81993 - Mozilla almost hangs on this page with <FONT> tags not closed

Status: RESOLVED DUPLICATE of bug 61684

(Core :: Layout, defect)

Description

[lars]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux 2.4.3-XFS-3 i686; en-US; rv:0.9+)
Gecko/20010520
BuildID:    2001052021

Both the latest Milestone release and the 5/20/2001 nightly build freeze while
trying to fetch this URL -- at least when clicking on the "NetBSD/macppc 1.5
Install Notes" link at <http://netbsd.org/Ports/macppc/>.

Reproducible: Always
Steps to Reproduce:
1. Go to http://netbsd.org/Ports/macppc/
2. Select "NetBSD/macppc 1.5 Install Notes" along the right side of the page.
3. Watch Mozilla crash.

Comment 1

[timeless]

fwiw the server is alive.

Comment 2

[James Paige]

I tested this on build 2001052020 on Windows 95, and although it did not crash,
it did lock up, and I was forced to kill mozilla with CTRL+ALT+DEL

I manually downloaded the offending page from the FTP server with another ftp
client, and mozilla locked when I tried to view it as a local file.

Comment 3

[doctor__j]

Some stats on that page...
	Opening tags	Closing tags
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<tr>
203
	0
<td>
633
	0
<font>
167
	2
<b>
629
	431

No wonder Mozilla is choked...

Comment 4

[Jaime Rodriguez, Jr.]

Harish - The PDT would like to kow the follwoing: how can we crash? Is this
similar to the parser crash we just fixed?

Comment 5

[Jaime Rodriguez, Jr.]

Appears that this might hang Win32 build, and drives CPU usage to 100%.

Comment 6

[Doron Rosenberg (IBM)]

os: all, hangs win98 2001052320

I see no crash, only a hang that needs ctrl-alt-del love.

Comment 7

[harishd]

Jaime: What recent parser crash is being referred here? 

Comment 8

[harishd]

Here is the trace when mozilla locks up:

