164727 - document.write doesn't always work

Status: RESOLVED INACTIVE

(Core :: DOM: Core & HTML, defect, P5)

Description

[Kai Lahmann (is there, where MNG is)]

on that page sometimes the document.write fails and so makes the page unusable.

Js-Console-Output, if it breaks:
Error: syntax error
Sourcefile: http://deusex-machina.com/
Line: 67
Sourcecode:
<A
HREF="http://oascentral.cybereps.com/RealMedia/ads/click_lx.ads/ttlg.com/1142098440/Top1/Interep/FGN_Filler_Banner/amigamos468x60.gif/35303865363363663364366162666230"
target="_blank"><IMG SRC="http://realmedia-a800.d4p.net/6/800/1129/1022197724/oas-ce

the string looks normally like:
<A
HREF="http://oascentral.cybereps.com/RealMedia/ads/click_lx.ads/ttlg.com/276606444/Top1/Interep/FGN_Filler_Banner/tiberium.jpg/35303865363363663364366162383430"
target="_blank"><IMG
SRC="http://realmedia-a800.d4p.net/6/800/1129/1022198180/oas-central.realmedia.com/RealMedia/ads/Creatives/Interep/FGN_Filler_Banner/tiberium.jpg"
 WIDTH=468 HEIGHT=60 ALT="Click Here" border=0 BORDER="0"></A>

and it doesn't always break at the same position as far as I can see.

...this also breaks a forum with 100.000 users, so it would be nice, if this
doesn't end as an UNCO forever...

Reproducable with every Mozilla Version available.

Comment 1

[Markus Hübner]

confirming - using trunk build 2002082208 on win-xp pro.
Rendered correctly at the first visited - did reload and the page was broken.

Comment 2

[Phil Schwartau]

Confirming, also: I see this with Mozilla trunk binary 20020826xx WinNT.
In the JS Console:

Error: syntax error
Source File: http://deusex-machina.com/
Line: 67
Source Code:
<A 
HREF="http://oascentral.cybereps.com/RealMedia/ads/click_lx.ads/ttlg.com/1443123
783/Top1/Interep/FGN_Filler_Banner/eqlorebanner.gif/3430656338626639336436313432
6130" target="_blank"><IMG 
SRC="http://realmedia-a800.d4p.net/6/800/1129/1022197997/oas-cent


As in Comment #1, this did not happen on initial load, only on reload.
I saved and ran the HTML locally, however, and NEVER got this error,
no matter how many times I reloaded it. By the way, I added this tag
so the images would all render: <base href="http://deusex-machina.com/">


I may be wrong, but I would think that if this were a bug in JS Engine,
it wouldn't matter if we ran this file locally or not: we would experience
the bug either way. 

Therefore let me reassign this to the Networking component: is the
transmission of the page somehow getting interrupted or corrupted?

Comment 3

[Phil Schwartau]

Note: I'm also getting this error in the JS Console:

          Error: _version is not defined
          Source File: http://deusex-machina.com/
          Line: 59

However, it doesn't seem to be relevant. The reason I say that:
I get the same error when I save and run the file locally as above.
Yet when run locally, the page seems to render just fine, as I said.

The site document.writes() a lot of <script> blocks. For example,
here is where they try to define the global variable |_version| : 


<script language="JavaScript">
  <!-- Hide from old browsers
  var random = new Number(Math.floor(9999999 * Math.random())+1);

  // Modify to reflect site specifics
  page = "ttlg.com/";
  target = "@Top1,x02,x05,x08!Top1";

  document.write('<SCR');
  document.write('IPT LANGUAGE="JavaScript1.1" 
SRC="http://oascentral.cybereps.com/RealMedia/ads/adstream_jx.ads/' + page + 1 + 
random + target + '">');
  document.write('</SCR');
  document.write('IPT>');

  document.write('<SCR');
  document.write('IPT LANGUAGE="JavaScript">');
  document.write('_version=10; //-->');
  document.write('</SCR');
  document.write('IPT>');

  document.write('<SCR');
  document.write('IPT LANGUAGE="JavaScript1.1">');
  document.write('_version=11; //-->');
  document.write('</SCR');
  document.write('IPT>');

  document.write('<SCR');
  document.write('IPT LANGUAGE="JavaScript">');

