Slashdot Mirror


DHTML Bug Found in Mozilla 1.2

joyoflinux writes "The people at Mozilla have announced that Mozilla 1.2 contained a bug that caused sites that use DHTML to fail (more on the front page). They have pulled 1.2 from the releases page, pending a 1.2.1 release."

26 of 351 comments (clear)

  1. Interesting by fucksl4shd0t · · Score: 5, Insightful
    Interesting that every couple of months when Mozilla has a bug or exploit or something people talk all kinds of trash, but forget about other competitors (IE) that have new exploits almost daily.

    All in all, bug for bug, line by line, even accounting for the massive differences in complexity (mozilla is by far a more complex project that IE ever wanted to be), I'd have to say that Mozilla has less show-stopping bugs and fewer exploits than IE.

    --
    Like what I said? You might like my music
    1. Re:Interesting by whereiswaldo · · Score: 5, Interesting

      I'd have to say that Mozilla has less show-stopping bugs and fewer exploits than IE.

      Until I hear different, that's my impression, too. But personally, I think the Phoenix project based on Mozilla has a lot of promise. It is a blazingly fast browser and is quick to startup, too. Amazing!

      At least this bug today wasn't a security-related bug, like *cough* IE *cough* Outlook *cough* windows *cough* *cough* *cough* *cough* *cough* goddamn! *cough* *cough* Microsoft
      feck
      *cough* *cough* *cough* must... hit.. submit...

    2. Re:Interesting by whereiswaldo · · Score: 5, Informative

      No need. Every piece of software known to man has at least one security flaw. The differenced I see are the frequency of flaws found and timeliness of updates. Microsoft loses there. Ask the analysts if you don't believe me. (eg.)

      But I'll just let you read this article.

      Open your eyes, man.

    3. Re:Interesting by whereiswaldo · · Score: 5, Insightful

      OK, maybe you're right about the fact that MSIE has more security flaws than other browsers. That's also because more people are using it and more people found bugs.

      I see your point, but it's not exactly that simple. A good example I can point out is the Apache webserver. It got hit hard with the Code Red virus just like IIS did. Only it wasn't susceptible like IIS was.

      Still, Mozilla and Netscape will never be first class browser with large user base.

      How can you say that? Linux stared out as a tiny OS which only supported IDE hard drives. Now look at it. OSS projects can mature at a rapid pace, especially those which are fueled by many people. How many people work on IE? How many on Mozilla? Is there much of a difference? (I don't know)

      Don't even think about commercializing Mozilla when it can't open certain DHTML sites.

      FYI: AOL's Netscape is based on Mozilla. I'd say it's been commercialized. Don't worry, the bug will be fixed shortly, most likely.

      Progressive JPEG rendering

      That's a minor bug, IMO.

      Keep tabs on mozilla.org in the next week and see how things happen.

    4. Re:Interesting by marauder404 · · Score: 5, Interesting

      I missed that day on Slashdot, but I just read that BBC piece, and that article doesn't support your argument. Your argument is that IE has more security flaws than other browsers. While that may or may not be true, the BBC article simply states that IE should be avoided because it's the most targeted: "The easiest way to avoid parasite programs, he says, is to stop using Internet Explorer because it is targeted by many of the adware and spyware companies." This advice is akin to saying that one shouldn't buy a Honda because they are targeted by thieves -- it's not saying that Hondas are easier to steal than other cars. Likewise, the article doesn't say that IE is more vulnerable than other browsers but merely that it's more targeted. IE is definitely more vulnerable than other browsers, but the article doesn't argue it for you.

      Neither does that other article. I actually read the whole whitepaper and the article isn't about how Unix is better than Windows (in fact, right in the abstract of the paper, it says that Windows provides much better throughput and slightly better performance than Unix!). Rather, it describes the process by which Hotmail was migrated from Unix to Windows. There are advantages and disadvantages to both platforms and it discusses them well. It describes in good detail how it went about converting the platform and the challenges as they were presented and resolved. It criticizes Windows where appropriate, but it doesn't say that Unix is the better OS as the Slashdot headline and blurb suggest.

      I was ok with your post up until you referencing the other articles because they make no sense.

