Bug 614583: Bail earlier when attempting to SetAttr when we don't have room for more attributes to avoid caching flags and attributes to get out of sync. r=jst a=blocker
authorJonas Sicking <jonas@sicking.cc>
Tue, 14 Dec 2010 09:16:24 -0800
changeset 59211 5a4959ebd32631c7a73a7553e7c54cba42704092
parent 59210 e9b1ad4ad23bc936303e6674b7e2e87a1035891f
child 59212 e65c1b9d95fbcf63254f57d7fa57332f5168ae71
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewersjst, blocker
bugs614583
milestone2.0b9pre
Bug 614583: Bail earlier when attempting to SetAttr when we don't have room for more attributes to avoid caching flags and attributes to get out of sync. r=jst a=blocker
content/base/src/nsAttrAndChildArray.cpp
content/base/src/nsAttrAndChildArray.h
content/base/src/nsGenericElement.cpp
content/base/test/Makefile.in
content/base/test/test_bug614583.html
--- a/content/base/src/nsAttrAndChildArray.cpp
+++ b/content/base/src/nsAttrAndChildArray.cpp
@@ -316,28 +316,28 @@ nsAttrAndChildArray::AttrCount() const
 }
 
 const nsAttrValue*
 nsAttrAndChildArray::GetAttr(nsIAtom* aLocalName, PRInt32 aNamespaceID) const
 {
   PRUint32 i, slotCount = AttrSlotCount();
   if (aNamespaceID == kNameSpaceID_None) {
     // This should be the common case so lets make an optimized loop
-    for (i = 0; i < slotCount && mImpl->mBuffer[i * ATTRSIZE]; ++i) {
+    for (i = 0; i < slotCount && AttrSlotIsTaken(i); ++i) {
       if (ATTRS(mImpl)[i].mName.Equals(aLocalName)) {
         return &ATTRS(mImpl)[i].mValue;
       }
     }
 
     if (mImpl && mImpl->mMappedAttrs) {
       return mImpl->mMappedAttrs->GetAttr(aLocalName);
     }
   }
   else {
-    for (i = 0; i < slotCount && mImpl->mBuffer[i * ATTRSIZE]; ++i) {
+    for (i = 0; i < slotCount && AttrSlotIsTaken(i); ++i) {
       if (ATTRS(mImpl)[i].mName.Equals(aLocalName, aNamespaceID)) {
         return &ATTRS(mImpl)[i].mValue;
       }
     }
   }
 
   return nsnull;
 }
@@ -355,17 +355,17 @@ nsAttrAndChildArray::AttrAt(PRUint32 aPo
 
   return &ATTRS(mImpl)[aPos - mapped].mValue;
 }
 
 nsresult
 nsAttrAndChildArray::SetAttr(nsIAtom* aLocalName, const nsAString& aValue)
 {
   PRUint32 i, slotCount = AttrSlotCount();
-  for (i = 0; i < slotCount && mImpl->mBuffer[i * ATTRSIZE]; ++i) {
+  for (i = 0; i < slotCount && AttrSlotIsTaken(i); ++i) {
     if (ATTRS(mImpl)[i].mName.Equals(aLocalName)) {
       ATTRS(mImpl)[i].mValue.SetTo(aValue);
 
       return NS_OK;
     }
   }
 
   NS_ENSURE_TRUE(slotCount < ATTRCHILD_ARRAY_MAX_ATTR_COUNT,
@@ -380,17 +380,17 @@ nsAttrAndChildArray::SetAttr(nsIAtom* aL
 
   return NS_OK;
 }
 
 nsresult
 nsAttrAndChildArray::SetAndTakeAttr(nsIAtom* aLocalName, nsAttrValue& aValue)
 {
   PRUint32 i, slotCount = AttrSlotCount();
-  for (i = 0; i < slotCount && mImpl->mBuffer[i * ATTRSIZE]; ++i) {
+  for (i = 0; i < slotCount && AttrSlotIsTaken(i); ++i) {
     if (ATTRS(mImpl)[i].mName.Equals(aLocalName)) {
       ATTRS(mImpl)[i].mValue.Reset();
       ATTRS(mImpl)[i].mValue.SwapValueWith(aValue);
 
       return NS_OK;
     }
   }
 
@@ -413,17 +413,17 @@ nsAttrAndChildArray::SetAndTakeAttr(nsIN
 {
   PRInt32 namespaceID = aName->NamespaceID();
   nsIAtom* localName = aName->NameAtom();
   if (namespaceID == kNameSpaceID_None) {
     return SetAndTakeAttr(localName, aValue);
   }
 
