413842 - OOM crash in nsHtml5TreeBuilder::accumulateCharacters while recursive reading/modification of firstChild

Status: RESOLVED WORKSFORME

(Core :: DOM: HTML Parser, defect)

Description

[Robin]

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en) AppleWebKit/523.12.2 (KHTML, like Gecko) Version/3.0.4 Safari/523.12.2
Build Identifier: 2.0.0.11

Running this code causes problems:

for(var c in document.firstChild){
document.write(document.firstChild[c]);
}

browser becomes unresponsive, memory usage skyrockets, browser uses up 100% cpu.

Reproducible: Always

Steps to Reproduce:
1. run this script
for(var c in document.firstChild){
document.write(document.firstChild[c]);
}

Actual Results:  

browser becomes unresponsive, memory usage skyrockets, browser uses up 100% cpu.

Expected Results:  
observe results in Opera 9
should print out object contents maybe

Comment 1

[Matthew Cline]

WFM with Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.11) Gecko/20071127 Firefox/2.0.0.11

Comment 2

[Tyler Downer [He/Him]]

This bug was reported on Firefox 2.x or older, which is no longer supported and will not be receiving any more updates. I strongly suggest that you update to Firefox 3.6.3 or later, update your plugins (flash, adobe, etc.), and retest in a new profile. If you still see the issue with the updated Firefox, please post here. Also give a stacktrace.
Otherwise, please close as RESOLVED > WORKSFORME
http://www.mozilla.com
http://support.mozilla.com/kb/Managing+profiles
http://support.mozilla.com/kb/Safe+mode
https://developer.mozilla.org/En/How_to_get_a_stacktrace_for_a_bug_report

Comment 3

[Tyler Downer [He/Him]]

Reporter, are you still seeing this issue with Firefox 3.6.10 or later in safe mode? If not, please close. These links can help you in your testing.
http://support.mozilla.com/kb/Safe+Mode
http://support.mozilla.com/kb/Managing+profiles

Comment 4

[Robin]

Thankyou but this still occurs. I have tested in Firefox 4.0b6 in safe mode. It still crashes :*(

I have uploaded the test case again here:
http://murderdeathkitty.net/****/killall.html

Here is the offending code again:
for(var c in document.firstChild)document.write(document.firstChild[c]);

Comment 5

[Tyler Downer [He/Him]]

I get a hang and script not responding errors with Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b7pre) Gecko/20101004 Firefox/4.0b7pre, but no crash. Can you post crash reports? https://developer.mozilla.org/En/How_to_get_a_stacktrace_for_a_bug_report

Comment 6

[Tyler Downer [He/Him]]

Reporter, were you able to get a stacktrace for us?
https://developer.mozilla.org/En/How_to_get_a_stacktrace_for_a_bug_report

Comment 7

[Bob Clary [:bc] (inactive)]

see also bug 588205

bp-37459dba-95bd-4279-98e5-71e282110208

0 	libmozalloc.dylib 	mozalloc_abort 	memory/mozalloc/mozalloc_abort.cpp:64
1 	libmozalloc.dylib 	mozalloc_handle_oom 	memory/mozalloc/mozalloc_oom.cpp:54
2 	libmozalloc.dylib 	moz_xmalloc 	memory/mozalloc/mozalloc.cpp:100
3 	XUL 	nsHtml5TreeBuilder::accumulateCharacters 	c.h:241
4 	XUL 	nsHtml5Tokenizer::stateLoop 	parser/html/nsHtml5Tokenizer.cpp:277
5 	XUL 	nsHtml5Tokenizer::tokenizeBuffer 	parser/html/nsHtml5Tokenizer.cpp:391

Comment 8

[Scoobidiver (away)]

More reports at:
https://crash-stats.mozilla.com/report/list?signature=TouchBadMemory+|+mozalloc_abort+|+mozalloc_handle_oom+|+moz_xmalloc+|+nsHtml5TreeBuilder%3A%3AaccumulateCharacters

Comment 9

[Mats Palmgren (inactive)]

Fwiw, [@ nsHtml5TreeBuilder::accumulateCharacters ] has fairly high volume in v50(beta)
currently at #26 in the Top Crash list.

Comment 10

[Henri Sivonen (:hsivonen)]

(In reply to Mats Palmgren (:mats) from comment #9)
> Fwiw, [@ nsHtml5TreeBuilder::accumulateCharacters ] has fairly high volume
> in v50(beta)
> currently at #26 in the Top Crash list.

That's a newer thing (to be fixed in 51), not this one.

Comment 11

[Sylvestre Ledru [:Sylvestre]]

Closing because no crash reported since 12 weeks.

Comment 12

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Reopening because crash bugs **with testcases** should not be resolved **as WONTFIX** based on queries of crash-stats.  Other resolutions may be appropriate for other reasons.

(Crash signatures are not the same as bug identity; they're merely a search aid to find and group similar crashes.  The bug may still be present, but the signature may have changed slightly, or the bug may even still be present with the same signature but there are simply no recent reports of crashes in that function.)

Comment 13

[Hsin-Yi Tsai (she/her) [:hsinyi]]

Just tested the testcase in the URL field - no crash; there's a warning saying this page is slowing down your browser, but it was eventually loaded.
Going to close this as WORKSFORME due to the test result as well as no crash reports for a long time.