Firefox gets emergency update to fix the last update

It looks like last week's automatic update to Firefox came with an unintended hitchhiker: a new bug that opened up a potentially critical security vulnerability. The Mozilla Foundation responded by pushing out a new update that fixes the problem:MFSA 2009-23 Crash in nsTextFrame::ClearTextRun()I found the time line on this one interesting so I thought I'd share it.

It looks like last week's automatic update to Firefox came with an unintended hitchhiker: a new bug that opened up a potentially critical security vulnerability. The Mozilla Foundation responded by pushing out a new update that fixes the problem:

I found the time line on this one interesting so I thought I'd share it. It provides a fascinating insight into Mozilla's around-the-clock development process (all times are PDT):

April 21:

  • 5:11am: Marc Gueury, who was running a pre-release version of Firefox, noticed a new crash when using the HTML Validator extension (bug 489322). As more people started running into it, one noted:

    Firefox 3.0.9 downloaded in the background and installed when I restarted. Ordinarily I think that is a brilliant thing, but this time, because of this bug, it's corrupting my ability to work.

April 22:

  • 1:06pm: Daniel Veditz noticed a new "topcrash" and filed bug 489647. Topcrashes are like Firefox's equivalent of a "Top 10 list" from the automatic crash reporter.
  • 1:16pm: Developers narrowed down the time frame of the regression and identified a couple of possible pushes that might have caused it.
  • 11:17pm: The exact problem was described. Essentially, a fix to one problem got tangled up in a fix to another problem, which resulted in an incomplete patch being applied.

April 23:

  • 3:46am: A test case was created.
  • 3:52am: A patch was created to fix the bug.
  • 10:20am: The patch was checked into source control.
  • 12:30am: The fix was approved for an emergency release.
  • 5:04pm: The bug fix was verified on 3.0.10 builds on Linux.
  • 11:52pm: The bug fix was verified on 3.0.10 builds on Windows.

Once the fix was approved and verified the process of pushing out a new automatic update was started.