    5. Re:Interesting by asa · · Score: 5, Informative

      " Interesting that every couple of months when Mozilla has a bug or exploit or something"

      This isn't an exploit or even a crash or dataloss bug. This is just a visual glitch that you'll get on some pages with DHTML. The release hasn't really been pulled and is still available at ftp but we'd rather spare our users a large download that would probably be repeated in a couple of days when the 1.2.1 release out so the high-visibility links were commented out for the time being.

      --Asa

    6. Re:Interesting by asa · · Score: 5, Informative

      Don't even think about commercializing Mozilla when it can't open certain DHTML sites. I've tried 1.2.1 (just now) on both Windows and my Debian.

      Actually, if you're thinking about commercializing Mozilla then our milestone model is probably just the thing you're looking for.

      We push nightly builds to thousands of testers every day, hundreds of thousands of users test and thousands of users report problems against Alpha and Beta Milesotne releases and then we ship a final milestone to even more users/testers.

      In some cases a new problem is discovered in that Final Milestone a fix is landed on the milestone branch. Someone interested in commercializing Mozilla has a well tested and well patched code branch from which to build a commercial product.

      That this bug was discovered in Mozilla is precisely the reason that organizations would want to use Mozilla technologies in commercial products. We keep making it better and when we move on to the next release cycle any commercial (or non-commercial) organization is free to pull the code, listen to Mozilla Milestone feedback and bug reports and continue making it better themselves.

      The alternative is doing all this development and testing work yourself or relying on closed source code where you can't continue making it better yourselves if you do find something wrong. If I was building a commercial app that required HTML rendering then I'd definitely investigate using one of the Mozilla code branches for my products.

      --Asa

  2. Re:lalaa by IamNotWitchboy · · Score: 5, Informative

    from the mozilla FAQ: "Mozilla 1.0 is a fully functional technology demo for those interested in seeing what can be done with Mozilla technology, and those who want to create Mozilla-based products and packages. The intended target audience is the development community. " so, it's not really a product. but a great 'demo' imho. if you want to use the 'commercial' suite, use netscape.

    --
    The best cure for insomnia is realizing that it is already time to get up. EsteEncanto.com - Blog on technology, urban
  3. What?!?! by trotski · · Score: 5, Insightful

    A bug in mozilla??? No way, you've got to be jokeing!!!

    Seriously though, although Mozilla has it's faults, (this being a prime example). It is still the cutting edge of browser technology. I mean, theres one feature that wins over every person I've recommended Mozilla to: the ability to stop pop ups from apearing. ALthough Mozilla is still rough around the edges, it is still my browser of choice.

    --

    "Entropy is the bad-guy, and he is everywhere"
  4. Mozilla Bugs... by trotski · · Score: 5, Insightful

    Finding Bugs like this is proof that Mozilla is well on the way to becoming the world's best browser. With open source and lots of people contributing, bugs are found and elliminated quickly.

    Microsoft IE on the other hand, bugs take time to find and even more time to repair due to the slow reaction of a large organization. This is probably why we hear so much about Mozilla bugs, they're far easier to uncover than bugs in IE or other browser.

    PErsonally, I think Mozilla users should concider this a Good Thing, it means that your browser of choice is getting better!

    --

    "Entropy is the bad-guy, and he is everywhere"
  5. bugzilla link by J.+Random+Software · · Score: 5, Informative
    I'm guessing it's bug 182500 (or at least the bugs referred to there). Something about document.write() dropping leading characters.

    IMHO documents that completely rely on ECMAScript are inherently broken anyway.

  6. but HOW? by FuegoFuerte · · Score: 5, Insightful

    What I'd like to know (and this is NOT meant as a flame any way, I love mozilla), is HOW exactly do big bugs like this get into final releases? I mean, the 1.2 release was more than a month behind what was scheduled on the roadmap, and yet it still ends up with this in it? Is it just the number of people who don't bother with nightlies or reporting bugs? I would think there would be enough people using the nightlies to find fairly significant bugs like this. Perhaps the fine mozilla people need to add a "gamma" release after "alpha" and "beta" but before "final"? Have the gamma and final be seperated by one week, and ONLY incorporate bugfixes which don't affect major parts of the code? I don't quite know what the answer is, but it seems something should be done. All in all though, great browser.

    1. Re:but HOW? by caillon · · Score: 5, Interesting

      Long story short, a patch got checked in on the trunk before we branched, it caused problems, we noticed it and asked that it got backed out on both the trunk and the 1.2 branch. It got backed out OK on the trunk, but somehow it didn't get fully backed out on the branch...

