69160 - Hangs and starts eating memory on malformed html

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Christian Geist]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; 0.8) Gecko/20010215
BuildID:    2001021505

When entering this URL into Mozilla, it  first starts building the page but then
grabs as much memory as possible and hangs around. I don't know how much he
actually wants but I killed it at about 600MB.

Reproducible: Always
Steps to Reproduce:
Just use above URL (I hate to acknowledge I copied this URL out of IE)

Actual Results:  Web page is started to be built, then hangs. In NT task manager
you can see memory piling up.

Expected Results:  The usual memory consumption ...

Comment 1

[Brian Haskin (Janzert)]

I can confirm this with
user agent: Mozilla/5.0 (Windows; U; Win98; en-US; 0.8) Gecko/20010215
build: 2001021508

Before setting this to new I'm working on a testcase so I can better check for
duplicates.

Comment 2

[Bruce Harada]

Also confirmed on 2001021503 0.8 build under Linux 2.2.18/glibc 2.1.2/XFree86
3.3.6

Comment 3

[Brian Haskin (Janzert)]

Ok, this seems to be the result of a misplaced </map> tag. Although it also
depends on the way a couple of Table's and another <map> is.

Changed summary from Mozilla grabs about, I don't know, 1GB of memory
Changing OS to All per comments.
Changing component to Parser from Layout.

Comment 4

[Brian Haskin (Janzert)]

Attachment: Simplified testcase

Comment 5

[HJ]

Wow, this is a heavy one. And it eats more and faster then my dog.

Comment 6

[harishd]

Setting to m0.9.

Comment 7

[Asa Dotzler [:asa]]

*** Bug 70011 has been marked as a duplicate of this bug. ***

Comment 8

[harishd]

Attachment: Proposed patch v1.1

Comment 9

[Heikki Toivonen (remove -bugzilla when emailing directly)]

r=heikki. A couple of suggestions, but you don't need to do these if you don't
want. You have "PRBool(mHasOpenMap>0)", but the cast here is unnecessary since
operator > returns a boolean. Also, the name "mHasOpenMap" is slightly
misleading since it is no longer boolean - I would probably change it to
something like mOpenMapCount or some such. I think there are other similar
variables in the class suffering from this same misleading naming.

Comment 10

[vidur (gone)]

sr=vidur, seconding Heikki's renaming request.

Comment 11

[bsharma]

updated qa contact.

Comment 12

[harishd]

Fix is in. Marking FIXED.

Comment 13

[bsharma]

Verified on:
build: 2000-03-07-10-Mtrunk
platform: WinNT

The page loads fine.

Comment 14

[Boris Zbarsky [:bzbarsky]]

*** Bug 73500 has been marked as a duplicate of this bug. ***