   PRUint32 i, slotCount = AttrSlotCount();
-  for (i = 0; i < slotCount && mImpl->mBuffer[i * ATTRSIZE]; ++i) {
+  for (i = 0; i < slotCount && AttrSlotIsTaken(i); ++i) {
     if (ATTRS(mImpl)[i].mName.Equals(localName, namespaceID)) {
       ATTRS(mImpl)[i].mName.SetTo(aName);
       ATTRS(mImpl)[i].mValue.Reset();
       ATTRS(mImpl)[i].mValue.SwapValueWith(aValue);
 
       return NS_OK;
     }
   }
@@ -516,17 +516,17 @@ nsAttrAndChildArray::GetSafeAttrNameAt(P
 
   return &reinterpret_cast<InternalAttr*>(pos)->mName;
 }
 
 const nsAttrName*
 nsAttrAndChildArray::GetExistingAttrNameFromQName(const nsAString& aName) const
 {
   PRUint32 i, slotCount = AttrSlotCount();
-  for (i = 0; i < slotCount && mImpl->mBuffer[i * ATTRSIZE]; ++i) {
+  for (i = 0; i < slotCount && AttrSlotIsTaken(i); ++i) {
     if (ATTRS(mImpl)[i].mName.QualifiedNameEquals(aName)) {
       return &ATTRS(mImpl)[i].mName;
     }
   }
 
   if (mImpl && mImpl->mMappedAttrs) {
     return mImpl->mMappedAttrs->GetExistingAttrNameFromQName(aName);
   }
@@ -545,24 +545,24 @@ nsAttrAndChildArray::IndexOfAttr(nsIAtom
     }
   }
 
   PRUint32 i;
   PRUint32 mapped = MappedAttrCount();
   PRUint32 slotCount = AttrSlotCount();
   if (aNamespaceID == kNameSpaceID_None) {
     // This should be the common case so lets make an optimized loop
-    for (i = 0; i < slotCount && mImpl->mBuffer[i * ATTRSIZE]; ++i) {
+    for (i = 0; i < slotCount && AttrSlotIsTaken(i); ++i) {
       if (ATTRS(mImpl)[i].mName.Equals(aLocalName)) {
         return i + mapped;
       }
     }
   }
   else {
-    for (i = 0; i < slotCount && mImpl->mBuffer[i * ATTRSIZE]; ++i) {
+    for (i = 0; i < slotCount && AttrSlotIsTaken(i); ++i) {
       if (ATTRS(mImpl)[i].mName.Equals(aLocalName, aNamespaceID)) {
         return i + mapped;
       }
     }
   }
 
   return -1;
 }
@@ -650,17 +650,17 @@ nsAttrAndChildArray::Clear()
     return;
   }
 
   if (mImpl->mMappedAttrs) {
     NS_RELEASE(mImpl->mMappedAttrs);
   }
 
   PRUint32 i, slotCount = AttrSlotCount();
-  for (i = 0; i < slotCount && mImpl->mBuffer[i * ATTRSIZE]; ++i) {
+  for (i = 0; i < slotCount && AttrSlotIsTaken(i); ++i) {
     ATTRS(mImpl)[i].~InternalAttr();
   }
 
   nsAutoScriptBlocker scriptBlocker;
   PRUint32 end = slotCount * ATTRSIZE + ChildCount();
   for (i = slotCount * ATTRSIZE; i < end; ++i) {
     nsIContent* child = static_cast<nsIContent*>(mImpl->mBuffer[i]);
     // making this PR_FALSE so tree teardown doesn't end up being
--- a/content/base/src/nsAttrAndChildArray.h
+++ b/content/base/src/nsAttrAndChildArray.h
@@ -120,16 +120,22 @@ public:
   nsresult SetAndTakeMappedAttr(nsIAtom* aLocalName, nsAttrValue& aValue,
                                 nsMappedAttributeElement* aContent,
                                 nsHTMLStyleSheet* aSheet);
   nsresult SetMappedAttrStyleSheet(nsHTMLStyleSheet* aSheet);
   void WalkMappedAttributeStyleRules(nsRuleWalker* aRuleWalker);
 
   void Compact();
 
+  bool CanFitMoreAttrs() const
+  {
+    return AttrSlotCount() < ATTRCHILD_ARRAY_MAX_ATTR_COUNT ||
+           !AttrSlotIsTaken(ATTRCHILD_ARRAY_MAX_ATTR_COUNT - 1);
+  }
+
 private:
   nsAttrAndChildArray(const nsAttrAndChildArray& aOther); // Not to be implemented
   nsAttrAndChildArray& operator=(const nsAttrAndChildArray& aOther); // Not to be implemented
 
   void Clear();
 
