If you think a bug might affect users in the 57 release, please set the correct tracking and status flags for Release Management.

Browser crash in case of large DOM depth

RESOLVED DUPLICATE of bug 323394

Status

()

Core
Layout
RESOLVED DUPLICATE of bug 323394
7 years ago
4 years ago

People

(Reporter: Christian, Unassigned)

Tracking

Trunk
x86
Windows XP
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Reporter)

Description

7 years ago
User-Agent:       Mozilla/5.0 (Windows; Windows NT 5.1; rv:2.0b2) Gecko/20100720 Firefox/4.0b2 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; Windows NT 5.1; rv:2.0b2) Gecko/20100720 Firefox/4.0b2 (.NET CLR 3.5.30729)

This is the source code of the page that causes the crash:

<html>
	<head>
		<title>DIV leak test</title>
		
		<script type="text/javascript">
			
			var numdivlayer=0;
			var mwidth=1000;
						
			function addDivLayer() {
				
				// ermittele DIV, unterhalb dessen ein weiteres DIV angefügt werden muss				
				if (numdivlayer == 0) {
					obj=document.getElementById("divcontainer");
				} else {
					obj=document.getElementById("nesteddiv"+numdivlayer)
				}
				
				// div Zähler erhöhen
				numdivlayer++;
				
				// breite sukzessive verkleinern 
				wh = mwidth-1*numdivlayer;
				
				// abwechselnd andere Rahmenfarbe
				var c= numdivlayer % 2;
				
				// div definieren
				divstr='<div class="class'+c+'" id="nesteddiv'+numdivlayer+'" style="width:'+wh+'px;height:'+wh+'px">'+numdivlayer+'</div>';
							
				// neues DIV einhängen
				obj.innerHTML = divstr;
				
				// prüfen, ob DIV in DOM vorhanden
				if(!document.getElementById("nesteddiv"+numdivlayer)) {
					window.title= "Error: " + numdivlayer;
				} else {
					document.title = "Success: " + numdivlayer; 					
				}				
			}
			
			function starttest() {
				// erzeuge 1000 ineinander verschachtelte DIVs
				for(var cc=0; cc<1000; cc++) {
					addDivLayer();
				}
			}			
			
		</script>
		<style>
			.class1 {
				background-color: #FF0000;
				border:1px solid #000000;
			}
			
			.class0 {
				background-color: #FF0000;
				border:1px solid #FFFFFF;
			}
			
		</style>
	</head>
	<body onload="starttest()">
		
		<div id="divcontainer" class="class1" style="width:1000px;height:1000px"></div>
		
	</body>
</html>

Reproducible: Always

Steps to Reproduce:
1. Call the page in the "details" section
2. Browser crashes
3. If you reduce the depth in function "starttest", e.g. to 900, the page is ok.
Actual Results:  
browser crashes immediatly

Expected Results:  
Rendering of 1000 nested DIVs (as safari is doing). 

We use that page to detect brwoser leaks and browser DOM handling differences between IE, FF and Safari. Safari is rendering to a DOM depth of 1000 as expected. IE renders up to a DOM Depth of 50 and FF 3.xx renders to a DOM depth of approx. 200 (which would be enough for our purposes).
Layout can't deal, which is known. The new HTML parser has a limit of 200 on a per-innerHTML basis, but this script does one innerHTML at a time, but you could crash with createElement/appendChild anyway.
Component: General → Layout
Product: Firefox → Core
QA Contact: general → layout
Whiteboard: dupeme
Version: unspecified → Trunk
(Reporter)

Comment 2

7 years ago
That's correct. I did an alternative test with createElement/appendchild and the behavior is the same.
Marking as duplicate based on description--didn't check the crash stack myself.
Status: UNCONFIRMED → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 323394

Updated

4 years ago
Whiteboard: dupeme
You need to log in before you can comment on or make changes to this bug.