StyleContextImpl::FetchInheritedStyleBlob(nsStyleStructID eStyleStruct_Font) 
line 2849 + 4 bytes
StyleContextImpl::FetchInheritedStyleStruct(nsStyleStructID eStyleStruct_Font) 
line 2406 + 15 bytes
StyleContextImpl::GetStyleData(nsStyleStructID eStyleStruct_Font) line 2875 + 12 
bytes
nsFrame::GetStyleData(const nsFrame * const 0x03dcb0a8, nsStyleStructID 
eStyleStruct_Font, const nsStyleStruct * & 0x00119ad0) line 492 + 21 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03432270, const nsHTMLReflowState 
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...}, 
unsigned int & 0) line 513
nsInlineFrame::Reflow(nsInlineFrame * const 0x03dcb0a8, nsIPresContext * 
0x03432270, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 338 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x03dcb0a8, nsIFrame * * 0x00119e4c, 
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 955 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03432270, const 
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame * 
0x03dcb0a8, unsigned int & 0) line 613 + 26 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03432270, const nsHTMLReflowState 
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...}, 
unsigned int & 0) line 427 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x03dcb070, nsIPresContext * 
0x03432270, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 338 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x03dcb070, nsIFrame * * 0x0011a160, 
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 955 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03432270, const 
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame * 
0x03dcb070, unsigned int & 0) line 613 + 26 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03432270, const nsHTMLReflowState 
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...}, 
unsigned int & 0) line 427 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x03dcb038, nsIPresContext * 
0x03432270, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 338 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x03dcb038, nsIFrame * * 0x0011a474, 
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 955 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03432270, const 
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame * 
0x03dcb038, unsigned int & 0) line 613 + 26 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03432270, const nsHTMLReflowState 
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...}, 
unsigned int & 0) line 427 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x03dcb000, nsIPresContext * 
0x03432270, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 338 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x03dcb000, nsIFrame * * 0x0011a788, 
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 955 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03432270, const 
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame * 
0x03dcb000, unsigned int & 0) line 613 + 26 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03432270, const nsHTMLReflowState 
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...}, 
unsigned int & 0) line 427 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x03dcaf68, nsIPresContext * 
0x03432270, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 338 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x03dcaf68, nsIFrame * * 0x0011aa9c, 
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 955 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03432270, const 
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame * 
0x03dcaf68, unsigned int & 0) line 613 + 26 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03432270, const nsHTMLReflowState 
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...}, 
unsigned int & 0) line 427 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x03dcaf30, nsIPresContext * 
0x03432270, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 338 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x03dcaf30, nsIFrame * * 0x0011adb0, 
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 955 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03432270, const 
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame * 
0x03dcaf30, unsigned int & 0) line 613 + 26 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03432270, const nsHTMLReflowState 
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...}, 
unsigned int & 0) line 427 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x03dcaef8, nsIPresContext * 
0x03432270, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 338 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x03dcaef8, nsIFrame * * 0x0011b0c4, 
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 955 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03432270, const 
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame * 
0x03dcaef8, unsigned int & 0) line 613 + 26 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03432270, const nsHTMLReflowState 
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...}, 
unsigned int & 0) line 427 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x03dcaec0, nsIPresContext * 
0x03432270, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 338 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x03dcaec0, nsIFrame * * 0x0011b3d8, 
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 955 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03432270, const 
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame * 
0x03dcaec0, unsigned int & 0) line 613 + 26 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03432270, const nsHTMLReflowState 
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...}, 
unsigned int & 0) line 427 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x03dcae88, nsIPresContext * 
0x03432270, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 338 + 28 bytes
nsLineLayout::ReflowFrame(nsIFrame * 0x03dcae88, nsIFrame * * 0x0011b6ec, 
unsigned int & 0, nsHTMLReflowMetrics * 0x00000000, int & 0) line 955 + 43 bytes
nsInlineFrame::ReflowInlineFrame(nsIPresContext * 0x03432270, const 
nsHTMLReflowState & {...}, nsInlineFrame::InlineReflowState & {...}, nsIFrame * 
0x03dcae88, unsigned int & 0) line 613 + 26 bytes
nsInlineFrame::ReflowFrames(nsIPresContext * 0x03432270, const nsHTMLReflowState 
& {...}, nsInlineFrame::InlineReflowState & {...}, nsHTMLReflowMetrics & {...}, 
unsigned int & 0) line 427 + 28 bytes
nsInlineFrame::Reflow(nsInlineFrame * const 0x03dcae50, nsIPresContext * 
0x03432270, nsHTMLReflowMetrics & {...}, const nsHTMLReflowState & {...}, 
unsigned int & 0) line 338 + 28 bytes
nsLineLa

I see a bunch of open FONT tags. This could trigger the stack overflow problem 
:-(. 

CCing waterson.

Comment 9

[harishd]

Attachment: Working testcase [ with FONT tags closed ]

Comment 10

[Chris Waterson]

Yup, this is a well-known problem. Unclosed inline tags lead to a deeply nested
content model, which leads to deeply nested frame hierarchy, which sends reflow
off into the weeds. I have at least one other bug open for this very problem.
harishd: feel free to reassign to me and I'll dup it when I can find the other bug.

Comment 11

[harishd]

Reassigning to waterson.

Comment 12

[Jeremy M. Dolan]

no crash with linux 0.9.1, just 209 seconds to render (almost killed it). After
loading, the scrollbar buttons weren't there.

Comment 13

[Håkan Waara]

moving to layout.

Comment 14

[Chris Waterson]

It looks like the page loads now, after a really, really long time.

Comment 15

[Tom Mraz]

Updating summary.

Comment 16

[timeless]

bug 18480 was the old crasher about unclosed tags, bug 60731 covers font stuff.
there's bug 83042 which is amazingly tiny and cute...

bug 39133 could be a good candidate but the accused function call doesn't 
appear in the call stack.

