Open Bug 527618 Opened 11 years ago Updated 5 years ago

when remote XMLHttpRequest success callback tries to update hash via location.href, current session history entry is replaced ("Back" skips the entry)

Categories

(Core :: DOM: Navigation, defect)

x86
All
defect
Not set
normal

Tracking

()

UNCONFIRMED

People

(Reporter: cowboy, Unassigned, NeedInfo)

References

(Depends on 1 open bug, )

Details

(Keywords: testcase-wanted)

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_8; en-us) AppleWebKit/531.9 (KHTML, like Gecko) Version/4.0.3 Safari/531.9
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5

When I make a cross-domain XMLHttpRequest request, if the success callback tries to change the hash by setting location.href = baseurl + "#hash" instead of location.hash = "#hash", the previous location loses its history entry, such that hitting the back button actually skips back two locations.

See my blog post here:
http://benalman.com/news/2009/11/is-this-a-firefox-remote-xhr-bug/

Reproducible: Always

Steps to Reproduce:
1. Make a cross-domain XMLHttpRequest request with a success callback that sets the hash via location.href = baseurl + "#hash";
2. Press the back button once.

Actual Results:  
The history goes back two locations, instead of one.

Expected Results:  
The history should go back one location.

I've observed this behavior in Firefox 2 - 3.6, on both Mac and Windows.
This also happens when appending an arbitrary script tag to the head or body. For example, append this script and the same thing happens; the history goes back two locations, instead of one.

<script>location.href=location.href.replace(/#.*/,"")+"#foo";</script>

Is this some kind of security thing?
Any chance you could attach a minimized testcase using plain XMLHttpRequest without jQuery? I can reproduce the #4 from the linked page in Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:2.0b8pre) Gecko/20101025 Firefox/4.0b8pre

As for comment 1 "appending an arbitrary script tag" - did you mean appending in the HTML source or dynamically?
Component: Bookmarks & History → General
Keywords: testcase-wanted
Product: Firefox → Core
QA Contact: bookmarks → general
Summary: Error when remote XMLHttpRequest success callback tries to update hash via location.href → when remote XMLHttpRequest success callback tries to update hash via location.href, current session history entry is replaced ("Back" skips the entry)
Version: unspecified → Trunk
Component: General → Document Navigation
QA Contact: general → docshell
I can confirm this too. To clarify, the title of this bug should be:

"When SCRIPT onload callback (aka JSONP callback) tries to update hash via location.href, current session history entry is replaced ("Back" skips the entry)".

However, there seems to be some strange conditions required. I'm getting the buggy behavior in a complex application built using Google Closure JSONP and history objects.

However, plain simple test case does not reproduce this:
http://barunkad.savana.cz/jiri.kopsa/testcase-firefox-hash-jsonp.html
I believe this is the same underlying issue as bug 754029 (which has patches and whatnot).
Depends on: 754029
Hi Ben,

I have test this issue on latest Firefox (44.0.2) release, latest Nighty (47.0a1) build and I have manged to reproduce it with the URL provided. 

Firefox: 47.0a1, Build ID: 20160301030237
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Firefox: 44.0.2, Build ID: 20160210153822
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:44.0) Gecko/20100101 Firefox/44.

I am unable to provide more reduce test case, can you please provide one like Nickolay suggested in comment 2? 

Thanks,
Cosmin.
Flags: needinfo?(cowboy)
You need to log in before you can comment on or make changes to this bug.