598226 - bug 61098 fix should be non trappable with try{}catch(){}

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P3)

Description

[Biju]

Attachment: alert_trap.html

bug 61098 fix should be non trappable with try{}catch(){} 

Otherwise user will have to wait till "script taking too long" to stop the run away script.

Again if user accidentally pressed continue he will be stuck again.

See attachment alert_trap.html

Comment 1

[Nochum Sossonko [:Natch]]

Essentially this is asking to stop script execution on the page, I seem to recall a bug out there for this already although I don't have the number offhand.

I highly doubt this will block at this point though...

Comment 2

[Johnny Stenback (:jst)]

Nope, not blocking. The point in bug 61098 was to give people 'a' way out, but given the extremely rare occurrences of these problems (I've personally never run into one randomly) I don't think it's worth investing much time in making it the smoothest experience possible. Time may of course change that, but for now I don't see a need to do anything beyond what we've done for Firefox 4.

Comment 3

[Kyle Huey (Exited; not receiving bugmail, old account, do not use)]

See Bug 397490 and Bug 384412

Comment 4

[Daniel Veditz [:dveditz]]

(In reply to comment #1)
> Essentially this is asking to stop script execution on the page

No, just immediately return from the function without throwing. The page doesn't need to know that you've disabled their prompts, just act like the user immediately hit Esc.

(In reply to comment #2)
> given the extremely rare occurrences of these problems (I've personally never
> run into one randomly) I don't think it's worth investing much time in making
> it the smoothest experience possible.

You've been lucky, or you stick to the well-maintained, well-financed big sites on the web. In the sketchier parts sites get hacked all the time, and this is a common approach for miscreants who don't have an outright 0-day to infect you with.

Comment 5

[Nochum Sossonko [:Natch]]

(In reply to comment #4)
> (In reply to comment #1)
> > Essentially this is asking to stop script execution on the page
> 
> No, just immediately return from the function without throwing. The page
> doesn't need to know that you've disabled their prompts, just act like the user
> immediately hit Esc.

I don't really understand this, that would still be a runaway js loop. Stopping js execution would return control to the user.

Comment 6

[Kate McKinley [:kmckinley, :Kate]]

The provided tests no longer work. The checkbox stops the repeated alert or prompt.