691242 - "ASSERTION: Want to fire DOMNodeRemoved event, but it's not safe" with NoScript

Status: NEW

(Core :: DOM: Events, defect, P5)

Description

[Josh Matthews [:jdm]]

Attachment: Backtrace

STR:
1. install noscript
2. visit forums.whirlpool.net.au

From the stacktrace, it looks like we:
* add a script element
* check the content load policies
* one of the policies is a script which ends up removing a node (presumably in the same document or something)

Comment 1

[Josh Matthews [:jdm]]

STR addendum:
3. temporarily allow scripts on the page
4. assert

Comment 2

[Boris Zbarsky [:bzbarsky]]

It could be a different document.  Doesn't matter.  As things stand, content policies modifying any DOM is completely unsafe....

We really need to start calling them async.  :(

Comment 3

[Josh Matthews [:jdm]]

https://addons.mozilla.org/en-US/firefox/files/browse/133269/file/chrome/noscript.jar/content/noscript/ScriptSurrogate.js#L225

This is the function being called by the noscript content load policy (wait what? is that how policies are supposed to work?).

Comment 4

[Giorgio Maone [:ma1]]

(In reply to Josh Matthews [:jdm] from comment #3)
> https://addons.mozilla.org/en-US/firefox/files/browse/133269/file/chrome/
> noscript.jar/content/noscript/ScriptSurrogate.js#L225
> 
> This is the function being called by the noscript content load policy (wait
> what? is that how policies are supposed to work?).

Until there are better hooks (if ever), a content policy callback is the only place for an extension to execute a script instead of a blocked one. 

I could use a Sandbox and avoid to touch the DOM (I used to and, in fact, the method is still there) but I settled for the DOM-based approach after being severely bitten by memory/performance issues (maybe related to bug 646575?)

As a middle-ground, changing https://addons.mozilla.org/en-US/firefox/files/browse/133269/file/chrome/noscript.jar/content/noscript/ScriptSurrogate.js#L176 into

   this.executeSandbox;

switches back to Sandbox-based execution every surrogate triggered by a content policy call (by default, this happens on any allowed webpage which tries to import blocked Google Analytics scripts, for instance).

Comment 5

[Boris Zbarsky [:bzbarsky]]

> Until there are better hooks (if ever)

Others have asked for such callbacks; all that's missing is time to implement, fwiw...

Comment 6

[Giorgio Maone [:ma1]]

FYI, NoScript 2.1.5rc1 has changes to never modify the DOM during content policy callbacks.