  if (navigator.appVersion.indexOf('MSIE 3') != -1){
    document.write('<IFRAME MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 
FRAMEBORDER=0 SCROLLING=no BORDERCOLOR="#000000" 
SRC="oascentral.cybereps.com/RealMedia/ads/adstream_sx.ads/' + page + random + 
target + '"></IFRAME>');
  }

  else if (_version < 11) {
    document.write ('<A 
HREF="http://oascentral.cybereps.com/RealMedia/ads/click_nx.ads/' + page + 
random + target + '"><IMG 
SRC="http://oascentral.cybereps.com/RealMedia/ads/adstream_nx.ads/' + page + 
random + target + '"></a>');
  }

  document.write('</SCR');
  document.write('IPT>');

  // End Hide -->
</script>

Comment 4

[Phil Schwartau]

The error on line 59 in Comment #3 really would explain everything.
Right after that, the site authors test |_version| before they attempt
the document.write() that fails on line 67.

But there must be some sort of timing issue involved in detecting
the error. We are able to load this page off the Internet occasionally
and have it look right. I am ALWAYS able to load it locally and have
it look right. 

In those "good" scenarios, I get the error on line 59 in the JS Console,
but not the error on line 67. 

Comment 5

[Phil Schwartau]

Networking probably isn't the right component; let me reassign to
the DOM for further analysis. What timing issues might there be in
JS errors that occur in nested <SCRIPTS> created by document.write()?

Comment 6

[Boris Zbarsky [:bzbarsky]]

Attachment: What I think is a minimal testcase

This reproduces the one error I can reproduce consistently on that page...

Comment 7

[Boris Zbarsky [:bzbarsky]]

So.. it _looks_ like the async script load blocks the sync script load but not
execution of the parent script... and then things break.

Comment 8

[Johnny Stenback (:jst)]

Mass-reassigning bugs to [e-mail]

Comment 9

[Garrett Smith]

Attachment: Test with valid html where the script also writes valid HTML, reloading every 2 sec.

Attachment with valid html where the script also writes valid HTML.

Description:
The test will reload itsself. 

Results:
I see "passed" sometimes and "failed" sometimes ("passed" occurs 4/10 times on
my slow machine). 

If you uncomment the first document.write("<script ..."), you'll see "passed"
every time. 

It seems that a script that is written with document.write exists in a new
thread, creating race conditions.

Comment 10

[Garrett Smith]

Attachment: write("<script src='s2.js' ...") followed by more calls to write().

Try this out in IE and Mozilla.

------------------------------------------------------------

window.demo = function() {
	var x = window.open();
	
	// s2.js should execute in a new thread. The thread executing the 
	// current script should be notified by the thread executing s2.js.
	// The current thread, upon receiving notification, should join with 
	// the thread executing s2.js.
	// after s2.js has executed, the thread executing in the main thread
should resume.
	x .document.write( "<script src='s2.js'
type='text/javascript'><\/script>");
	x .document.write( "<h1>heading (1 of 6)<\/h1>");
	x .document.write( "<h1>heading (2 of 6)<\/h1>");
	x .document.write( "<h1>heading (3 of 6)<\/h1>");
	x .document.write( "<h1>heading (4 of 6)<\/h1>");
	x .document.write( "<h1>heading (5 of 6)<\/h1>");
	x .document.write( "<h1>heading (6 of 6) <\/h1>");
	x .document.write("<h1>All Done!<\/h1>");
	document.close();
    };
------------------------------------------------------------

Expected result:
"
text written from s2.js
heading (1 of 6)
heading (2 of 6)
heading (3 of 6)
heading (4 of 6)
heading (5 of 6)
heading (6 of 6) 


Actual Result:
heading (1 of 6)
heading (2 of 6)
heading (3 of 6)
heading (4 of 6)
heading (5 of 6)
heading (6 of 6)
All Done!
text written from s2.js

------------------------------------------------------------
window.demo = function() {
	var x = window.open();
	
	x .document.write( "<script src='s2.js'
type='text/javascript'><\/script>",
	"<h1>heading (1 of 6)<\/h1>",
	"<h1>heading (2 of 6)<\/h1>",
	"<h1>heading (3 of 6)<\/h1>",
	"<h1>heading (4 of 6)<\/h1>",
	"<h1>heading (5 of 6)<\/h1>",
	"<h1>heading (6 of 6) <\/h1>",
	"<h1>All Done!<\/h1>");
	document.close();
    };
------------------------------------------------------------

Expected result: 
Same as above.