   PRUint32 NonMappedAttrCount() const;
   PRUint32 MappedAttrCount() const;
@@ -145,16 +151,22 @@ private:
     return AttrSlotCount() * ATTRSIZE;
   }
 
   PRUint32 AttrSlotCount() const
   {
     return mImpl ? mImpl->mAttrAndChildCount & ATTRCHILD_ARRAY_ATTR_SLOTS_COUNT_MASK : 0;
   }
 
+  bool AttrSlotIsTaken(PRUint32 aSlot) const
+  {
+    NS_PRECONDITION(aSlot < AttrSlotCount(), "out-of-bounds");
+    return mImpl->mBuffer[aSlot * ATTRSIZE];
+  }
+
   void SetChildCount(PRUint32 aCount)
   {
     mImpl->mAttrAndChildCount = 
         (mImpl->mAttrAndChildCount & ATTRCHILD_ARRAY_ATTR_SLOTS_COUNT_MASK) |
         (aCount << ATTRCHILD_ARRAY_ATTR_SLOTS_BITS);
   }
 
   void SetAttrSlotCount(PRUint32 aCount)
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -4573,16 +4573,20 @@ nsresult
 nsGenericElement::SetAttr(PRInt32 aNamespaceID, nsIAtom* aName,
                           nsIAtom* aPrefix, const nsAString& aValue,
                           PRBool aNotify)
 {
   NS_ENSURE_ARG_POINTER(aName);
   NS_ASSERTION(aNamespaceID != kNameSpaceID_Unknown,
                "Don't call SetAttr with unknown namespace");
 
+  if (!mAttrsAndChildren.CanFitMoreAttrs()) {
+    return NS_ERROR_FAILURE;
+  }
+
   nsAutoString oldValue;
   PRBool modification = PR_FALSE;
   PRBool hasListeners = aNotify &&
     nsContentUtils::HasMutationListeners(this,
                                          NS_EVENT_BITS_MUTATION_ATTRMODIFIED,
                                          this);
   
