77145 - Stray left angle brackets ("<") from tags are left in output around the 4kB mark

Status: VERIFIED FIXED

(Core :: DOM: HTML Parser, defect)

Description

[Dan Plimak]

The gist of this bug is that the parser seems to leave a stray left angle
bracket from any HTML tag as long as it is in just the right place, which seems
to be around the *4096* byte mark. (I smell an off-by one buffer screwup here.)

In the limited time I've had to play with this bug (I found this in the middle
of hurriedly writing some release notes in between fixing bugs for a product
that's due tomorrow), I've managed to whip up two test cases (located at the URL
for this bug), both of which need to be run using the file:// resource type to
most easily reproduce this bug, and need to be left in their original format
(which is CR/LF line endings). *The exact number of characters matters when
reproducing this bug*, as I already mentioned. To ensure the file contents
aren't munged when downloading, the two testcases are in a .zip file.

To see the bug in action, open each test case, and look for an opening angle
bracket at the bottom. Then look at the HTML. It all should become clear then.

Comment 1

[Dan Plimak]

Attachment: Two test cases inside a .zip file. Make sure you preserve the contents (i.e., line endings) so file size stays intact.

Comment 2

[doctor__j]

Some additional info after playing with the cool test case:

The requirements for reproducing the bug are:
1) You have to cheat/make Moz into thinking that it is dealing with an HTML file
(so Moz will have to parse the content instead of diaplaying it like plain text).

2) File content:
 a) First, put a bunch of characters exactly 4095 bytes long.
 b) Then, add a retuen (which, in DOS file format, means an CR and LF)
 c) Finally, put some other characters (length doesn't matter)

Comment 3

[doctor__j]

Attachment: I've tidied up the testcase for sheer viewing pleasure

Comment 4

[doctor__j]

Oh... the 2nd attachment is a ZIP file too...

Comment 5

[Boris Zbarsky [:bzbarsky]]

I see this on Linux build 2001-04-22-21 as well.  status to new, adding various
keywords.

Comment 6

[harishd]

Setting to 1.0 since 0.9.2 hasn't been scheduled yet.

Comment 7

[clayton]

Moving to milestone 0.9.2 
We'd really like this fix before too long
nsbeta1-, we don't need it immediately, other things are more important right now.

Comment 8

[harishd]

Symptoms are very similar to bug 63081.

Comment 9

[harishd]

Attachment: Patch v1.1

Comment 10

[harishd]

Attachment: Patch v1.2 [ replacing postfix operator with prefix ]

Comment 11

[vidur (gone)]

r/sr=vidur

Comment 12

[Heikki Toivonen (remove -bugzilla when emailing directly)]

r=heikki.

Comment 13

[Asa Dotzler [:asa]]

a= [e-mail] for checkin to the trunk.
(on behalf of drivers)

Comment 14

[harishd]

Fix is in.

Comment 15

[bsharma]

Verified on
build: 2001-06-20-04-Trunk
platform: Win NT

Both the test cases load fine.