115325 - Huge memory allocation when choosing dropdown option

Status: RESOLVED DUPLICATE of bug 112241

(Core :: Layout: Form Controls, defect)

Description

[mozilla3eran]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.6) Gecko/20011120
BuildID:    2001112009

Upon opening http://www.pacificink.com/hpcartridges.html (copy attached) and
choosing a dropdown option in the "Inkjet Printer Products" dropdown, Mozilla
incrementally allocates a huge amount of memory (at least 300MB, possibly
infinite). All Mozilla windows become unresponsibe and much thrashing ensues.
Must kill Mozilla using Task Manager or equivalent.

Reproducible: Always
Steps to Reproduce:
1. Open http://www.pacificink.com/hpcartridges.html
2. Choosing an option in the "Inkjet Printer Products" dropdown


Actual Results:  Thrashing, hang.

Expected Results:  Go to another page depending on choice.

Attribution to JavaScript is a guess.

Might have nasty DoS implications, such as the ability to hang Mozilla and
overload the computer by sending an HTML e-mail (without attachments).

Comment 1

[mozilla3eran]

Attachment: Problematic page (http://www.pacificink.com/hpcartridges.html)

Careful with the dropdowns -- unless the bug is fixed, your browser may die if
you use them.

Comment 2

[R.K.Aa.]

dup of bug 112241?

Comment 3

[R.B.]

Confirming on Linux 2001121406. OS-->all ?

Comment 4

[Phil Schwartau]

Yes, it is a dupe of bug 112241. The <SELECT> in question is

<SELECT name="select1" onChange="selectaplace(this.form)" size=1>
   <OPTION value=hpcartridges.html>Select Inkjet Printer

                        etc.

The function selectaplace() causes a change event (see below),
hence infinite recursion in onChange. Look for lines of the form

       form.select1.options[formindex].text = (something)


function selectaplace(form) {
  var appname = navigator.appName;
  var appversion = parseInt(navigator.appVersion);
  if (appname == "Netscape" && appversion >= 3) {
    var formindex = form.select1.selectedIndex;
    var storage = form.select1.options[formindex].text;
    if (form.select1.options[formindex].value != "none") {
      var msg = storage + "You are now being transferred to the -> " + storage;
      for (var spot = 0; spot < msg.length - storage.length; spot++) {
        var x = msg.substring(spot, msg.length);
        form.select1.options[formindex].text = x;
        for (var d = 0; d < 150; d++) {
        }
      }
      window.location = form.select1.options[formindex].value;
      form.select1[formindex].text = storage;
    } else {
      form.select1[formindex].text = "Not a real option!";
      for (var d = 0; d < 1250; d++) {
      }
      form.select1[formindex].text = storage;
    }
  } else {
    var formindex = form.select1.selectedIndex;
    window.location = form.select1.options[formindex].value;
  }
}

Comment 5

[Phil Schwartau]

Reassigning to HTML Form Controls for parity with dupe - 

Comment 6

[Phil Schwartau]

*** This bug has been marked as a duplicate of 112241 ***