608899 - Maybe purge pending keyboard / mouse events when window destroyed?

Status: NEW

(Core :: DOM: UI Events & Focus Handling, defect)

Description

[Michal Zalewski]

Hi folks,

This is minor in the grand scheme of things, but since JS busy loops block the UI hard, keyboard and mouse events are not dequeued and processed; and if that busy loop ends with window.close(), they will be delivered to the wrong window or tab instead. Naive PoC:

http://lcamtuf.coredump.cx/ffpause/

I actually suspect this is broken in more ways than immediately apparent (for example, a well-timed busy loop lets me have a half-done file open / save prompt on screen), but the window.close() vector is the most obvious and easiest to fix by just purging the event queue when window or tab is destroyed.

Comment 1

[Michal Zalewski]

Umm, so this kind of looks fixed in Firefox 5.

Comment 2

[Matthew N. [:MattN]]

I can still reproduce this with:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:9.0a1) Gecko/20110919 Firefox/9.0a1