> tag's is less than 10,
page always work correctly, but with 20-30-40 unclosed tag it become locking.

To produce this effect you need open following testcase and try to use select
menu  several time (but try to switching fast, I don't clearly understand, but
if I selected option slow, with big pause, everything could be normal). It take
me 2-10 clicks to lock-up Mozilla's. CPU usage is over 100% and task is not
answered, same picture in Linux Mozilla.

Comment 1

[Ruslan Ismailov]

Attachment: Manu unclosed option tag lead to mozilla lock-up

Comment 2

[Simon Montagu :smontagu]

Attachment: Same as attachment 128156, but with the closing tags

This seems very surprising. I don't see why omitting the closing tags should
have any effect, but I can reproduce the hang with attachment 128156 [details] and not
with this one.

The hang seems to be a mutually recursive loop of
nsFrame::GetNextPrevLineFromeBlockFrame() and nsFrame::PeekOffset()

Comment 3

[Simon Montagu :smontagu]

Attachment: Stack after breaking in the debugger

Comment 4

[Simon Montagu :smontagu]

.

Comment 5

[(no longer active)]

Mass-assigning the new rtl keyword to RTL-related (see bug 349193).

Comment 6

[Daniel Holbert [:dholbert]]

(In reply to Simon Montagu :smontagu from comment #2)

I can reproduce the hang with attachment 128156 [details]

I can't reproduce it at this point. (loading that attachment and rapidly clicking the button to open/close/open/close/[etc] the dropdown)

Likely fixed in the last two decades. :) Please reopen if anyone can still repro.