293841 - weird recursive behavior with document.write in data: URL

Status: VERIFIED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Somebody pointed this out on IRC sometime in the past week, and I couldn't find
a bug on it.

Loading the URL data:text/html,<script>document.write(window.location);</script>
causes weird recursive behavior.

Steps to reproduce:
 1. load data:text/html,<script>document.write(window.location);</script>

Expected results:
 1. "data:text/html,<script>document.write(window.location);</script>"

Actual results:
 1. data:text/html,data:text/html,data:text/html,data:text/html,...
 2. 
Error: too much recursion
Source File: data:text/html,x<script>document.write(window.location);</script>
Line: 1

Stack showing the recursion to be attached.

Comment 1

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

Attachment: stack showing recursion

Note that frame #0 matches frame #29.

Comment 2

[Brendan Eich [:brendan]]

I was the one who found this and mentioned it on #content.  Big fun, and the JS
recursion limiter saves the day.  Thanks for filing it.

/be

Comment 3

[Hixie (not reading bugmail)]

I disagree with the expected results.

You're document.write()ing a <script> tag. Thus that <script> tag is going to
execute. That <script> tag happens to be what you're currently executing, but
that's not the point.

To me it seems that this is exactly correct behaviour.

Comment 4

[Brendan Eich [:brendan]]

Hixie's right!  Fun.

/be

Comment 5

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Agreed