      From the bug: "It looks like the 1.2-branch backout was done incorrectly. The 9 was not changed to an 8."

    2. Re:but HOW? by caillon · · Score: 5, Informative
      No. The patch was a 1 liner. patch -R would have either reverted it completely or not at all. I would imagine that the file in question was hand edited. The eHTMLTag_userdefined portion was removed but the 9 was not changed back to an 8.

      FWIW, the patch was:

      RCS file: /cvsroot/mozilla/htmlparser/src/nsElementTable.cpp ,v
      retrieving revision 3.140
      diff -r3.140 nsElementTable.cpp
      102c102
      < TagList gHeadKids={8,{eHTMLTag_base,eHTMLTag_bgsound,eHTML Tag_link,eHTMLTag_meta,eHTMLTag_script,eHTMLTag_st yle,eHTMLTag_title,eHTMLTag_noembed}};
      ---
      > TagList gHeadKids={9,{eHTMLTag_base,eHTMLTag_bgsound,eHTML Tag_link,eHTMLTag_meta,eHTMLTag_script,eHTMLTag_st yle,eHTMLTag_title,eHTMLTag_noembed,eHTMLTag_userd efined}};
  7. Re:Talk about spin and hyposcrisy. by IamNotWitchboy · · Score: 5, Insightful
    it's not really the presence or absence of bugs in the software. We all know that every softwarehas bugs.

    it's rather the way these bugs are treated and fixed. With a MS product, some bugs are not acknowledged until they have a fix, sometime months after the first discovery.

    with an open source model, bugs are public and are generally much quicker to be patched.

    --
    The best cure for insomnia is realizing that it is already time to get up. EsteEncanto.com - Blog on technology, urban
  8. arrrrggghhhh by vsync64 · · Score: 5, Informative
    This really isn't fair. From the end of my most recent log entry:

    I'm extremely upset. 8 hours ago I downloaded Mozilla 1.2b for Win32 for Joie's parents' computer. It looks like they released 1.2 while I was downloading 1.2b. This isn't the first time a fresh download of mine has been obsoleted, but never this quickly.

    So today I downloaded 1.2. This is quite upsetting.

    Anyway, in order to save Bugzilla the crush, I'm pasting the bug report (#182500) here. It seems that the main issues are broken user-defined XML tags, broken document.write(), and checkins to the 1.2 branch missing in the release.

    This is a meta-bug whose dependencies will be problems caused by the incorrect backout described in bug 167493 comment 21. Some of these bugs have been reported as Windows-only, but I've also been able to reproduce them on a gcc 3.2.1 Linux build with -O2.

    ------- Additional Comment #1 From David Baron 2002-11-28 07:38 -------
    I've corrected the backout on the 1.2 branch (although I admit I only tested the change on the trunk, but I did the backout by backing out the backout with cvs up -j -j and then backing out the original checkin the same way). It remains to be seen what (if anything) we'll do with the 1.2 release.

    ------- Additional Comment #2 From Malcolm Rowe 2002-11-28 08:26 -------
    We may have to do something with the 1.2 branch anyway. Some of the checkins to the 1.2 branch disappeared from the 1.2 release - see bug 182506.

    ------- Additional Comment #3 From David Baron 2002-11-28 09:07 -------
    I think I've gone through all the Browser bugs filed between the 1.2 release and now (mostly by just skimming bug summaries), and added all the relevant dependencies. However, bug 182317 and bug 182433 are probably also dependencies of this bug, but I didn't add them since I'm not sure.

    ------- Additional Comment #4 From Phil Schwartau 2002-11-28 13:21 -------
    Note I've added this bug as a dependency:

    bug 182253, "document.write() eats initial characters in 1.2"

    It explains why so many sites with DHTML menus are being hit by the current bug. The sites are using document.write() to create them -

    ------- Additional Comment #5 From Dawn Endico 2002-11-29 16:50 -------
    I removed links to 1.2 from the releases page and the home page, and announced the release of 1.2.1 when we have a correct tag and new builds. Since this happened on a 4 day holiday weekend the new release may not happen till Monday.

