Crash Internet Explorer 9 in one line of Javascript!

UPDATE: It appears that this bug has been fixed. This no longer crashes Internet Explorer 9.

As I’m sure you are all aware, Internet Explorer 9 was released a  couple of weeks ago, and last week I had the pleasure of testing my first website on it.  I had very high hopes because all the reviews said it was a  great browser: fast, standards compliant and a joy to work with. Maybe Microsoft had  at last  produced a  browser that wouldn’t cause pain to developers worldwide!

I was rather surprised then, when I opened my test site, only to find that IE 9 crashed, and crashed hard. After a bit of research I managed to distil the crash down to a  few lines of code.

If you wish to test out the crasher, please click here

    NOTE: This link will not crash IE9, but the link from this link will.
    DO NOT CLICK IT IF YOU DO NOT WANT TO CRASH INTERNET EXPLORER!


the source code is here:

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">
	<head>
		<title>IE Crasher</title>

		<link id="font-style-link"
href="http://fonts.googleapis.com/css?family=Cabin"
 rel='stylesheet' type='text/css'/>

		<style type="text/css">
			body{
				font-family: "Cabin";
			}
		</style>
		</head>
	<body>

		<select id="font-selector">
		</select><!--font-selector -->
		<a href="#" id="crash-button"
onclick="document.getElementById('font-style-link').href='xx';">
CLICKING THIS WILL CRASH INTERNET EXPLORER 9!</a>
	</body>
</html>

As you can see, this is all valid html, and legitimate javascript.

What happens is the page loads an external font using the @font-face command. For ease I am using the google font api instead of supplying my own font-face rule.

This font is then applied to the page body using a css rule – so far, so mundane.
The part that crashes IE 9 is this line of code, activated on clicking the link

document.getElementById('font-style-link').href='fail';

What this line does is removes the link to the stylesheet providing the font, cutting the reference to the loaded font.  When this happens in other browsers, they will load the fallback font and style the page using that.

In IE 9 however, it seems to be unable to do this should there be a  <select> element in the page and the browser will crash. I could get it to crash occasionally without the select element, but if it is there, it will crash every time.

On the demonstration page I have linked to, Internet Explorer 9 will only crash when you click on a  link. It is however trivial to attach the script to the page load, causing the browser to crash simply by visiting a  page. What is even more amusing is that IE 9 will then try to reload the page and crash again in a loop – I’m not going to put the page up, because that would be nasty!


If you liked this article you might like to read the follow-up article, AVG Antivirus 2011 corrupting web pages with injection of script avg_ls_dom.js.


About Alex Taylor

Roslin Design specialises in web design in Edinburgh. We offer competitively priced website design, and website hosting services. Roslin also provides web management services.
This entry was posted in Uncategorized. Bookmark the permalink.

4 Comments

  1. Faizan

    Internet Explorer 9 Su***…. i tried everything the guide you posted, the guide here: http://backspacetab.com/2011/05/16/internet-explorer-9-crashes-in-windows-7/
    but nothing is working for me.

  2. Kit Patterson

    For reference, this seems to now be fixed on IE9 (and IE10DP). I can’t reproduce it.

  3. Tass Sinclair

    Doesn’t crash my Internet Explorer 9.0.8112.16421 64-bit.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>