Closed
Bug 582535
Opened 14 years ago
Closed 14 years ago
Browser crash in case of large DOM depth
Categories
(Core :: Layout, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 323394
People
(Reporter: christian.maehler, Unassigned)
Details
User-Agent: Mozilla/5.0 (Windows; Windows NT 5.1; rv:2.0b2) Gecko/20100720 Firefox/4.0b2 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; Windows NT 5.1; rv:2.0b2) Gecko/20100720 Firefox/4.0b2 (.NET CLR 3.5.30729)
This is the source code of the page that causes the crash:
<html>
<head>
<title>DIV leak test</title>
<script type="text/javascript">
var numdivlayer=0;
var mwidth=1000;
function addDivLayer() {
// ermittele DIV, unterhalb dessen ein weiteres DIV angefügt werden muss
if (numdivlayer == 0) {
obj=document.getElementById("divcontainer");
} else {
obj=document.getElementById("nesteddiv"+numdivlayer)
}
// div Zähler erhöhen
numdivlayer++;
// breite sukzessive verkleinern
wh = mwidth-1*numdivlayer;
// abwechselnd andere Rahmenfarbe
var c= numdivlayer % 2;
// div definieren
divstr='<div class="class'+c+'" id="nesteddiv'+numdivlayer+'" style="width:'+wh+'px;height:'+wh+'px">'+numdivlayer+'</div>';
// neues DIV einhängen
obj.innerHTML = divstr;
// prüfen, ob DIV in DOM vorhanden
if(!document.getElementById("nesteddiv"+numdivlayer)) {
window.title= "Error: " + numdivlayer;
} else {
document.title = "Success: " + numdivlayer;
}
}
function starttest() {
// erzeuge 1000 ineinander verschachtelte DIVs
for(var cc=0; cc<1000; cc++) {
addDivLayer();
}
}
</script>
<style>
.class1 {
background-color: #FF0000;
border:1px solid #000000;
}
.class0 {
background-color: #FF0000;
border:1px solid #FFFFFF;
}
</style>
</head>
<body onload="starttest()">
<div id="divcontainer" class="class1" style="width:1000px;height:1000px"></div>
</body>
</html>
Reproducible: Always
Steps to Reproduce:
1. Call the page in the "details" section
2. Browser crashes
3. If you reduce the depth in function "starttest", e.g. to 900, the page is ok.
Actual Results:
browser crashes immediatly
Expected Results:
Rendering of 1000 nested DIVs (as safari is doing).
We use that page to detect brwoser leaks and browser DOM handling differences between IE, FF and Safari. Safari is rendering to a DOM depth of 1000 as expected. IE renders up to a DOM Depth of 50 and FF 3.xx renders to a DOM depth of approx. 200 (which would be enough for our purposes).
Layout can't deal, which is known. The new HTML parser has a limit of 200 on a per-innerHTML basis, but this script does one innerHTML at a time, but you could crash with createElement/appendChild anyway.
Component: General → Layout
Product: Firefox → Core
QA Contact: general → layout
Whiteboard: dupeme
Version: unspecified → Trunk
That's correct. I did an alternative test with createElement/appendchild and the behavior is the same.
Marking as duplicate based on description--didn't check the crash stack myself.
Status: UNCONFIRMED → RESOLVED
Closed: 14 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•