   // If we have no listeners and aNotify is false, we are almost certainly
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -434,16 +434,17 @@ include $(topsrcdir)/config/rules.mk
 		test_bug600466.html \
 		test_bug600468.html \
 		test_bug600471.html \
 		test_bug601803.html \
 		file_bug601803a.html \
 		file_bug601803b.html \
 		test_bug602838.html \
 		script_bug602838.sjs \
+		test_bug614583.html \
 		test_bug604660.html \
 		file_bug604660-1.xml \
 		file_bug604660-2.xsl \
 		file_bug604660-3.js \
 		file_bug604660-4.js \
 		file_bug604660-5.xml \
 		file_bug604660-6.xsl \
 		test_bug605982.html \
new file mode 100644
--- /dev/null
+++ b/content/base/test/test_bug614583.html
@@ -0,0 +1,262 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=614583
+-->
+<head>
+  <title>Test for Bug 614583</title>
+  <script type="application/javascript" src="/MochiKit/packed.js"></script>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=614583">Mozilla Bug 614583</a>
+<span id="crash1"
+attr0 attr1 attr2 attr3 attr4 attr5 attr6 attr7 attr8 attr9
+attr10 attr11 attr12 attr13 attr14 attr15 attr16 attr17 attr18 attr19
+attr20 attr21 attr22 attr23 attr24 attr25 attr26 attr27 attr28 attr29
+attr30 attr31 attr32 attr33 attr34 attr35 attr36 attr37 attr38 attr39
+attr40 attr41 attr42 attr43 attr44 attr45 attr46 attr47 attr48 attr49
+attr50 attr51 attr52 attr53 attr54 attr55 attr56 attr57 attr58 attr59
+attr60 attr61 attr62 attr63 attr64 attr65 attr66 attr67 attr68 attr69
+attr70 attr71 attr72 attr73 attr74 attr75 attr76 attr77 attr78 attr79
+attr80 attr81 attr82 attr83 attr84 attr85 attr86 attr87 attr88 attr89
+attr90 attr91 attr92 attr93 attr94 attr95 attr96 attr97 attr98 attr99
+attr100 attr101 attr102 attr103 attr104 attr105 attr106 attr107 attr108 attr109
+attr110 attr111 attr112 attr113 attr114 attr115 attr116 attr117 attr118 attr119
+attr120 attr121 attr122 attr123 attr124 attr125 attr126 attr127 attr128 attr129
+attr130 attr131 attr132 attr133 attr134 attr135 attr136 attr137 attr138 attr139
+attr140 attr141 attr142 attr143 attr144 attr145 attr146 attr147 attr148 attr149
+attr150 attr151 attr152 attr153 attr154 attr155 attr156 attr157 attr158 attr159
+attr160 attr161 attr162 attr163 attr164 attr165 attr166 attr167 attr168 attr169
+attr170 attr171 attr172 attr173 attr174 attr175 attr176 attr177 attr178 attr179
+attr180 attr181 attr182 attr183 attr184 attr185 attr186 attr187 attr188 attr189
+attr190 attr191 attr192 attr193 attr194 attr195 attr196 attr197 attr198 attr199
+attr200 attr201 attr202 attr203 attr204 attr205 attr206 attr207 attr208 attr209
+attr210 attr211 attr212 attr213 attr214 attr215 attr216 attr217 attr218 attr219
+attr220 attr221 attr222 attr223 attr224 attr225 attr226 attr227 attr228 attr229
+attr230 attr231 attr232 attr233 attr234 attr235 attr236 attr237 attr238 attr239
+attr240 attr241 attr242 attr243 attr244 attr245 attr246 attr247 attr248 attr249
+attr250 attr251 attr252 attr253 attr254 attr255 attr256 attr257 attr258 attr259
+attr260 attr261 attr262 attr263 attr264 attr265 attr266 attr267 attr268 attr269
+attr270 attr271 attr272 attr273 attr274 attr275 attr276 attr277 attr278 attr279
+attr280 attr281 attr282 attr283 attr284 attr285 attr286 attr287 attr288 attr289
+attr290 attr291 attr292 attr293 attr294 attr295 attr296 attr297 attr298 attr299
+attr300 attr301 attr302 attr303 attr304 attr305 attr306 attr307 attr308 attr309
+attr310 attr311 attr312 attr313 attr314 attr315 attr316 attr317 attr318 attr319
+attr320 attr321 attr322 attr323 attr324 attr325 attr326 attr327 attr328 attr329
+attr330 attr331 attr332 attr333 attr334 attr335 attr336 attr337 attr338 attr339
+attr340 attr341 attr342 attr343 attr344 attr345 attr346 attr347 attr348 attr349
+attr350 attr351 attr352 attr353 attr354 attr355 attr356 attr357 attr358 attr359
+attr360 attr361 attr362 attr363 attr364 attr365 attr366 attr367 attr368 attr369
