394203 - [javascript] Firefox freez

Status: RESOLVED DUPLICATE of bug 291047

(Core :: DOM: Core & HTML, defect)

Description

[Vitja Makarov]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6

Here is example html code, press button and firefox will freez

tested with 1.5.7 and 2.0.6 version both on windows and linux.

here is it:

<script type="text/javascript">
function foo() {
	var inputs = document.getElementsByTagName("input");

	for (var i = 0; i < inputs.length; i++) {
		var w = inputs[i];
		w.innerHTML = "die";
	}
}
</script>

<form>
	<input type="hidden"/>
	<input type="button" onclick="foo();" value="don't press">
</form>


Reproducible: Always

Steps to Reproduce:
1. Enable javascript
2. Place that code on your page

Actual Results:  
Firefox takes 100% cpu usage and freez, kill will help.

Comment 1

[Martijn Wargers (dead)]

Attachment: testcase from comment 0 attached to bug

Comment 2

[Martijn Wargers (dead)]

This particular testcase may be solved once bug 291047 is solved, but it's probably very simple to create another hanging testcase.
What should happen is that you get a warning that a script is slowing down the browser and the option to bail out.
I haven't looked for dupes yet, so I won't confirm it yet.

No need to remain security sensitive, it's just a hang.

Comment 3

[Jesse Ruderman]

Yeah, document.getElementsByTagName is live, so it makes sense that bug 291047 turns this code into an infinite JavaScript loop.

Firefox tries to detect infinite JavaScript loops and give the user a chance to escape, but there are known bugs that prevent it from doing that.