Bug 157230 - Some content causes deep recursion.
Summary: Some content causes deep recursion.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: zalan
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2016-04-29 21:22 PDT by zalan
Modified: 2016-04-30 22:41 PDT (History)
4 users (show)

See Also:


Attachments
Test case (649 bytes, text/html)
2016-04-29 21:22 PDT, zalan
no flags Details
WIP patch (2.28 KB, patch)
2016-04-29 21:27 PDT, zalan
no flags Details | Formatted Diff | Diff
Patch (5.28 KB, patch)
2016-04-30 21:43 PDT, zalan
no flags Details | Formatted Diff | Diff
Patch (5.37 KB, patch)
2016-04-30 21:51 PDT, zalan
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description zalan 2016-04-29 21:22:03 PDT
Created attachment 277795 [details]
Test case

See attached test case.
Comment 1 zalan 2016-04-29 21:23:01 PDT
rdar://problem/7694756
Comment 2 zalan 2016-04-29 21:27:36 PDT
Created attachment 277796 [details]
WIP patch

This patch limits render tree nesting. DOM can have all the nested nodes but renderer tree has only up to 512. (from 512 and up, it's like they were display: none}
This (DOM vs render tree) matches FF(45.0.2) behavior.
Comment 3 Alexey Proskuryakov 2016-04-29 23:56:27 PDT
> This (DOM vs render tree) matches FF(45.0.2) behavior.

But not Chrome?
Comment 4 zalan 2016-04-30 06:33:31 PDT
(In reply to comment #3)
> > This (DOM vs render tree) matches FF(45.0.2) behavior.
> 
> But not Chrome?
No, Chrome crashes when the stack space is exhausted.
Comment 5 zalan 2016-04-30 21:43:35 PDT
Created attachment 277839 [details]
Patch
Comment 6 Antti Koivisto 2016-04-30 21:45:52 PDT
Comment on attachment 277839 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=277839&action=review

> Source/WebCore/style/StyleTreeResolver.cpp:370
>          auto& element = downcast<Element>(node);
> +        if (it.depth() > Settings::defaultMaximumRenderTreeDepth) {

An empty line after auto& element would look nicer.
Comment 7 zalan 2016-04-30 21:51:46 PDT
Created attachment 277840 [details]
Patch
Comment 8 WebKit Commit Bot 2016-04-30 22:41:53 PDT
Comment on attachment 277840 [details]
Patch

Clearing flags on attachment: 277840

Committed r200301: <http://trac.webkit.org/changeset/200301>
Comment 9 WebKit Commit Bot 2016-04-30 22:41:58 PDT
All reviewed patches have been landed.  Closing bug.