MDL-36011 added some unusual code where it produces empty rows until the number of rows in the table is equal to the desired page size which can be seen here.

In certain situations, the user can make the page size any number they want. For example one million. This can result in a ridiculous amount of markup being generated for no good reason and can bring down the webserver.

To see this:

1. Create a course with a quiz with a single question and enrol a student
2. As the student, attempt the quiz
3. As the admin browse to the quiz and press the "Results" tab
4. Under "Display options" set "Page size" to 1000000
5. Press "Show report"
6. Boom

The page will take forever to load, and using the network inspector you will see that a ridiculous amount of data is being transferred for a table that has only one meaningful row.

This exact thing happened to us when an academic accidentally pasted a student number in to that field.

There are two issues here:

1. It should not be possible to put such a huge number in that field, instead it should probably be a dropdown with sensible values like 25, 50, 100
2. The finish_html method shouldn't produce empty rows

For 2, MDL-36011 seems to indicate it was done because when the headers are printed, it's not known how many total rows of data there will be. So to make the number of rows known at the time headers are printed, it was decided to just print as many rows as the specified page size. I guess what is being referred to in MDL-36011 is this part where the show/hide link needs to specify what it is controlling (the rows in this case).