+attr370 attr371 attr372 attr373 attr374 attr375 attr376 attr377 attr378 attr379
+attr380 attr381 attr382 attr383 attr384 attr385 attr386 attr387 attr388 attr389
+attr390 attr391 attr392 attr393 attr394 attr395 attr396 attr397 attr398 attr399
+attr400 attr401 attr402 attr403 attr404 attr405 attr406 attr407 attr408 attr409
+attr410 attr411 attr412 attr413 attr414 attr415 attr416 attr417 attr418 attr419
+attr420 attr421 attr422 attr423 attr424 attr425 attr426 attr427 attr428 attr429
+attr430 attr431 attr432 attr433 attr434 attr435 attr436 attr437 attr438 attr439
+attr440 attr441 attr442 attr443 attr444 attr445 attr446 attr447 attr448 attr449
+attr450 attr451 attr452 attr453 attr454 attr455 attr456 attr457 attr458 attr459
+attr460 attr461 attr462 attr463 attr464 attr465 attr466 attr467 attr468 attr469
+attr470 attr471 attr472 attr473 attr474 attr475 attr476 attr477 attr478 attr479
+attr480 attr481 attr482 attr483 attr484 attr485 attr486 attr487 attr488 attr489
+attr490 attr491 attr492 attr493 attr494 attr495 attr496 attr497 attr498 attr499
+attr500 attr501 attr502 attr503 attr504 attr505 attr506 attr507 attr508 attr509
+attr510 attr511 attr512 attr513 attr514 attr515 attr516 attr517 attr518 attr519
+attr520 attr521 attr522 attr523 attr524 attr525 attr526 attr527 attr528 attr529
+attr530 attr531 attr532 attr533 attr534 attr535 attr536 attr537 attr538 attr539
+attr540 attr541 attr542 attr543 attr544 attr545 attr546 attr547 attr548 attr549
+attr550 attr551 attr552 attr553 attr554 attr555 attr556 attr557 attr558 attr559
+attr560 attr561 attr562 attr563 attr564 attr565 attr566 attr567 attr568 attr569
+attr570 attr571 attr572 attr573 attr574 attr575 attr576 attr577 attr578 attr579
+attr580 attr581 attr582 attr583 attr584 attr585 attr586 attr587 attr588 attr589
+attr590 attr591 attr592 attr593 attr594 attr595 attr596 attr597 attr598 attr599
+attr600 attr601 attr602 attr603 attr604 attr605 attr606 attr607 attr608 attr609
+attr610 attr611 attr612 attr613 attr614 attr615 attr616 attr617 attr618 attr619
+attr620 attr621 attr622 attr623 attr624 attr625 attr626 attr627 attr628 attr629
+attr630 attr631 attr632 attr633 attr634 attr635 attr636 attr637 attr638 attr639
+attr640 attr641 attr642 attr643 attr644 attr645 attr646 attr647 attr648 attr649
+attr650 attr651 attr652 attr653 attr654 attr655 attr656 attr657 attr658 attr659
+attr660 attr661 attr662 attr663 attr664 attr665 attr666 attr667 attr668 attr669
+attr670 attr671 attr672 attr673 attr674 attr675 attr676 attr677 attr678 attr679
+attr680 attr681 attr682 attr683 attr684 attr685 attr686 attr687 attr688 attr689
+attr690 attr691 attr692 attr693 attr694 attr695 attr696 attr697 attr698 attr699
+attr700 attr701 attr702 attr703 attr704 attr705 attr706 attr707 attr708 attr709
+attr710 attr711 attr712 attr713 attr714 attr715 attr716 attr717 attr718 attr719
+attr720 attr721 attr722 attr723 attr724 attr725 attr726 attr727 attr728 attr729
+attr730 attr731 attr732 attr733 attr734 attr735 attr736 attr737 attr738 attr739
+attr740 attr741 attr742 attr743 attr744 attr745 attr746 attr747 attr748 attr749
+attr750 attr751 attr752 attr753 attr754 attr755 attr756 attr757 attr758 attr759
+attr760 attr761 attr762 attr763 attr764 attr765 attr766 attr767 attr768 attr769
+attr770 attr771 attr772 attr773 attr774 attr775 attr776 attr777 attr778 attr779
+attr780 attr781 attr782 attr783 attr784 attr785 attr786 attr787 attr788 attr789
+attr790 attr791 attr792 attr793 attr794 attr795 attr796 attr797 attr798 attr799
+attr800 attr801 attr802 attr803 attr804 attr805 attr806 attr807 attr808 attr809
+attr810 attr811 attr812 attr813 attr814 attr815 attr816 attr817 attr818 attr819
+attr820 attr821 attr822 attr823 attr824 attr825 attr826 attr827 attr828 attr829
+attr830 attr831 attr832 attr833 attr834 attr835 attr836 attr837 attr838 attr839
+attr840 attr841 attr842 attr843 attr844 attr845 attr846 attr847 attr848 attr849
