646157 - Stops responding when selecting a checkbox on the Netapp admin page inside deeply nested <label>s

Status: VERIFIED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[jason]

User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0) Gecko/20100101 Firefox/4.0

It seems when selecting checkboxes on the Netapp Admin pages, seems to cause Firefox 4 to go into an infinity loop, where it refuses to respond.  This also occurs in Safemode, and in a new profile in Safe Mode.

In Process Explorer, it seems to run the CPU to 100% (of at least 1 processor), and the memory will climb for a few minutes upto around 300Mb then it will drop by around 100Mb and this will repeat.

Reproducible: Always

Steps to Reproduce:
1. Load Page to Manage Quotas
2. Click on Checkbox
3. Wait for a long time, it doesn't seem to crash or anything.
Actual Results:  
Locks up Firefox

Expected Results:  
It should check the box

I don't think there is anything at the moment.  Though limits the usefulness

Comment 1

[jason]

Attachment: Mini Dumpfile from Firefox

Comment 2

[jason]

I have also seen this in the netapp communities as well
http://communities.netapp.com/thread/13891

Comment 3

[Matthias Versen [:Matti]]

Please create a stack trace with Windbg
https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg

Comment 4

[(mostly gone) XtC4UaLL [:xtc4uall]]

Does it work in Fx 3.6? Does it work in one of the past Fx4 Betas?

Comment 5

[jason]

it did work in 3.6, but I never tried in the Betas if I recall, as I had not required to manage the device in question, while I was using the Betas

Comment 6

[jason]

Attachment: Stack Dump

Comment 7

[Matthias Versen [:Matti]]

This seems to be the loop:
xul!nsHTMLLabelElement::PostHandleEvent
xul!nsEventTargetChainItem::HandleEventTargetChain
xul!nsEventTargetChainItem::HandleEventTargetChain
xul!nsEventDispatcher::Dispatch
xul!PresShell::HandleDOMEventWithTarget
xul!nsGenericElement::DispatchEvent
xul!nsGenericElement::DispatchClickEvent
xul!nsHTMLLabelElement::PostHandleEvent
xul!nsEventTargetChainItem::HandleEventTargetChain

This will be still difficult without a testcase and I'm really lost if it comes to select a component for this. Can you help here Boris ?

Comment 8

[Boris Zbarsky [:bzbarsky]]

CCing some more folks.

The description doesn't sound like infinite recursion (e.g. no crash).  So what's really going on?

Reporter, are you able to attach the relevant HTML to this bug?

Comment 9

[jason]

possibly but it does have to get sanitized heavily, since it deals with production stuff.   You may be able to contact netapp, and ask for their Simulator.

Comment 10

[Boris Zbarsky [:bzbarsky]]

jason, is the concern about making the HTML completely public, or about anyone at all being able to see it?

That is, are you happier sending the HTML to me by private mail, with the promise that I would not be posting it anywhere?

Chris, do we have contacts at netapp?

Comment 11

[jason]

it seems that there are a large number of 
<label for="vol-1" /><input name="vol-13" type="hidden" value="V00067" title="vol-13" id="vol-1" />

type lines, at 10 it is very slow, at 20 it stops responding.

Comment 12

[jason]

Attachment: html causing problems

it has been slightly santized.

Comment 13

[jason]

Comment on attachment 523068 [details]
html causing problems

Even locally this still causes problems, and with javascript disabled as well.

Comment 14

[jason]

At 20 <label> tags, it stops responding while it's processing, and takes around 5 minutes or more to start responding.

Doing some tests, it looks like the following
13 - 3 seconds
14 - 6 seconds
16 - 10 seconds or so

Comment 15

[Boris Zbarsky [:bzbarsky]]

Ah, so tons of nested labels, and then you click something inside the innermost one.  I see.

In firefox 3.6 the labels do NOT nest.

Comment 16

[Boris Zbarsky [:bzbarsky]]

They do nest in Opera and Webkit, though.

Are we ending up with something silly like activating labels exponentially many times in the depth of nesting?

Comment 17

[Boris Zbarsky [:bzbarsky]]

Oh, http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!DOCTYPE%20html%3E%0A%3Clabel%2F%3E%0A%3Clabel%2F%3E for the testcase for parser behavior.

Comment 18

[jason]

Actually even clicking on the first item in the list triggers this.

Comment 19

[Mounir Lamouri (:mounir)]

Attachment: Patch v1

Actually, label elements ignore click events coming from their descendants but the code doing that go from the target of the event to the label but doesn't check siblings, only parents.

The behavior we have with this patch seems to be the same on Opera. I do not have any webkit browser on this laptop.

Comment 20

[Mounir Lamouri (:mounir)]

Attachment: testcase

If someone can give me the results when clicking on the rightest label (with various browsers): it should be 1/6.

