248480 - Image.src="javascript:<expression>" fails to complete unless <expression> is a var or literal

Status: RESOLVED WONTFIX

(Core :: General, defect)

Description

[Jeremy Cole]

User-Agent:       Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.6) Gecko/20040113
Build Identifier: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.6) Gecko/20040113

A) Mozilla can't display an image that is a set of JavaScript statements
creating an XBM image. 
B) Trying to assign JavaScript statements to the src property of an Image object
stops the script execution. 

Reproducible: Always
Steps to Reproduce:
1.Run sample code in 'Additional Information'
2.
3.

Actual Results:  
1, 2, 4, 5: Single dot XBM image, bracketed by [ and ]
3: Broken image icon
6: Omitted

Expected Results:  
As seen on NN4.5, MS-IE4.0 and MS-IE5.5
1, 2, 3, 4, 5, 6: Single dot XBM image, bracketed by [ and ]

<ol>
<script>
	var	xbm	= "#define xbm_width 1\n#define xbm_height 1\nstatic char xbm_bits[] =
{\n0x01 };";
</script>
<!--	OK on NN4.5, MS-IE4, MS-IE5.5, Moz1.6	-->
<li>[<img src="javascript:xbm">]
<!--	OK on NN4.5, MS-IE4, MS-IE5.5, Moz1.6	-->
<li>[<img src="javascript:'#define xbm_width 1\n#define xbm_height 1\nstatic
char xbm_bits[] = {\n0x01 };'">]
<!--	OK on NN4.5, MS-IE4, MS-IE5.5. Broken image on Moz1.6	-->
<li>[<img src="javascript:var c = '#define xbm_width 1\n#define xbm_height
1\nstatic char xbm_bits[] = {\n0x01 };'; c">]
<script>
	var	img	= new Image();

	//	OK on NN4.5, MS-IE4, MS-IE5.5, Moz1.6
	img.src	= "javascript:xbm";
	document.writeln('<li>[<img src="', img.src, '">]');

	//	OK on NN4.5, MS-IE4, MS-IE5.5, Moz1.6
	img.src	= "javascript:'#define xbm_width 1\\n#define xbm_height 1\\nstatic char
xbm_bits[] = {\\n0x01 };'";
	document.writeln('<li>[<img src="', img.src, '">]');

	//	OK on NN4.5, MS-IE4, MS-IE5.5. Fails on Moz1.6
	img.src	= "javascript:var c = '#define xbm_width 1\\n#define xbm_height
1\\nstatic char xbm_bits[] = {\\n0x01 };'; c";
	document.writeln('<li>[<img src="', img.src, '">]');
</script>
</ol>

Comment 1

[Brendan Eich [:brendan]]

This has nothing to do with the JavaScript Engine.  Reporter, please use the
right bugzilla component in Product Browser, or use Browser-General if you don't
know of the right component.

Trivial tests show equivalence of javascript:'hi' and javascript:c='hi';c.

Someone debug this a bit, see what is going on in imglib.

/be

Comment 2

[Brendan Eich [:brendan]]

Tor, do you have a little time to debug this?  Easy testcase, at least!

/be

Comment 3

[Boris Zbarsky [:bzbarsky]]

This bug needs a testcase attached to the bug.  Please use https://bugzilla.mozilla.org/attachment.cgi?bugid=248480&action=enter

Comment 4

[Kagami Rosylight [:saschanaz] (they/them)]

XBM is removed by bug 504822. (TIL XBM 😅)