Changeset 64702 in webkit

Timestamp:

Aug 4, 2010 6:10:07 PM (14 years ago)

Author:

abarth@webkit.org

Message:

2010-08-04 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

fast/parser/residual-style-hang.html hangs
​https://bugs.webkit.org/show_bug.cgi?id=42950

Add a dump-as-markup test that shows what DOM we actually create in
this case.

Note: these results are for the existing parser.

• fast/parser/residual-style-dom-expected.txt: Added.
• fast/parser/residual-style-dom.html: Added.

2010-08-04 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

fast/parser/residual-style-hang.html hangs
​https://bugs.webkit.org/show_bug.cgi?id=42950

We need to cap the iteration of the adoption agency algorithm to
prevent this hang. The legacy tree builder does this as well.

• html/HTMLTreeBuilder.cpp: (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/parser/residual-style-dom-expected.txt (added)
• LayoutTests/fast/parser/residual-style-dom.html (added)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/html/HTMLTreeBuilder.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2010-08-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        fast/parser/residual-style-hang.html hangs
+        https://bugs.webkit.org/show_bug.cgi?id=42950
+
+        Add a dump-as-markup test that shows what DOM we actually create in
+        this case.
+
+        Note: these results are for the existing parser.
+
+        * fast/parser/residual-style-dom-expected.txt: Added.
+        * fast/parser/residual-style-dom.html: Added.
+
 2010-08-04  Andrew Wilson  <atwilson@chromium.org>
 

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-08-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        fast/parser/residual-style-hang.html hangs
+        https://bugs.webkit.org/show_bug.cgi?id=42950
+
+        We need to cap the iteration of the adoption agency algorithm to
+        prevent this hang.  The legacy tree builder does this as well.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+
 2010-08-04  Adam Barth  <abarth@webkit.org>
 

trunk/WebCore/html/HTMLTreeBuilder.cpp

@@ -1648 +1648 @@
 void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
 {
-    while (1) {
+    // The adoption agency algorithm is N^2.  We limit the number of iterations
+    // to stop from hanging the whole browser.  This limit is copied from the
+    // legacy tree builder and might need to be tweaked in the future.
+    static const int adoptionAgencyIterationLimit = 10;
+
+    for (int i = 0; i < adoptionAgencyIterationLimit; ++i) {
         // 1.
         Element* formattingElement = m_tree.activeFormattingElements()->closestElementInScopeWithName(token.name());
@@ -1681 +1686 @@
         HTMLElementStack::ElementRecord* nextNode = node->next();
         HTMLElementStack::ElementRecord* lastNode = furthestBlock;
-        while (1) {
+        for (int i = 0; i < adoptionAgencyIterationLimit; ++i) {
             // 6.1
             node = nextNode;