Comment 21

[Boris Zbarsky [:bzbarsky]]

It's 1/6 in Safari, Chrome, and Opera over here.

Comment 22

[Mounir Lamouri (:mounir)]

Nice! Thanks for checking :)

Comment 23

[Olli Pettay [:smaug][[e-mail]]]

Comment on attachment 524468 [details] [diff] [review]
Patch v1

I don't understand why you check only previoussibling and not nextsibling.

Comment 24

[Mounir Lamouri (:mounir)]

(In reply to comment #23)
> Comment on attachment 524468 [details] [diff] [review]
> Patch v1
> 
> I don't understand why you check only previoussibling and not nextsibling.

This code tries to prevent sending a click event to the control element if it has been sent to it already. AFAIK, this can't happen if the element is after the target element in tree order. IOW, the method reproduces how the event bubbles and make sure that the control element isn't in the bubbling path.

Comment 25

[Olli Pettay [:smaug][[e-mail]]]

Attachment: testcase2

With or without the patch our behavior when clicking the last checkbox is different than on Opera or Chromium

Comment 26

[Olli Pettay [:smaug][[e-mail]]]

Though, actually, I didn't check that Opera or Chromium parse the testcase
the same way as gecko.

Comment 27

[Luis]

Setting "html5.parse.enable" to false seems to solve the problem. See bug 579352.

Comment 29

[jason]

is there any update for when this patch will be included?

Comment 30

[Matthias Versen [:Matti]]

The patch got a negative review and it will be not included in any Firefox release. When the next patch gets a positive review it will get checked into the trunk and that's currently FF7.

Comment 32

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Mounir, what is the status here?

Comment 34

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

I investigated this a bit.  The behaviors in various browsers are:

 Engine |  A bubbling click can trigger  |  A label-generated click can
        |  multiple <labels>             |  trigger additional labels
--------+--------------------------------+----------------------------------------
 Gecko  |           Yes                  |              Yes
--------+--------------------------------+----------------------------------------
 Webkit |                                |
 / IE   |           No                   |              No
--------+--------------------------------+----------------------------------------
 Opera  |           No                   |              Yes

Note that Opera and Webkit agree on Mounir's testcase if you click on the checkbox, but disagree if you click on the text, because of their differences here.

Comment 35

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

In fact, no other browser propagates a click event beyond the first label it encounters.

Comment 36

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

So the spec doesn't really say what to do here.

"The label element's exact default presentation and behavior, in particular what its activation behavior might be, if anything, should match the platform's label behavior."

As far as I know, platforms don't really have the concept of "bubbling" events ...

Comment 37

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Olli says we should copy the WebKit/IE behavior here.

Comment 38

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to comment #37)
> Olli says we should copy the WebKit/IE behavior here.

except that we're going to let the original click continue to bubble.

Comment 39

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Attachment: First half

This is the first half.  This patch stops a bubbling click from triggering multiple <label>s.  This is enough to fix the hang.

Comment 40

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

Attachment: Second half

Propagate the "I've trigger a label" flag to the synthetic click event.

I'm going to throw this whole thing at try to see if anything depends on our existing behavior.

Comment 41

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

After applying these two patches we should behave like WebKit and IE except that we will allow the original click event to continue to bubble.

Comment 42

[Mozilla RelEng Bot]

Try run for e094d7112f16 is complete.
Detailed breakdown of the results available here:
    http://tbpl.mozilla.org/?tree=Try&rev=e094d7112f16
Results:
    success: 146
    warnings: 15
    failure: 2
Total buildrequests: 163

Comment 43

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

http://hg.mozilla.org/mozilla-central/rev/09b2569edec2

The behaviors that I describe in the commit message are worth documenting on MDC, I think.

Comment 44

[Jake Maul [:jakem]]

Pressing my luck here, but any chance this could land in Aurora (Fx7) as well? :)

Comment 45

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

(In reply to comment #44)
> Pressing my luck here, but any chance this could land in Aurora (Fx7) as
> well? :)

Don't think so, sorry :-(

Comment 46

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

If you wanted to verify that this is fixed on Nightlies, that would be awesome :-)

Comment 47

[Jake Maul [:jakem]]

The NetApp FilerView hang is indeed fixed in the 7/25 nightly build. :) :) :)

Comment 48

[Shyam Mani [:fox2mike]]

Kyle,

Just a note of thanks from both myself and Jake, for working on this, pushing this to the right component and getting it looked at, testing, working on patches etc.

Thanks again!

Comment 49

[Florian Scholz (Open Web Docs)]

https://developer.mozilla.org/en/HTML/Element/label#Notes
https://developer.mozilla.org/en/Firefox_8_for_developers#HTML