+attr850 attr851 attr852 attr853 attr854 attr855 attr856 attr857 attr858 attr859
+attr860 attr861 attr862 attr863 attr864 attr865 attr866 attr867 attr868 attr869
+attr870 attr871 attr872 attr873 attr874 attr875 attr876 attr877 attr878 attr879
+attr880 attr881 attr882 attr883 attr884 attr885 attr886 attr887 attr888 attr889
+attr890 attr891 attr892 attr893 attr894 attr895 attr896 attr897 attr898 attr899
+attr900 attr901 attr902 attr903 attr904 attr905 attr906 attr907 attr908 attr909
+attr910 attr911 attr912 attr913 attr914 attr915 attr916 attr917 attr918 attr919
+attr920 attr921 attr922 attr923 attr924 attr925 attr926 attr927 attr928 attr929
+attr930 attr931 attr932 attr933 attr934 attr935 attr936 attr937 attr938 attr939
+attr940 attr941 attr942 attr943 attr944 attr945 attr946 attr947 attr948 attr949
+attr950 attr951 attr952 attr953 attr954 attr955 attr956 attr957 attr958 attr959
+attr960 attr961 attr962 attr963 attr964 attr965 attr966 attr967 attr968 attr969
+attr970 attr971 attr972 attr973 attr974 attr975 attr976 attr977 attr978 attr979
+attr980 attr981 attr982 attr983 attr984 attr985 attr986 attr987 attr988 attr989
+attr990 attr991 attr992 attr993 attr994 attr995 attr996 attr997 attr998 attr999
+attr1000 attr1001 attr1002 attr1003 attr1004 attr1005 attr1006 attr1007 attr1008 attr1009
+attr1010 attr1011 attr1012 attr1013 attr1014 attr1015 attr1016 attr1017 attr1018 attr1019
+attr1020 attr1021 attr1022 attr1023 attr1024 attr1025 attr1026 attr1027 attr1028 attr1029
+attr1030 attr1031 attr1032 attr1033 attr1034 attr1035 attr1036 attr1037 attr1038 attr1039
+attr1040 attr1041 attr1042 attr1043 attr1044 attr1045 attr1046 attr1047 attr1048 attr1049
+attr1050 attr1051 attr1052 attr1053 attr1054 attr1055 attr1056 attr1057 attr1058 attr1059
+attr1060 attr1061 attr1062 attr1063 attr1064 attr1065 attr1066 attr1067 attr1068 attr1069
+attr1070 attr1071 attr1072 attr1073 attr1074 attr1075 attr1076 attr1077 attr1078 attr1079
+attr1080 attr1081 attr1082 attr1083 attr1084 attr1085 attr1086 attr1087 attr1088 attr1089
+attr1090 attr1091 attr1092 attr1093 attr1094 attr1095 attr1096 attr1097 attr1098 attr1099
+>I'm on a boat</span>
+<span
+attr0 attr1 attr2 attr3 attr4 attr5 attr6 attr7 attr8 attr9
+attr10 attr11 attr12 attr13 attr14 attr15 attr16 attr17 attr18 attr19
+attr20 attr21 attr22 attr23 attr24 attr25 attr26 attr27 attr28 attr29
+attr30 attr31 attr32 attr33 attr34 attr35 attr36 attr37 attr38 attr39
+attr40 attr41 attr42 attr43 attr44 attr45 attr46 attr47 attr48 attr49
+attr50 attr51 attr52 attr53 attr54 attr55 attr56 attr57 attr58 attr59
+attr60 attr61 attr62 attr63 attr64 attr65 attr66 attr67 attr68 attr69
+attr70 attr71 attr72 attr73 attr74 attr75 attr76 attr77 attr78 attr79
+attr80 attr81 attr82 attr83 attr84 attr85 attr86 attr87 attr88 attr89
+attr90 attr91 attr92 attr93 attr94 attr95 attr96 attr97 attr98 attr99
+attr100 attr101 attr102 attr103 attr104 attr105 attr106 attr107 attr108 attr109
+attr110 attr111 attr112 attr113 attr114 attr115 attr116 attr117 attr118 attr119
+attr120 attr121 attr122 attr123 attr124 attr125 attr126 attr127 attr128 attr129
+attr130 attr131 attr132 attr133 attr134 attr135 attr136 attr137 attr138 attr139
+attr140 attr141 attr142 attr143 attr144 attr145 attr146 attr147 attr148 attr149
+attr150 attr151 attr152 attr153 attr154 attr155 attr156 attr157 attr158 attr159
+attr160 attr161 attr162 attr163 attr164 attr165 attr166 attr167 attr168 attr169
+attr170 attr171 attr172 attr173 attr174 attr175 attr176 attr177 attr178 attr179
+attr180 attr181 attr182 attr183 attr184 attr185 attr186 attr187 attr188 attr189
+attr190 attr191 attr192 attr193 attr194 attr195 attr196 attr197 attr198 attr199
+attr200 attr201 attr202 attr203 attr204 attr205 attr206 attr207 attr208 attr209
+attr210 attr211 attr212 attr213 attr214 attr215 attr216 attr217 attr218 attr219
+attr220 attr221 attr222 attr223 attr224 attr225 attr226 attr227 attr228 attr229
