138939 - [JS/CSS] Mozilla falls into an infinite loop if asked to manipulate an undefined style element

Status: RESOLVED DUPLICATE of bug 114461

(Core :: DOM: Core & HTML, defect)

Description

[Pascal Chevrel:pascalc (PTO until April 26)]

It might be a dupe but there are so many JS bugs filed that I coudd not find one
that matched mine.

If in a JS function mozilla is asked to use a CSS property which was not set, it
falls into an infinite loop and stops processing the rest of the page.

I created a testcase with a <div> that has its "left" position set in an inline
CSS style but not its "top " position. If I ask Mozilla to display the value of
the Left and Top positions of the <div>, it displays the value of the Left
position which was set (after a loong time on an Athlon 1700XP !) but seems to
fall into an infinite loop when it has to display the undefined Top value. The
mozilla logo keeps on spinning and the browser keeps on working with a 2% CPU usage.

IE displays the results instantly and gives me the expected "NaN" value for the
property I had not set.

Pascal

Comment 1

[Pascal Chevrel:pascalc (PTO until April 26)]

Attachment: testcase showing how Mozilla gets stucked when asked to display the value of an undefined CSS property

Comment 2

[Charles Capps]

Seeing this using 2002041711 (RC1) and 2002042006 on Win2k.

Comment 3

[Kai Lahmann (is there, where MNG is)]

confirmed with 1.0RC1, Linux - someone change the OS please

Comment 4

[Olivier Cahagne]

Keyword: +hang

Comment 5

[Bradley Baetz (:bbaetz)]

critical, not blocker

-> dom style

Comment 6

[Boris Zbarsky [:bzbarsky]]

This is not a hang (as anyone could have discovered by simply pressing the
"stop" button).

Here is what happens:

1)  We get the style object.
2)  We get the "left" of the style object and document.write() it.  This
    destroys the initial page, together with the various script variables
    defined on it, since document.write() calls an implicit document.open().
3)  We attempt to parseInt(gk.left) and get a JS error (anyone bothered to look
    at their JS console?) since gk is no longer defined.
4)  We're in the middle of a document.write() and never call document.close(),
    so the throbber keeps spinning (bug 81980).

A possible bug here is the "This destroys the initial page, together with the
various script variables".  Not sure whether we should be doing that or not..
over to DOM0 for consideration.

Comment 7

[Pascal Chevrel:pascalc (PTO until April 26)]

Thank you Boris for this explanation, the bug should indeed probably be marked
Invalid except if we consider that Opera/IE are right when they do not destroy
the script variables.

Comment 8

[Boris Zbarsky [:bzbarsky]]

restoring form fields that got munged.  :)

Comment 9

[Fabian Guisset]

Dup of bug 114461?

Comment 10

[Boris Zbarsky [:bzbarsky]]

Yeh, that's it.  :)

*** This bug has been marked as a duplicate of 114461 ***