    ------- Additional Comment #6 From Bryan 2002-11-29 17:28 -------
    Hi,
    Yes I did see it happen in that relase but somebody beated me to the punch. Are you giong to remove it form the ftp://ftp.mozilla.org/pub/mozilla/realses page or you going to keep it there for people to download and test this problem. IF you can e-mail me wiht that info that will be great I will like to see still on there for the people who want to take risks like me.

    ------- Additional Comment #7 From Asa Dotzler 2002-11-29 20:10 -------
    We're not talking about a security exploit or even major dataloss here. I see no need to re-write history. The 1.2 release will stay where it is.

    This bug is likely to see some traffic. I'm taking this oportunity to ask all of you folks that read about this bug at mozillazine or slashdot or wherever to not comment. Unless you're actually working on this problem your comments will only get in the way. Thanks.

    [Emphasis mine.]
    --
    TO BUY A NEW CAR WOULD MAKE YOU SEXUALLY ATTRACTIVE.
  9. Re:Oh, the OSS zealots would say this is a "featur by Spy+Hunter · · Score: 5, Insightful
    If this were an IE bug, you'd never hear the end of it.

    No, if this were an IE bug, sites would have been designed around it in the first place and no one would ever notice except for the web designers.

    --
    main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
  10. Re:Talk about spin and hyposcrisy. by nagora · · Score: 5, Informative
    It would be better for us, I think, if we just handled the bugs better than MS

    Pulling the release is handling the bugs better than MS!

    TWW

    --
    "Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
  11. Great browser for half the Internet by melonman · · Score: 5, Interesting

    proof that Mozilla is well on the way to becoming the world's best browser

    The points about spin have already been covered, so can I ask how many banking sites you have tried to use recently?

    Just spent half an hour trying (unsuccessfully) to persuade Mozilla not to reduce all the pages on a French government site to 4 point text (why would this be a feature for anyone unless your name is Stuart Little?).

    Most of my regular customers have learned how to do ctrl-alt-esc just to kill zombie Mozilla windows. The Mozilla-on-remote-X bug is so longstanding that there is now a lobbying campaign to get it fixed...

    So, yes, it's a great bit of software, but it would be more useful if it worked with more than half of the Internet, or if it worked over a network.

    --
    Virtually serving coffee
  12. Composer & scripting issues. by Anonymous Coward · · Score: 5, Insightful

    As Mozilla issues go, this has got to be one of the more annoying ones, but apparently nobody wants to actively work on it. "Composer" is actually not a bad WYSIWYG html editor at all - it has alot of potential. But as long as it strips / corrupts PHP and other scripting code, it will never be very useful to anyone doing anything beyond the most trivial of web pages.

    The Mozilla-dev folks need to wake up and realize that just about any web designer these days is using some degree of scripting.. Composer needs to at the very least ignore (and not corrupt) scripting blocks. Composer is quite an excellent html editor generally, but as long as it continues to act brain-damaged in regards to any unknown blocks it encounters, it is not going to be truly useful for anybody other than your Great Aunt Emma working on her Geocities homepage.

    Right now, if you need PHP and still want to do your page design in Composer, you have only two options: (1) Every time you tweak the page in Composer, insert all your PHP by hand, or (2) Put your own "#PHPBlock1" tags in the html and have a script replace it with the neccessary PHP code later. Having to do either is annoying. Composer simply shouldn't mangle PHP blocks at all.

    I'm pretty sure there's another outstanding bug regarding the fact that Composer cannot save 'fragments' - if you're merely designing a table or template to be generated via PHP, there is no way to have Mozilla save it as a fragment, without header tags etc. A bit of a nitpick, but really, how much effort would it take to code in a "Save as fragment" option?

    Mozilla is quite an impressive accomplishment for open source, I really do think Mozilla smokes IE hands down these days.. but these Composer bugs should have been fixed long ago - not enough people care about this aspect of Mozilla. A little bit of work here could go a long ways towards undercutting commercial HTML editors in a big way.

  13. Mozilla 1.2 - The Release that Shouldn't Have Been by cedars · · Score: 5, Interesting

    To follow links in this message you will need to copy and then paste them in the HTML bar since Bugzilla won't let /.ers through directly.

    Usually I'm delighted to hear when Mozilla releases a new browser as, up until recently, Mozilla was my browser of choice. But when I heard about the Mozilla 1.2 release I was just disappointed.

