1126220 - DOMSubtreeModified event handler 100% CPU usage

Status: UNCONFIRMED

(Core :: DOM: Events, defect, P5)

Description

[SkyLined]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Build ID: 20150122214805

Steps to reproduce:

Repro:

<script>
  var oNode1 = document.createDocumentFragment();
  oNode1.textContent = 2;
  oNode1.addEventListener("DOMSubtreeModified", function(oEvent){
    oEvent.target.appendChild(document.createElement("f"));
  }, true);
  var oNode2 = document.createDocumentFragment();
  oNode2.appendChild(oNode1);
</script>


Actual results:

Page uses 100% CPU. When the appropriate warning dialog pops up, "Stop Script" does not stop the script. Effectively, the user cannot stop the CPU usage without closing the tab.


Expected results:

"Stop Script" should terminate the script and return CPU usage to normal.

Ideally, this infinitely loop should be detected and an exception should be thrown to prevent the CPU usage without user interaction: there is no valid use case for such a loop.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

Oh, we should remove DOMSubtreeModified somewhat soon, well all the mutation events.

Comment 2

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.