Stops responding when selecting a checkbox on the Netapp admin page inside deeply nested <label>s

VERIFIED FIXED in mozilla8

Status

()

Core
DOM
VERIFIED FIXED
6 years ago
6 years ago

People

(Reporter: jason, Assigned: khuey)

Tracking

({dev-doc-complete, hang, testcase})

Trunk
mozilla8
dev-doc-complete, hang, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments, 6 obsolete attachments)

(Reporter)

Description

6 years ago
User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0) Gecko/20100101 Firefox/4.0
Build Identifier: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0) Gecko/20100101 Firefox/4.0

It seems when selecting checkboxes on the Netapp Admin pages, seems to cause Firefox 4 to go into an infinity loop, where it refuses to respond.  This also occurs in Safemode, and in a new profile in Safe Mode.

In Process Explorer, it seems to run the CPU to 100% (of at least 1 processor), and the memory will climb for a few minutes upto around 300Mb then it will drop by around 100Mb and this will repeat.

Reproducible: Always

Steps to Reproduce:
1. Load Page to Manage Quotas
2. Click on Checkbox
3. Wait for a long time, it doesn't seem to crash or anything.
Actual Results:  
Locks up Firefox

Expected Results:  
It should check the box

I don't think there is anything at the moment.  Though limits the usefulness
(Reporter)

Comment 1

6 years ago
Created attachment 522757 [details]
Mini Dumpfile from Firefox
(Reporter)

Comment 2

6 years ago
I have also seen this in the netapp communities as well
http://communities.netapp.com/thread/13891
Please create a stack trace with Windbg
https://developer.mozilla.org/en/How_to_get_a_stacktrace_with_WinDbg
Does it work in Fx 3.6? Does it work in one of the past Fx4 Betas?
Severity: major → normal
Keywords: stackwanted
Hardware: x86_64 → x86
Version: unspecified → 4.0 Branch
(Reporter)

Comment 5

6 years ago
it did work in 3.6, but I never tried in the Betas if I recall, as I had not required to manage the device in question, while I was using the Betas
(Reporter)

Comment 6

6 years ago
Created attachment 523045 [details]
Stack Dump
(Reporter)

Updated

6 years ago
Hardware: x86 → x86_64
Attachment #523045 - Attachment mime type: application/octet-stream → text/plain
This seems to be the loop:
xul!nsHTMLLabelElement::PostHandleEvent
xul!nsEventTargetChainItem::HandleEventTargetChain
xul!nsEventTargetChainItem::HandleEventTargetChain
xul!nsEventDispatcher::Dispatch
xul!PresShell::HandleDOMEventWithTarget
xul!nsGenericElement::DispatchEvent
xul!nsGenericElement::DispatchClickEvent
xul!nsHTMLLabelElement::PostHandleEvent
xul!nsEventTargetChainItem::HandleEventTargetChain

This will be still difficult without a testcase and I'm really lost if it comes to select a component for this. Can you help here Boris ?
Component: General → General
Keywords: stackwanted → hang
Product: Firefox → Core
QA Contact: general → general
Version: 4.0 Branch → 2.0 Branch
CCing some more folks.

The description doesn't sound like infinite recursion (e.g. no crash).  So what's really going on?

Reporter, are you able to attach the relevant HTML to this bug?
(Reporter)

Comment 9

6 years ago
possibly but it does have to get sanitized heavily, since it deals with production stuff.   You may be able to contact netapp, and ask for their Simulator.
jason, is the concern about making the HTML completely public, or about anyone at all being able to see it?

That is, are you happier sending the HTML to me by private mail, with the promise that I would not be posting it anywhere?

Chris, do we have contacts at netapp?
(Reporter)

Comment 11

6 years ago
it seems that there are a large number of 
<label for="vol-1" /><input name="vol-13" type="hidden" value="V00067" title="vol-13" id="vol-1" />

type lines, at 10 it is very slow, at 20 it stops responding.
(Reporter)

Comment 12

6 years ago
Created attachment 523068 [details]
html causing problems

it has been slightly santized.
(Reporter)

Comment 13

6 years ago
Comment on attachment 523068 [details]
html causing problems

Even locally this still causes problems, and with javascript disabled as well.
(Reporter)

Comment 14

6 years ago
At 20 <label> tags, it stops responding while it's processing, and takes around 5 minutes or more to start responding.

Doing some tests, it looks like the following
13 - 3 seconds
14 - 6 seconds
16 - 10 seconds or so
Ah, so tons of nested labels, and then you click something inside the innermost one.  I see.

In firefox 3.6 the labels do NOT nest.
They do nest in Opera and Webkit, though.

Are we ending up with something silly like activating labels exponentially many times in the depth of nesting?
Status: UNCONFIRMED → NEW
Component: General → DOM
Ever confirmed: true
QA Contact: general → general
Summary: Stops responding when selecting a checkbox on the Netapp admin page → Stops responding when selecting a checkbox on the Netapp admin page inside deeply nested <label>s
Version: 2.0 Branch → Trunk
Oh, http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!DOCTYPE%20html%3E%0A%3Clabel%2F%3E%0A%3Clabel%2F%3E for the testcase for parser behavior.
(Reporter)

Comment 18

6 years ago
Actually even clicking on the first item in the list triggers this.
OS: Windows 7 → All
Hardware: x86_64 → All
Created attachment 524468 [details] [diff] [review]
Patch v1

Actually, label elements ignore click events coming from their descendants but the code doing that go from the target of the event to the label but doesn't check siblings, only parents.

