59769 - Page stops rendering after a number of color changes

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect, P3)

Description

[Ari Pollak]

Kind of a browser buster - go to http://aripollak.com/~compwiz/stuff/test2.html
- Loads fine in NS 4.7x, But stops loading after 2 lines in Mozilla. 
WARNING - Page fairly large (100k, large by webpage standards) and I wouldn't
suggest trying to view this in IE or in a machine with less than 64 MB RAM.

Comment 1

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Please triage.

Comment 2

[Heikki Toivonen (remove -bugzilla when emailing directly)]

Incremental layout again?

Comment 3

[Nisheeth Ranjan]

Harish, would you please verify that this isn't a parser problem?  If it 
isn't, then it is probably a layout issue, in which case, please pass the bug on 
to Chris Karnaze.  Thanks.

Comment 4

[Hixie (not reading bugmail)]

Reassigning QA Contact for all open and unverified bugs previously under Lorca's
care to Gerardo as per phone conversation this morning.

Comment 5

[harishd]

Attachment: Content model [ it's huge ]

Comment 6

[harishd]

The content model ( attached above ) seems to be correct. This is probably a 
layout issue.

Comment 7

[karnaze (gone)]

Reassigning to pierre.

Comment 8

[Ari Pollak]

Ohhh. I see why this isn't working, it's incorrect HTML.. the FONT tag never
ends, and mozilla gives up trying to make a deeper hierarchy than it can handle.
Perhaps this is a feature, not a bug? IE 4/5/6 crashes on this page. Perhaps I
should close the bug?

Comment 9

[TucsonTester1]

Also on Windows NT if you keep changing the colors and trying to type even 
after the page is frozen Netscape will crash. You will receive an application 
error in Netscp6.exe Exception: Access Violation (0x0000005), Address: 
0x02c1fbf7. The Talkback Incedent ID is TB35513071x-Program Crash

Comment 10

[Pierre Saslawsky]

Tucson, what do you mean by "if you keep changing the colors and trying to type 
even after the page is frozen"?  Please describe the steps to reproduce.  How do 
you keep changing the colors after the page is frozen?  Where do you try to type 
when the page is frozen?

I think the page stops rendering because of the tags are not terminated and we 
hit the MAX_REFLOW_DEPTH limit (= 200 on Windows and Unix) - which would make the 
bug invalid.

Reassigned to Parser to confirm the above and to investigate the Talkback 
incident.  The MAX_REFLOW_DEPTH should have prevented the crash from happening.

Comment 11

[Pierre Saslawsky]

[e-mail] sent me the following email regarding this bug:
----
The Page freezes in terms of entering text. You can still change the colors 
over and over, and attempt to type in the text field. If you do so, then 
Netscape crashes. So if you keep changing the colors and the page does not 
allow you to enter anymore text into the text field, then keep trying to 
change the colors and type some text. The page seems to overload and then 
crashes. Like you said if the page stops responding then everything should 
stop responding, but it doesn't. It still allows you to edit the color 
preferences.
----

Nick, this bug is not about changing the colors in the Preferences dialog but 
about receiving a very large number of unterminated <FONT COLOR=XXXXXX> tags 
within the page so we may need to open a separrate bug report.  Problem: I don't 
quite understand what you described.  For instance, there is no text field within 
the page (are you refering to the URL bar?).  What do you mean by "the page stops 
responding" (this is a static page: just text, no html form controls).  Could you 
please describe in detail the steps to reproduce?  For instance:

Using build #99-99-99 on platform XXXX running Operating System YYYY....
1) go to the page at the url above
2) change the text color within the preferences dialog
3) select the URL field and type in enough characters to make the text overflow 
and scroll
4) repeat steps #2 and #3 between 5 and 10 times
5) ===> notice how you can no longer enter characters within the URL field and 
how the toolbar buttons are no longer responding
6) try to change one more time the text color within the preferences dialog
7) ===> the application crashes

Thanks!

Comment 12

[harishd]

I need a build number.

Comment 13

[Asa Dotzler [:asa]]

Bugs targeted at mozilla1.0 without the mozilla1.0 keyword moved to mozilla1.0.1 
(you can query for this string to delete spam or retrieve the list of bugs I've 
moved)

Comment 14

[Ari Pollak]

This has been fixed in Mozilla 0.9.6. It's incredbly slow, but it works. Mark FIXED?

Comment 15

[Ari Pollak]

Works.

Comment 16

[Moied]

Marking verified fixed with build ID 20020131 on Linux and win2k