Firefox 2.0 is line for another update today, the first time Mozilla will have released two versions of the open-source browser in the same week.
A bug in rendering 'canvas' HTML elements worked its way into Firefox 126.96.36.199, the edition Mozilla released on Monday to fix six other vulnerabilities. Canvas elements, which were first used by Apple in its Safari browser, let website designers dynamically render bitmap images in HTML. Firefox, Safari and Opera support Canvas natively; Microsoft's Internet Explorer does so with a plug-in.
All editions of Firefox 188.8.131.52 - for Windows, Mac OS X and Linux - break pages that include the Canvas element, and cripple at least two Firefox extensions, FoxSaver and Fotofox.
Developer Kevin Han reported the regression bug late on Monday, within hours of 184.108.40.206's release. By Tuesday morning, confirmations began pouring into Bugzilla, Mozilla's bug and patch database.
"I can confirm this problem," said Klaus Reimer in a message posted to Bugzilla. "Customers are complaining because their Firefox automatically updated to 220.127.116.11 and now they can no longer order photo prints in our shop. I think this is a very serious problem, and I hope it will be fixed immediately in a 18.104.22.168 update."
By midday on Tuesday, developers had come up with a fix for the flaw. A day later, Nick Thomas, one of the developers working on the bug, answered questions about an update schedule. "The release of 22.214.171.124 is tentatively scheduled for Friday, November 30," he said on Bugzilla. "If that comes off, it'll be the fastest turnaround between Firefox releases to date; i.e., it relies on everything in the release process going without a hitch."
In an emailed statement, Mike Schroepfer, vice president of engineering for Mozilla, downplayed the extent of the problem. "The bug affects a specific use case of the Canvas tag, which is not yet in wide use," he said.
As for how the flaw slipped through Mozilla's testing process, Schroepfer said: "We used our standard process of releasing a beta to tens of thousands of users and had no reports of this issue prior to the full release of 126.96.36.199. Most importantly, once we became aware of the issue, we worked overtime to address it."
He did not say whether Mozilla would, in fact, deliver Firefox 188.8.131.52 on Friday.
But even if Mozilla meets the rush deadline, the snafu will leave some users very unhappy. "We develop process management web applications on Oracle that use AJAX [and] Ruby on Rails, and we have gone out of our way to tell our customers that we 'strongly' recommend they use Firefox," said someone identified only as Jonathan on Bugzilla. "This little episode really has egg on our face.
"For a couple of days, we have had an unbearable number of support calls. I would hope this reinforces the need for someone to put in some serious effort on developing a solid and extensive suite of regression tests. This should have NEVER gotten into a public release."
Firefox 3.0 Beta 1, which launched last week, is not affected by the Canvas regression.