745138 - Minor DoS while showing an alert in a visibilitychange event handler

Status: NEW

(Firefox :: Tabbed Browser, defect)

Description

[Mounir Lamouri (:mounir)]

Attachment: testcase

With the attached test case loaded, you can't change the active tab unless you close it. If the user tries to change the active tab (with a click to another tab or keyboard navigation), two alerts will pops and the active tab will not change.

Comment 1

[Mounir Lamouri (:mounir)]

FWIW, I would have expected to have only one event showing up ("hidden") and only after the active tab becomes inactive but that might be another issue.

Comment 2

[Boris Zbarsky [:bzbarsky]]

Hmm.  Shouldn't we put a "stop these alerts" thing on that page at some point?  How do we handle just a setInterval() that alerts?

In any case, I see no way to fix this on the DOM side; the UI is what switches to the tab that's trying to put up the alert.

Comment 3

[Mounir Lamouri (:mounir)]

(In reply to Boris Zbarsky (:bz) from comment #2)
> Hmm.  Shouldn't we put a "stop these alerts" thing on that page at some
> point?

Even if we do, my expectation would have to get the alert showing on the page *after* being put in background. At least, it shouldn't prevent the tab switching. Blocking alerts for the page seems like a workaround but not the correct behavior nor a real fix.

Comment 4

[:Gavin Sharp [email: [e-mail]]]

See also bug 700080. Fixing bug 391834 properly would solve a lot of these types of issues...

Comment 5

[Boris Zbarsky [:bzbarsky]]

> Even if we do, my expectation would have to get the alert showing on the page

When a background tab puts up an alert, the Firefox UI brings it to the foreground.  I agree that that's a bug, but it's not one that has anything to do with visibilitychange handlers.

Comment 6

[Mounir Lamouri (:mounir)]

(In reply to Boris Zbarsky (:bz) from comment #5)
> > Even if we do, my expectation would have to get the alert showing on the page
> 
> When a background tab puts up an alert, the Firefox UI brings it to the
> foreground.  I agree that that's a bug, but it's not one that has anything
> to do with visibilitychange handlers.

Oh, I didn't know that... I guess I don't see that many alert()'s.
Do we have a bug filed for that? It seems like we could simply have the tab to be highlighted like we do for app tabs that have their title changed...

Comment 7

[Boris Zbarsky [:bzbarsky]]

No idea on preexisting bugs; worst case this can be the bug for it.  ;)

Comment 8

[Steven Berlan]

This brings back memories...
Simply make a page that immediately executes this code for a fun game:

window.addEventListener('visibilitychange', function() {
    if (document.hidden) {
        window.open(location.href);
        alert("Whack-a-mole!");
    }
});

alert(!opener ? 'Want to play whack-a-mole?' : 'Enjoy more whack-a-mole!');
location.reload();