172917 - DOM structure corruption when many comment lines are placed in a nested <DL>

Status: RESOLVED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[WADA:World Anti-bad-Duping Agency]

When many comment lines are placed in a nested DL, DOM corruption occurs even
though very very simple DL structure.
If same HTML is generated by JavaScript and written to a window, no problem is
found.
If comment lines are reduced, no problem is found.

There is a boundary condition ; if only 1 byte of comment text is increased,
problem appears. 
This is same situation as bug 154304, but I'm not certain whether these 2
problems are same or not.
bug 161121 also reported same situation.

This problem seems to be caused by overlay of Control Block for DL nesting by
DOM object data.
 
[Structure of HTML]

 <dl>(Top level DL)
 
 +------- ( 1st set of DT/DD )
 | <dt></dt>
 | <dd>(Nested DL without comment line)</dd>
 +-------

 +------- ( 2nd set of DT/DD )
 |
 | <dt></dt>
 |
 | +------- ( DD which includes nested DL ) 
 | | <dd>
 | |
 | |
 | | +------- (Nested DL,with comment lines) 
 | | | <dl>
 | | |
 | | | <dt></dt>
 | | | <dd></dd>
 | | |
 | | | ( N-1 lines of comment )
 | | | <!-- [ Comment text of length = L1 ] -->
 | | | ( N th (last) comment line )
 | | | <!-- [ Last comment text of length = L2 ] -->
 | | |
 | | | </dl>
 | | +-------
 | |
 | | <span></span> ( span after nested DL within a DD block ) 
 | |
 | | </dd>
 | +-------
 +-------

 +------- ( 3rd set of DT/DD )
 | <dt></dt>
 | <dd>(Nested DL without comment line)</dd>
 +-------
 </dl>(End of Top level DL)

Comment 1

[WADA:World Anti-bad-Duping Agency]

Attachment: Problem Description and JavaScript generated HTML case

This is detailed problem description and includes JavaScript generated HTML
test case.
Recreation test procedure is also described.

Comment 2

[WADA:World Anti-bad-Duping Agency]

Attachment: Test case for recreation of problem(Please save as local file)

Comment 3

[Johnny Stenback (:jst)]

Not a DOM problem, over to parser.

Comment 4

[WADA:World Anti-bad-Duping Agency]

Attachment: Normal case

Number of comments in nested DL is different from attachment 101910 [details] .
This case contains only 1 comment line in a nested DL.
In this normal case, DOM structure is correct and indention is proper.

Comment 5

[WADA:World Anti-bad-Duping Agency]

Attachment: Problem Description and JavaScript generated HTML case

Replacement of attachment 101908 [details].

Comment 6

[WADA:World Anti-bad-Duping Agency]

Attachment: Problem Description and JavaScript generated HTML case

(Right) replacement of attachment 101908 [details].

attachment 102287 [details] is invalid. Sorry for my mistake.

Comment 7

[Boris Zbarsky [:bzbarsky]]

Fixed by bug 179071

Comment 8

[WADA:World Anti-bad-Duping Agency]

Problem in attachment 102289 [details] has been resolved completely on
2002111404-trunc/Win-Me.

I believe "nested DL in DD" devil has vanished by your silver bullet :-)
Boris Zbarsky san, thanks a lot.