Actual result:
Same as above.

Comment 11

[Garrett Smith]

Attachment: write("<script src='s2.js' ...") followed by more calls to write().

Try this out in IE and Mozilla.

------------------------------------------------------------

window.demo = function() {
	var x = window.open();
	
	// s2.js should execute in a new thread. The thread executing the 
	// current script should be notified by the thread executing s2.js.
	// The current thread, upon receiving notification, should join with 
	// the thread executing s2.js.
	// after s2.js has executed, the thread executing in the main thread
should resume.
	x .document.write( "<script src='s2.js'
type='text/javascript'><\/script>");
	x .document.write( "<h1>heading (1 of 6)<\/h1>");
	x .document.write( "<h1>heading (2 of 6)<\/h1>");
	x .document.write( "<h1>heading (3 of 6)<\/h1>");
	x .document.write( "<h1>heading (4 of 6)<\/h1>");
	x .document.write( "<h1>heading (5 of 6)<\/h1>");
	x .document.write( "<h1>heading (6 of 6) <\/h1>");
	x .document.write("<h1>All Done!<\/h1>");
	document.close();
    };
------------------------------------------------------------

Expected result:
"
text written from s2.js
heading (1 of 6)
heading (2 of 6)
heading (3 of 6)
heading (4 of 6)
heading (5 of 6)
heading (6 of 6) 


Actual Result:
heading (1 of 6)
heading (2 of 6)
heading (3 of 6)
heading (4 of 6)
heading (5 of 6)
heading (6 of 6)
All Done!
text written from s2.js

------------------------------------------------------------
window.demo = function() {
	var x = window.open();
	
	x .document.write( "<script src='s2.js'
type='text/javascript'><\/script>",
	"<h1>heading (1 of 6)<\/h1>",
	"<h1>heading (2 of 6)<\/h1>",
	"<h1>heading (3 of 6)<\/h1>",
	"<h1>heading (4 of 6)<\/h1>",
	"<h1>heading (5 of 6)<\/h1>",
	"<h1>heading (6 of 6) <\/h1>",
	"<h1>All Done!<\/h1>");
	document.close();
    };
------------------------------------------------------------

Expected result: 
Same as above.

Actual result:
Same as above.

Comment 12

[Garrett Smith]

Attachment: write("<script src='s2.js' ... <h1>hello<\/h1> ..." by more calls to write()

window.demo = function() {
	var x = window.open();
	
	x .document.write( "<script src='s2.js'
type='text/javascript'><\/script>" 
	
// the following text should not be rendered in the target document "x" 
// until after s2.js has  been read and parsed.

	+"<h1>heading (1 of 6)<\/h1>" 
	+"<h1>heading (2 of 6)<\/h1>" 
	+"<h1>heading (3 of 6)<\/h1>"
	+"<h1>heading (4 of 6)<\/h1>"
	+"<h1>heading (5 of 6)<\/h1>"
	+"<h1>heading (6 of 6) <\/h1>"
	+"<h1>All Done!<\/h1>");
	document.close();
    };
------------------------------------------------------------------------


Expected result:
text written from s2.js
heading (1 of 6)
heading (2 of 6)
heading (3 of 6)
heading (4 of 6)
heading (5 of 6)
heading (6 of 6) 


Actual Result:
heading (1 of 6)
heading (2 of 6)
heading (3 of 6)
heading (4 of 6)
heading (5 of 6)
heading (6 of 6)
All Done!
text written from s2.js

------------------------------------------------------------------------

Comment 13

[Garrett Smith]

Attachment: s2.js for attachments 120379 and 120381

Comment 14

[Garrett Smith]

Attachment: 120379: write("<script src='s2.js' ...") followed by more calls to write().

Fixed file attachment to point to bugzilla's location of s2.js (attachment
120382 [details]).

Also note that the cursor always spins in moz. Is document.close() not getting
called?

Comment 15

[Garrett Smith]

Attachment: 120381: write("<script src='s2.js' ... <h1>hello<\/h1> ..." by more calls to write()

Fixed file attachment to point to bugzilla's location of s2.js (attachment
120382 [details]).

Comment 16

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.