How to crash IE9 with some simple CSS

http://tech.onefinestay.com/post/45746129401/dont-trust-your-bug-reports-aka-how-to-crash-ie9

by andrewingram • 13 years ago

94 44 13 years ago

tech.onefinestay.com

codefoe• 13 years ago

Microcrap strikes again.

Aardwolf• 13 years ago

Did you report this bug to the IE team?

andrewingram• 13 years ago

I'll ask Stuart (the author)

reybango• 13 years ago

Could you ask Stuart to email me a test case so I can look at it? We tried looking for a way to get a hold of him but couldn't find any short of a general email address on the company site.

reybango at microsoft [dot] com

ecaron2• 13 years ago

They'll just tell him that he should fix his CSS (https://groups.google.com/forum/?fromgroups#!topic/microsoft...). The only thing publicly announcing a MSIE bug will do is subject the author to ceaseless attacks from "you're either with us or against us" Internet Explorer fans (speaking from personal experience.)

mkr-hn2• 13 years ago

2013 Microsoft seems to be trying hard not to be 2009 Microsoft. Might be worth another shot.

ygra• 13 years ago

I don't see any MS employees answering there. Or don't they say so when answering on the newsgroups?

paul9290• 13 years ago

sorry but your company's browsers have caused many web devs to spend hours making their work look correctly in various IEs.

Nowadays there are frameworks like HTML5 boilerplate that help us along, but not so long ago it was extremely painful.

Worse are MS email clients even the most recent one which uses the MS Word engine to render html emails.

Further, if you want to create an innovative web app for mobile and desktop there is a ton more effort and work that needs to go in it if you want to reach the IE audience. It may not even work at all even after trying to get it to work - uggh!

woodchuck64• 13 years ago

"While it would be nice for IE to not get stuck like this, it would be much better for HTML authors to take a little more time and not put badly formatted junk into their sites."

Wow. Just... wow.

lojack• 13 years ago

I've ran into this bug before with a dotted border along with a border-radius on an element. This bugged the hell out of me and I was in contact with a friend from the IE team who was also debugging it. Finally isolated it to a small piece of code http://pastebin.com/w7YGvgWs

Apparently this is actually a browser hang and not actually a crash. The friend reported it internally, but he said they probably wouldn't actually fix it in IE9 since it wasn't a crash and wasn't exploitable.

So, yes, the IE team is fully aware of this bug.

fredley• 13 years ago

Of your fixes, did you need to do all of them or was any one on its own suffice to fix the problem?

cheeaun• 13 years ago

Would be useful if there's a simple testcase page for this.

Zirro• 13 years ago

The text doesn't mention if the bug remains in Internet Explorer 10. It would be interesting to know if the bug has been fixed in the latest major version.

Does Microsoft send out non-security updates for Internet Explorer 9 for those who are unable or unwilling to update to the latest version?

josteink• 13 years ago

Unable to reproduce in MSIE10:

http://jsfiddle.net/4Zukm/

beeglebug2• 13 years ago

That code won't kill it, it seems to need a width and height, see this one:

http://codepen.io/beeglebug/pen/ntLbv

ecaron2• 13 years ago

I'm guessing you're using Windows 8, but suspect that the bug still crashes MSIE10 on Win7. The two browsers look the same, but I suspect there are some drastic differences between their innards.

youngerdryas• 13 years ago

Just a heads up for anyone thinking of ugrading to IE10, it breaks several sites including FedEx, at least on Win7.

daigoba66• 13 years ago

The great thing about IE is that is backwards compatible. A website can automatically trigger IE to render in a specific version using metadata tags. I believe it can even go so far as to force it into compatibility mode by default for the website.

For websites that don't do this you can create a special list which can even be managed by group policy.

I'm always very frustrated when organizations choose not to upgrade for "compatibility" reasons. That's baloney. They're just too lazy to properly configure their systems.

Encosia4• 13 years ago

I've seen a couple mentions about that (Gmail being another site it breaks). What seems to be going on, and I don't have a Win7 machine to test on myself, is that something's causing IE10 on Win7 to incorrectly switch to compatibility mode on the affected sites. If you use the dev tools to switch back to IE10 standards mode, those sites work normally.

I think they should be able to fix that soon via Windows Update. I remember Windows Update made a change a few years ago that was switching all localhost:// addresses to compatibility mode, so there's probably an easily updatable list of sites that this happens automatically on.

IE10 on Windows 8 is not affected.

sp332• 13 years ago

It's available in the Windows Update dialog, but it's not selected by default.

tracker12• 13 years ago

I think that's pretty much bull... it should be checked by default... when you choose to include recommended updates with important ones, it should include IE10 in that list. It's bad enough that IE10 a year ago was close to current, that it took nearly a year to release the thing, now they don't even push it out. IE9 should be effectively dead now, but it's not.

mistercow• 13 years ago

>Does Microsoft send out non-security updates for Internet Explorer 9 for those who are unable or unwilling to update to the latest version?

A crashing bug in a browser is usually considered to be a security risk, so this wouldn't be a non-security update.

yuhong3• 13 years ago

Not always. Depends on the details of the crash. This particular case is actually a hang.

yuhong3• 13 years ago

They actually do include non-security "GDR fixes" in cumulative security updates. See the KB article associated with them. For example a MS10-xxx security update fixed the "operation aborted" appendChild problem and made it actually work.

beeglebug2• 13 years ago

Test case: http://codepen.io/beeglebug/pen/ntLbv

melling• 13 years ago

Hopefully, Microsoft will get around to pushing IE10 to consumers soon. IE10's market shares stands at 2.35%.

http://gs.statcounter.com/#browser_version-ww-daily-20130218...

I look forward to it hitting double digits this year.

Cowboy_X• 13 years ago

ooooh I have a story similar to this

Back in 2010 I moved to a new city, and was trying to find a graphic design firm that wanted an in-house web developer. I shopped a resume (with prominent link to on-line portfolio) to all sorts of shops, never got a single call back.

A while later, I had brief access to a Mac, and decided to check out my site there (those were the dark OS 9 days when Mac testing was sort of optional). Turns out that a CSS glitch in IE Mac would take down — not just the browser — but the entire computer. I had been walking around crashing systems and losing peoples work for months.

jordanthoms• 13 years ago

I don't think you meant 2010 there...

How to crash IE9 with some simple CSS

Related Stories