There's bug 56854 which is probably a better candidate but that's frames and 
reflows. I think that's the best bet.

bug 57451 doesn't appear to be diagnosed (except it's _not_ table reflows).

bug 61684 is about frames and reflows. Comments From [e-mail] 
2001-01-11 13:37 This is the old "unclosed font tag" problem.  The content tree 
is getting absurdly deep.  Not only are there thousands of unclosed font tags, 
but in general they serve no purpose;  they have identical attributes.

So that's probably the one waterson would choose.

bug 62203 is "Yeah, lots of font tags."

Really amusing but very unrelated is bug 64858. (2001-06-07 13:39)

Since this is waterson's bug and there were a few matches I'm going to let him 
or someone else make the resolution if they please.

My only question is should this bug be considered a Style System bug since 
that's where the tip of the stack is? (I suppose it could be a parser bug for 
building such a messy tree) or is it just a layout bug because that's where the 
rest of the stack is.  Moving QA out of browser-general.

Comment 17

[Chase Tingley]

*** Bug 95569 has been marked as a duplicate of this bug. ***

Comment 18

[Mircea Romantan]

I have 2001112903 on WinXP and I see no crash, no CPU pegging, all ok. 

Comment 19

[doctor__j]

Marking WFM.
Tested on Win32 nightly trunk build 2001120703.

Comment 20

[John Morrison]

no, this is still a bug. (Loading it over the network may have "metered" layout 
in this case, but loading from disk, this is still an issue).

Comment 21

[doctor__j]

I have tried to DL the file (INSTALL.htm) into my hard disk and load the file
locally.  No hang was observed.  It just chokes for about ten seconds and then
the page is displayed.  Running on 256MB RAM with Intel CPU (P3 866MHz) if that
matters.

Comment 22

[leon.zhang]

Can the Bug can be reproduced now?
I tried the attachment and original website, but not reproduce the bug again.
?

Comment 23

[José Jeria]

Still seing this on this page (Mozilla will hang):
ftp://ftp.NetBSD.ORG/pub/NetBSD/NetBSD-1.5.2/macppc/INSTALL.html

Comment 24

[leon.zhang]

I think two reasons for the long time waiting.
1) FTP protocal is two TCP connection protocal, normally access file using FTP
will cost more time than HTTP,which based only one TCp protocol.

2) Comparing mozilla with IE,we can find that mozilla display the whole webpage
when the html file loaded completely ,but,in IE ,displaying the webpage and
loading file is at the same time. Maybe the diffrence in the processing 
mechanism  can explain the bug? in reflow module? or html parser module?

Comment 25

[WD]

*** Bug 175642 has been marked as a duplicate of this bug. ***

Comment 26

[WD]

*** Bug 153842 has been marked as a duplicate of this bug. ***

Comment 27

[Markus Hübner]

Anyone willing to take this?

Comment 28

[Boris Zbarsky [:bzbarsky]]

.

Comment 29

[Andrew Schultz]

*** Bug 207366 has been marked as a duplicate of this bug. ***

Comment 30

[Andrew Schultz]

*** Bug 122976 has been marked as a duplicate of this bug. ***

Comment 31

[Andrew Schultz]

*** Bug 212565 has been marked as a duplicate of this bug. ***

Comment 32

[Olivier Cahagne]

*** Bug 215413 has been marked as a duplicate of this bug. ***

Comment 33

[Markus Hübner]

Using trunk build 2004101904 on winxp pro sp1 this works fine - also with nice 
incremental reflow.

Anyone still seeing this problem?

Comment 34

[Andrew Schultz]

Markus: think hardware.
linux trunk 2004101905 is nearly 2x faster loading the URL than Mozilla 1.0. 
But it's also nearly 2x faster loading the testcase with closed font tags.  In
both builds, the URL was ~4x slower than the attached testcase.  Try saving the
file locally and/or look at the dupes for more evil pages.

Comment 35

[Robin Monks]

*** This bug has been marked as a duplicate of 61684 ***