Open Bug 1133388 Opened 6 years ago Updated 2 years ago

Firefox locks up when parsing invalid HTML containing <button><i class="fa fa-reply" /></button>

Categories

(Core :: DOM: HTML Parser, defect, P5)

36 Branch
x86_64
Linux
defect

Tracking

()

UNCONFIRMED

People

(Reporter: kyle.mahan, Unassigned)

Details

(Keywords: hang)

Attachments

(1 file)

Attached file test.html
User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0
Build ID: 20150125221831

Steps to reproduce:

I am developing an application locally. I entered the following (invalid) markup:

<button type="submit" name="action" value="reply"><i class="fa fa-reply" /></button>
<button type="submit" name="action" value="like"><i class="fa fa-star" /></button>



Actual results:

Firefox became unresponsive and had to be killed. This happened every time I opened the page, without fail.

I fixed the HTML to properly close the <i> tags and it works fine now, so I am fairly confident the issue is related to the self-closing <i /> tags.


Expected results:

Should not have locked up.
Comment on attachment 8564831 [details]
test.html

This is the full content of the page I was working on. Running a local server and opening this page, it reliably locks up the browser.
Same full lockup on FF Beta 36.0 / MacOSX 10.7.5. Bumping to P1 since crasher.
Component: Untriaged → HTML: Parser
Keywords: hang
Priority: -- → P1
Product: Firefox → Core
Version: 35 Branch → 36 Branch
Can someone mark this bug as NEW, since it was confirmed?

Same full lockup on Firefox 51 DevEdition on macOS 10.12. Content for all pages is locked up, tab bar is still responsive and I can change tab but each tab shows a blank page with spinner, cannot close tabs.
Decreasing the priority as no update for the last 2 years on this bug.
See https://github.com/mozilla/bug-handling/blob/master/policy/triage-bugzilla.md#how-do-you-triage 
about the priority meaning.
Priority: P1 → P5
I can't reproduce in Nightly on Linux using the attached HTML page.

It could be because this was fixed in other bugs, or because the bug depended on some of the JS and CSS resources which are now blocked by cross-origin restrictions.
You need to log in before you can comment on or make changes to this bug.