679905 - deep DOM tree in an XHTML document causes stack overflow in frame construction

Status: RESOLVED WORKSFORME

(Core :: Layout, defect)

Description

[Konstantin Preißer]

Attachment: Example XHTML page that reproduces the crash.

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100101 Firefox/6.0
Build ID: 20110811165603

Steps to reproduce:

I experimented with an XHTML page that contains a lot of nested <div> elements, like ...<div><div><div></div></div></div>... (about 2000).


Actual results:

Firefox 2.0.20, 3.6.20, 4.0.1, 5.0.1, 6.0 crash when I open the page.
I made an example XHTML page that reproduces the problem and attached it (please note that Firefox must use its XML parser for the crash to occur. When the SGML parser is used, it doesn't crash). The example is also available under this URL:
http://preisser.dynalias.org/dere1/temp/FF-Crash/index.xhtml

When this URL is opened with Firefox 6.0 (or older versions) under a Windows operating system (at least Windows 7, Windows Vista and Windows XP), Firefox crashes.


Expected results:

Firefox shouldn't crash but render the page.

Comment 1

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I can reproduce this.  We're crashing with a stack overflow.

Comment 2

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Attachment: Stack

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

-> Layout

Comment 4

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I see this in the terminal:

WARNING: frame tree too deep; setting zero size and returning: file c:/dev/mozil
la-central/layout/generic/nsFrame.cpp, line 4605

So we've recognized that the tree is too deep, but we still fail anyways.

Comment 5

[Bob Clary [:bc] (inactive)]

fwiw, out of Firefox, Chrome, Safari and Opera we are the only one not to handle this gracefully and relatively quickly. Blocking sisyphus-crashes to indicate it shows up in automation.

dupe of bug 485941 ?

Comment 6

[Wayne Mery (:wsmwk)]

(In reply to Bob Clary [:bc:] from comment #5)
> fwiw, out of Firefox, Chrome, Safari and Opera we are the only one not to
> handle this gracefully and relatively quickly. Blocking sisyphus-crashes to
> indicate it shows up in automation.
> 
> dupe of bug 485941 ?

Comment 7

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Maybe!

Comment 8

[Carsten Book [:Tomcat]]

does not crash anymore - marking as wfm