The behavior we have with this patch seems to be the same on Opera. I do not have any webkit browser on this laptop.
Assignee: nobody → mounir.lamouri
Status: NEW → ASSIGNED
Attachment #524468 - Flags: review?(Olli.Pettay)
Whiteboard: [needs review]
Created attachment 524470 [details]
testcase

If someone can give me the results when clicking on the rightest label (with various browsers): it should be 1/6.
It's 1/6 in Safari, Chrome, and Opera over here.
Nice! Thanks for checking :)
Keywords: testcase
Comment on attachment 524468 [details] [diff] [review]
Patch v1

I don't understand why you check only previoussibling and not nextsibling.
Attachment #524468 - Flags: review?(Olli.Pettay) → review-
(In reply to comment #23)
> Comment on attachment 524468 [details] [diff] [review]
> Patch v1
> 
> I don't understand why you check only previoussibling and not nextsibling.

This code tries to prevent sending a click event to the control element if it has been sent to it already. AFAIK, this can't happen if the element is after the target element in tree order. IOW, the method reproduces how the event bubbles and make sure that the control element isn't in the bubbling path.
Created attachment 526976 [details]
testcase2

With or without the patch our behavior when clicking the last checkbox is different than on Opera or Chromium
Though, actually, I didn't check that Opera or Chromium parse the testcase
the same way as gecko.

Comment 27

6 years ago
Setting "html5.parse.enable" to false seems to solve the problem. See bug 579352.
Duplicate of this bug: 579352
(Reporter)

Comment 29

6 years ago
is there any update for when this patch will be included?
The patch got a negative review and it will be not included in any Firefox release. When the next patch gets a positive review it will get checked into the trunk and that's currently FF7.
Duplicate of this bug: 667005
Mounir, what is the status here?
Duplicate of this bug: 668534
I investigated this a bit.  The behaviors in various browsers are:

 Engine |  A bubbling click can trigger  |  A label-generated click can
        |  multiple <labels>             |  trigger additional labels
--------+--------------------------------+----------------------------------------
 Gecko  |           Yes                  |              Yes
--------+--------------------------------+----------------------------------------
 Webkit |                                |
 / IE   |           No                   |              No
--------+--------------------------------+----------------------------------------
 Opera  |           No                   |              Yes

Note that Opera and Webkit agree on Mounir's testcase if you click on the checkbox, but disagree if you click on the text, because of their differences here.
Whiteboard: [needs review]
In fact, no other browser propagates a click event beyond the first label it encounters.
So the spec doesn't really say what to do here.

"The label element's exact default presentation and behavior, in particular what its activation behavior might be, if anything, should match the platform's label behavior."

As far as I know, platforms don't really have the concept of "bubbling" events ...
Olli says we should copy the WebKit/IE behavior here.
Assignee: mounir → khuey
(In reply to comment #37)
> Olli says we should copy the WebKit/IE behavior here.

except that we're going to let the original click continue to bubble.
Created attachment 546668 [details] [diff] [review]
First half

This is the first half.  This patch stops a bubbling click from triggering multiple <label>s.  This is enough to fix the hang.
Attachment #522757 - Attachment is obsolete: true
Attachment #523045 - Attachment is obsolete: true
Attachment #523068 - Attachment is obsolete: true
Attachment #524468 - Attachment is obsolete: true
Attachment #524470 - Attachment is obsolete: true
Attachment #526976 - Attachment is obsolete: true
Attachment #546668 - Flags: review?(Olli.Pettay)
Created attachment 546683 [details] [diff] [review]
Second half

Propagate the "I've trigger a label" flag to the synthetic click event.

I'm going to throw this whole thing at try to see if anything depends on our existing behavior.
Attachment #546683 - Flags: review?(Olli.Pettay)
After applying these two patches we should behave like WebKit and IE except that we will allow the original click event to continue to bubble.

Comment 42

6 years ago
Try run for e094d7112f16 is complete.
Detailed breakdown of the results available here:
    http://tbpl.mozilla.org/?tree=Try&rev=e094d7112f16
Results:
    success: 146
    warnings: 15
    failure: 2
Total buildrequests: 163

Updated

6 years ago
Attachment #546668 - Flags: review?(Olli.Pettay) → review+

Updated

6 years ago
Attachment #546683 - Flags: review?(Olli.Pettay) → review+
http://hg.mozilla.org/mozilla-central/rev/09b2569edec2

The behaviors that I describe in the commit message are worth documenting on MDC, I think.
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Flags: in-testsuite+
Keywords: dev-doc-needed
Resolution: --- → FIXED
Target Milestone: --- → mozilla8

Comment 44

6 years ago
Pressing my luck here, but any chance this could land in Aurora (Fx7) as well? :)

Updated

6 years ago
Depends on: 673859
(In reply to comment #44)
> Pressing my luck here, but any chance this could land in Aurora (Fx7) as
> well? :)

Don't think so, sorry :-(
If you wanted to verify that this is fixed on Nightlies, that would be awesome :-)

Comment 47

6 years ago
The NetApp FilerView hang is indeed fixed in the 7/25 nightly build. :) :) :)
Status: RESOLVED → VERIFIED
Kyle,

Just a note of thanks from both myself and Jake, for working on this, pushing this to the right component and getting it looked at, testing, working on patches etc.

Thanks again!
https://developer.mozilla.org/en/HTML/Element/label#Notes
https://developer.mozilla.org/en/Firefox_8_for_developers#HTML
Keywords: dev-doc-needed → dev-doc-complete
You need to log in before you can comment on or make changes to this bug.