682103 - Select Option Bad Attribute Data Crashes Firefox

Status: RESOLVED DUPLICATE of bug 656589

(Core :: Graphics, defect)

Description

[Stephen Sagers]

Attachment: sample HTML file

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0) Gecko/20100101 Firefox/6.0
Build ID: 20110811165603

Steps to reproduce:

I was developing a page with a select dropdown that had a PHP notice resulting in a stack trace being output into a select option's attribute.  When I clicked on the dropdown, Firefox crashed.  I have attached a sample file that reproduces the issue.

I have tested this in stable (FF6) and nightly current as of today (2011-08-25).


Actual results:

Firefox crashes hard.


Expected results:

Firefox should be able to handle it gracefully enough to not crash the browser.  Chrome and IE do not crash (though naturally the page may not work as intended).

Comment 1

[Stephen Sagers]

PS:  The extension of the attached sample file is php, but it really doesn't have php in it, just change the extension to html.

Comment 2

[Thomas Ahlblom]

Does the issue still occur if you start Firefox in Safe Mode?
https://support.mozilla.com/en-US/kb/Safe+Mode

Please post the related Report IDs from about:crashes!
https://developer.mozilla.org/en/How_to_get_a_stacktrace_for_a_bug_report

Comment 3

[:aceman]

Attached the testcase. But it is not crashing for me, on XP, 32bit.

Comment 4

[Stephen Sagers]

I have identified that it happens when you have hardware acceleration on for FF.  I have had other co-workers try it, and the couple whose FF didn't have their graphics drivers blacklisted all were able to crash their FF with the testfile.  I am attaching the appropriate about:support info for their machines.

Comment 5

[Stephen Sagers]

Attachment: Graphics & FF info for machines that crash FF with testfile.

Comment 6

[Stephen Sagers]

about:crashes Report ID's for me and 2 co-workers who were able to crash FF with the test file:

bp-9f205c1d-e07c-43b4-8d88-7568d2110825
bp-c4f4b616-1597-4e57-9c40-1a7f42110825

bp-988b95c9-acdc-45b0-928b-9cb522110826

bp-c029fcd2-84ab-4a2d-b7e4-3ef662110826

Comment 7

[Stephen Sagers]

In looking at my bug report (ID: 9f205c1d-e07c-43b4-8d88-7568d2110825) - it looks like my bug is very similar to bug 656589.

Comment 8

[:aceman]

Can't see on linux either. Really seems to depend on D2D.

Comment 9

[:aceman]

Yes it seems very similar. Do you also crash on the test in bug 656589? Can you also confirm that you no longer crash if you disable HW acceleration (tools -> options -> advacend) ?

Comment 10

[Stephen Sagers]

Firefox won't crash when hardware acceleration disabled (co-worker's machines that FF could not accelerate, and when I disable it on my machine would not crash).  I believe that it would crash for that bug (I won't be able to test it until I go back into work on Monday).  My test, besides having a lot of data, starts out with a tag (<br>) that would end up closing the attributes area of the select option, and push the large data part into the display value part of the option.

Comment 11

[Stephen Sagers]

Confirmed hardware acceleration crashes testcase in bug 656589, where disabling hardware acceleration does not.

Comment 12

[Bas Schouten (:bas.schouten)]

I believe this is probably triggering creation of a window that's too big for D3D10, D3D10 layers will fail elegantly but sadly it will try to use basiclayers with D2D, which doesn't fail elegantly. This shouldn't be too hard to fix in theory, but I also wonder why the huge window is being created.

Comment 13

[Bas Schouten (:bas.schouten)]

Probably a dupe of bug 656589. Still confirming.

Comment 14

[Bas Schouten (:bas.schouten)]

Confirmed as dupe.