Greg Merideth

A while ago I was testing a quick tag parser to determine how many HTML tags were present in pages (the things we programmers do from time to time.) I then, to count the offset, made a quick page with mismatched (malformed) HTML tables.

The result would bring Internet Explorer 5 to its knees consuming 100% of available CPU resources and start a slow and stead ramp of memory consumption. I contacted several sources at Microsoft (via posts to MSDN forums) and found a very friendly and knowledgeable tech at Microsoft who examined the HTML, concurred that it was a fault in an HTML rendering DLL and would be resolved on the next patch release.

I never gave it much thought till I ran into the HTML file a while ago and decided to see what Chrome did with it. Well, sure enough, while Chrome, Firefox and Opera all render the pages (albeit completely different from each other) Internet Explorer still crashes. Now, IE (on a dual core machine) will consume 50% of the CPU and hang in the file ietutil.dll(Ordinal405+0x1e). Exploring the process (using process explorer) reveals roughly fifteen calls hanging in msls31.dll!LsQueryLineCpPpoint+0xb0e and some 50+ calls hanging in mshtml.dll!DllGetClassObject+0xa0398.

To this day I have no idea why IE crashes on pure HTML. There is no JavaScript trickery, no ActiveX modifications, no Flash buffer overrun, nothing save pure HTML bringing down IE.

I had considered adding it to every single webpage so anyone using IE would quickly get sick of it and start using another browser but that would be too easy.

So I present the IECRASH.HTML file to you to view. In any browser but IE it will look like a gibberish of malformed tables (squares in Firefox, a nice pyramid in Chrome and a rather well calculated attempt to show the tables in Opera.)

Viewing the file in IE will crash you, you have been amply warned.

Here is the mismatch count breakdown:

Table Starts : 164
Table Ends : 180
Table Row Start : 344
Table Row End : 0
Table Data Start : 164
Table Data End : 180

You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.