+attr230 attr231 attr232 attr233 attr234 attr235 attr236 attr237 attr238 attr239
+attr240 attr241 attr242 attr243 attr244 attr245 attr246 attr247 attr248 attr249
+attr250 attr251 attr252 attr253 attr254 attr255 attr256 attr257 attr258 attr259
+attr260 attr261 attr262 attr263 attr264 attr265 attr266 attr267 attr268 attr269
+attr270 attr271 attr272 attr273 attr274 attr275 attr276 attr277 attr278 attr279
+attr280 attr281 attr282 attr283 attr284 attr285 attr286 attr287 attr288 attr289
+attr290 attr291 attr292 attr293 attr294 attr295 attr296 attr297 attr298 attr299
+attr300 attr301 attr302 attr303 attr304 attr305 attr306 attr307 attr308 attr309
+attr310 attr311 attr312 attr313 attr314 attr315 attr316 attr317 attr318 attr319
+attr320 attr321 attr322 attr323 attr324 attr325 attr326 attr327 attr328 attr329
+attr330 attr331 attr332 attr333 attr334 attr335 attr336 attr337 attr338 attr339
+attr340 attr341 attr342 attr343 attr344 attr345 attr346 attr347 attr348 attr349
+attr350 attr351 attr352 attr353 attr354 attr355 attr356 attr357 attr358 attr359
+attr360 attr361 attr362 attr363 attr364 attr365 attr366 attr367 attr368 attr369
+attr370 attr371 attr372 attr373 attr374 attr375 attr376 attr377 attr378 attr379
+attr380 attr381 attr382 attr383 attr384 attr385 attr386 attr387 attr388 attr389
+attr390 attr391 attr392 attr393 attr394 attr395 attr396 attr397 attr398 attr399
+attr400 attr401 attr402 attr403 attr404 attr405 attr406 attr407 attr408 attr409
+attr410 attr411 attr412 attr413 attr414 attr415 attr416 attr417 attr418 attr419
+attr420 attr421 attr422 attr423 attr424 attr425 attr426 attr427 attr428 attr429
+attr430 attr431 attr432 attr433 attr434 attr435 attr436 attr437 attr438 attr439
+attr440 attr441 attr442 attr443 attr444 attr445 attr446 attr447 attr448 attr449
+attr450 attr451 attr452 attr453 attr454 attr455 attr456 attr457 attr458 attr459
+attr460 attr461 attr462 attr463 attr464 attr465 attr466 attr467 attr468 attr469
+attr470 attr471 attr472 attr473 attr474 attr475 attr476 attr477 attr478 attr479
+attr480 attr481 attr482 attr483 attr484 attr485 attr486 attr487 attr488 attr489
+attr490 attr491 attr492 attr493 attr494 attr495 attr496 attr497 attr498 attr499
+attr500 attr501 attr502 attr503 attr504 attr505 attr506 attr507 attr508 attr509
+attr510 attr511 attr512 attr513 attr514 attr515 attr516 attr517 attr518 attr519
+attr520 attr521 attr522 attr523 attr524 attr525 attr526 attr527 attr528 attr529
+attr530 attr531 attr532 attr533 attr534 attr535 attr536 attr537 attr538 attr539
+attr540 attr541 attr542 attr543 attr544 attr545 attr546 attr547 attr548 attr549
+attr550 attr551 attr552 attr553 attr554 attr555 attr556 attr557 attr558 attr559
+attr560 attr561 attr562 attr563 attr564 attr565 attr566 attr567 attr568 attr569
+attr570 attr571 attr572 attr573 attr574 attr575 attr576 attr577 attr578 attr579
+attr580 attr581 attr582 attr583 attr584 attr585 attr586 attr587 attr588 attr589
+attr590 attr591 attr592 attr593 attr594 attr595 attr596 attr597 attr598 attr599
+attr600 attr601 attr602 attr603 attr604 attr605 attr606 attr607 attr608 attr609
+attr610 attr611 attr612 attr613 attr614 attr615 attr616 attr617 attr618 attr619
+attr620 attr621 attr622 attr623 attr624 attr625 attr626 attr627 attr628 attr629
+attr630 attr631 attr632 attr633 attr634 attr635 attr636 attr637 attr638 attr639
+attr640 attr641 attr642 attr643 attr644 attr645 attr646 attr647 attr648 attr649
+attr650 attr651 attr652 attr653 attr654 attr655 attr656 attr657 attr658 attr659
+attr660 attr661 attr662 attr663 attr664 attr665 attr666 attr667 attr668 attr669
+attr670 attr671 attr672 attr673 attr674 attr675 attr676 attr677 attr678 attr679
+attr680 attr681 attr682 attr683 attr684 attr685 attr686 attr687 attr688 attr689
+attr690 attr691 attr692 attr693 attr694 attr695 attr696 attr697 attr698 attr699
