Closed Bug 1954304 Opened 5 months ago Closed 5 months ago

Feed reader embedded web browser crashes after clicking <a href="javascript:void(0)">

Categories

(MailNews Core :: General, defect)

Product:
MailNews Core
Component:
General
Version:
Thunderbird 128
Type:
defect

Tracking

(Not tracked)

Status:
RESOLVED DUPLICATE of bug 1907115

People

(Reporter: kajoamaton, Unassigned)

Details

Steps to reproduce:

  1. Create and open a new profile in Thunderbird 128.8.0esr (64-bit).
  2. Open Account Settings by pressing alt (opens toolbar) -> t (Tools) -> s (Account Settings).
  3. Click Account Actions -> Add Feed Account.
  4. In the Feed Account Wizard, click Next -> Finish to create a new feed account.
  5. Press ctrl-1 to go to the "main tab" of Thunderbird.
  6. Open feed subscriptions by pressing alt -> f (File) -> b (Subscribe).
  7. In Feed URL, enter https://old.reddit.com/r/all/.rss (or any feed where the webpage has <a href="javascript:void(0)"> elements).
  8. Click Add to create a new feed.
  9. Click the newly created feed folder. This shows a list of feed items in the message list pane.
  10. Double click one of the feed items to open it in a new tab.
  11. Press alt -> v (View) -> b (Feed Message Body As) -> w (Web Page) to open the feed item's URL in an embedded web browser.
  12. Scroll down to a Reddit comment and click the [-] button, which is supposed to minimize the comment. (Reddit implements this with an <a href="javascript:void(0)" onclick=...>)
  13. Observe that the embedded browser disappears. Inspecting it with the browser toolbox shows an empty <browser> element with no children.

I also tested this in the main tab's message pane. Its embedded browser will crash similarly.

I also tested this with other webpages by opening the embedded browser, selecting it with the browser toolbox and running the following JS commands from the toolbox. This will similarly crash the embedded browser.

const a = document.createElement("a");
a.href = "javascript:void(0)";
a.textContent = "test";
$0.appendChild(a); // When the embedded browser's <body> is selected in the browser toolbox inspector, $0 refers to the <body>
a.click();

Actual results:

  • All content in the embedded web browser disappears.
  • If these actions were performed in the message pane, no new embedded browser is opened in the message pane when selecting other feed items or when toggling the message pane with F8. Trying to open feed items from other folders causes the entire message pane to show up as empty.
  • Inspecting the embedded web browser through browser toolbox only shows a <browser> element with no children.

Expected results:

Similarly to Firefox, clicking a <a href="javascript:void(0)"> should do nothing.

Furthermore, I used the browser toolbox to track the issue into the function StrictLinkClickHandlerChild.handleEvent (LinkClickHandlerChild.sys.mjs). By default, the click event goes through this function with all the if-branches evaluating to false. The embedded web browser doesn't crash if the following actions are performed:

  1. Add a breakpoint in StrictLinkClickHandlerChild.handleEvent.
  2. Click an anchor <a href="javascript:void(0)"> to trip the breakpoint.
  3. In the console, enter event.preventDefault() to stop the click event from propagating.
  4. Click Resume (F8) to continue execution.

It seems to me that StrictLinkClickHandlerChild.handleEvent should have some added handling, such as if (eventUri.schemeIs("javascript")) event.preventDefault();

This was the cause of bug 1907115 which is now fixed.

Status: UNCONFIRMED → RESOLVED
Closed: 5 months ago
Duplicate of bug: 1907115
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.