    The Mozilla team had been alerted to major bugs which only recently appeared in the browser like this one and some of these (the latter link also has the comment in which a few poeple suggest Mozilla 1.2 should be unreleased) and yet still the team proceeded with this release. I'm not pretending that it's everyone's experience, but certainly as far as my own experience, Mozilla 1.2 is the first Mozilla browser to step further backwards than forwards - and I know I'm not the only one who thinks that. IMHO, it's a shame that such a great browser which was really beginning to show its potential had to make such a disappointing release. And for all that, I have to wonder what were the critical changes that led to all the aforementioned bugs (the implementation of type ahead searching!?!).

    It's too late for me, I've stopped using Mozilla on my Mac (still using the Gecko-based Chimera though) and have halted upgrades of it on my PC, so I guess all there is to say is better luck next time and hopefully we'll be fortunate enough to never see a release as bad as this one ever again.

  14. https/cookie problems by hughk · · Score: 5, Interesting
    Mozilla's most serious bug is a show stopper for eCommerce and that is it sometimes refuses to allow access to cookies under https.

    An important reason to use Mozilla is security. An important concern for anyone trying eCommerce on the web is security. eCommerce web sites often use cookies and they should use https.

    The bug is reported in Bugzilla but it appears that some people can circumvent this with script preferences. Regrettably I can't. See also the slashdot thread from the original 1.2 announcement here.

    I have kept my 1.1 installation under Linux and still have IE under Win 2K.

    --
    See my journal, I write things there
  15. Why this bug is considered "serious" by caillon · · Score: 5, Insightful
    I'm surprised that: A) this is considered a serious bug--who actually uses DHTML? and B) they're "recalling" the release, as it were. Tainted Mozilla meat.

    Is it not enough reason that this is a bug? We should stop release for all bugs! But seriously....

    A big reason is that DHTML is pretty much just a way of saying the W3C DOM and a few DOM Level 0 (no spec) APIs. This bug effectively cripples our standards support and I would definitely call that serious.

    On top of that, with every release, there is a chance that some embeddor will want to base their product off of it. Embeddors generally like DHTML, and this would be a show stopper for them.

  16. Re:Mozilla 1.2 - The Release that Shouldn't Have B by caillon · · Score: 5, Insightful

    "The Mozilla team had been alerted to major bugs which only recently appeared in the browser"

    Sorry. Just because you filed a bug and posted a comment on another does not mean the Mozilla team was alerted. If there is a showstopper bug, filing it in Bugzilla does not guarantee it will get noticed if everyone is busy with final preparations for a release, and trying to get ready for the impending alpha. Don't forget that the people involved with Mozilla get tons of email from bugs, review requests, etc. as well as have real lives in which they eat turkey and go Christmas shopping. Bugs sometimes slip through the cracks. Hop on to IRC next time and make sure that one of the drivers, or even a developer or QA person knows about your bug if you think it is an absolute showstopper.

    It definitely sucks that this bug was in a release. But things happen. Hopefully it won't again.

  17. Mozilla as AOL/TW corporate initiative...? by nazgul000 · · Score: 5, Insightful

    Caveat: I use Mozilla as my primary browser. That said, I'd like to make this observation:

    It seems to me that we spend a lot of time on Slashdot talking about Mozilla as a premiere project of the open source community. However, my impression is that Mozilla is largely still an internal project of Netscape (and by extension of AOL Time Warner). This impression is based on, among other things, the very large number of @netscape.com email addresses that pervade Bugzilla, the mozilla.org web site, etc. I can't believe that Netscape's engineers restrict themselves to working solely on their release branch of the Mozilla codebase during working hours.

    I don't think it at all diminishes the magnitude of the Mozilla project's achievement to say that it has made progress largely under the aegis of AOL/TW. But we should at least be honest that Mozilla is furthering the agenda of a very large corporation that is just as rapacious and profit-motivated as Microsoft.

    Anyone have any hard data about the investment that AOL has made in Mozilla development?

  18. Re:OSS Bug Jumping vs Commercial by Alomex · · Score: 5, Insightful

    but we don't go party, if there is a bug announced and say "ha ha, you aren't any better than we".

    Hello? For years when IE was still in its infancy, every bug was celebrated and shown as "proof of incompetency" on Microsoft's part.

    Even now every time a severe bug is found in Microsoft /.ers celebrate like a bunch of immature teenagers, fogetting that OSS is not going to succeed because how bad the competition is, but because how good a given OSS is.