401675 - Crash when closing a window containing an element with a crazy number of classes

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[David Smith]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-us) AppleWebKit/523.11+ (KHTML, like Gecko) Version/3.0.4 Safari/523.10
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en-US; rv:1.9a9pre) Gecko/2007100304 Minefield/3.0a9pre

The test page (14MB!) contains an element with an absurd number of classes. Firefox loads the page just fine, but crashes when closing it. In WebKit (which behaves similarly), the crash appears to be due to too much recursion in the destructor for the list storing the class names; it may be the case in Firefox as well.

Reproducible: Always

Steps to Reproduce:
1. Load the test url
2. Wait for it to finish loading (it will display a js alert)
3. Close the page
Actual Results:  
Crash

Expected Results:  
No Crash

http://bugs.webkit.org/show_bug.cgi?id=15760 is the equivalent bug for WebKit

http://crash-stats.mozilla.com/report/index/c688694a-86c0-11dc-b54d-001a4bd43ed6 and http://crash-stats.mozilla.com/report/index/1bbb1f33-86be-11dc-9545-001a4bd46e84 are the crash reports I submitted.

Comment 1

[David Smith]

Oops. Fixed in a more recent build. Apologies for the bugspam.

Comment 2

[Colin Barrett [:cbarrett]]

Doesn't happen in more recent nightlies.

Comment 3

[Colin Barrett [:cbarrett]]

Doesn't happen in more recent nightlies.

Comment 4

[Colin Barrett [:cbarrett]]

Argh, stupid bugzilla.