+attr700 attr701 attr702 attr703 attr704 attr705 attr706 attr707 attr708 attr709
+attr710 attr711 attr712 attr713 attr714 attr715 attr716 attr717 attr718 attr719
+attr720 attr721 attr722 attr723 attr724 attr725 attr726 attr727 attr728 attr729
+attr730 attr731 attr732 attr733 attr734 attr735 attr736 attr737 attr738 attr739
+attr740 attr741 attr742 attr743 attr744 attr745 attr746 attr747 attr748 attr749
+attr750 attr751 attr752 attr753 attr754 attr755 attr756 attr757 attr758 attr759
+attr760 attr761 attr762 attr763 attr764 attr765 attr766 attr767 attr768 attr769
+attr770 attr771 attr772 attr773 attr774 attr775 attr776 attr777 attr778 attr779
+attr780 attr781 attr782 attr783 attr784 attr785 attr786 attr787 attr788 attr789
+attr790 attr791 attr792 attr793 attr794 attr795 attr796 attr797 attr798 attr799
+attr800 attr801 attr802 attr803 attr804 attr805 attr806 attr807 attr808 attr809
+attr810 attr811 attr812 attr813 attr814 attr815 attr816 attr817 attr818 attr819
+attr820 attr821 attr822 attr823 attr824 attr825 attr826 attr827 attr828 attr829
+attr830 attr831 attr832 attr833 attr834 attr835 attr836 attr837 attr838 attr839
+attr840 attr841 attr842 attr843 attr844 attr845 attr846 attr847 attr848 attr849
+attr850 attr851 attr852 attr853 attr854 attr855 attr856 attr857 attr858 attr859
+attr860 attr861 attr862 attr863 attr864 attr865 attr866 attr867 attr868 attr869
+attr870 attr871 attr872 attr873 attr874 attr875 attr876 attr877 attr878 attr879
+attr880 attr881 attr882 attr883 attr884 attr885 attr886 attr887 attr888 attr889
+attr890 attr891 attr892 attr893 attr894 attr895 attr896 attr897 attr898 attr899
+attr900 attr901 attr902 attr903 attr904 attr905 attr906 attr907 attr908 attr909
+attr910 attr911 attr912 attr913 attr914 attr915 attr916 attr917 attr918 attr919
+attr920 attr921 attr922 attr923 attr924 attr925 attr926 attr927 attr928 attr929
+attr930 attr931 attr932 attr933 attr934 attr935 attr936 attr937 attr938 attr939
+attr940 attr941 attr942 attr943 attr944 attr945 attr946 attr947 attr948 attr949
+attr950 attr951 attr952 attr953 attr954 attr955 attr956 attr957 attr958 attr959
+attr960 attr961 attr962 attr963 attr964 attr965 attr966 attr967 attr968 attr969
+attr970 attr971 attr972 attr973 attr974 attr975 attr976 attr977 attr978 attr979
+attr980 attr981 attr982 attr983 attr984 attr985 attr986 attr987 attr988 attr989
+attr990 attr991 attr992 attr993 attr994 attr995 attr996 attr997 attr998 attr999
+attr1000 attr1001 attr1002 attr1003 attr1004 attr1005 attr1006 attr1007 attr1008 attr1009
+attr1010 attr1011 attr1012 attr1013 attr1014 attr1015 attr1016 attr1017 attr1018 attr1019
+attr1020 attr1021 attr1022 attr1023 attr1024 attr1025 attr1026 attr1027 attr1028 attr1029
+attr1030 attr1031 attr1032 attr1033 attr1034 attr1035 attr1036 attr1037 attr1038 attr1039
+attr1040 attr1041 attr1042 attr1043 attr1044 attr1045 attr1046 attr1047 attr1048 attr1049
+attr1050 attr1051 attr1052 attr1053 attr1054 attr1055 attr1056 attr1057 attr1058 attr1059
+attr1060 attr1061 attr1062 attr1063 attr1064 attr1065 attr1066 attr1067 attr1068 attr1069
+attr1070 attr1071 attr1072 attr1073 attr1074 attr1075 attr1076 attr1077 attr1078 attr1079
+attr1080 attr1081 attr1082 attr1083 attr1084 attr1085 attr1086 attr1087 attr1088 attr1089
+attr1090 attr1091 attr1092 attr1093 attr1094 attr1095 attr1096 attr1097 attr1098 attr1099
+id="crash2"
+>I'm on a boat</span>
+<pre id="test">
+<script>
+span = document.createElement("span");
+try {
+  var i = 0;
+  while(1) {
+    span.setAttribute("attr" + (++i), "foo");
+  }
+}
+catch (ex) {}
+span.id = "crash3";
+document.body.appendChild(span);
+var attrCount = span.attributes.length;
+var spans = document.getElementsByTagName("span");
+for (i = 0; i < spans.length; ++i) {
+  is(spans[i].attributes.length, attrCount, "didn't have maxed out attrs");
+}
+while (spans.length) {
+  spans[0].parentNode.removeChild(spans[0]);
+}
+</script>
+</pre>
+</body>
+</html>