Minor DoS while showing an alert in a visibilitychange event handler

NEW
Unassigned

Status

()

Firefox
Tabbed Browser
6 years ago
2 years ago

People

(Reporter: mounir, Unassigned)

Tracking

Trunk
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Created attachment 614721 [details]
testcase

With the attached test case loaded, you can't change the active tab unless you close it. If the user tries to change the active tab (with a click to another tab or keyboard navigation), two alerts will pops and the active tab will not change.
(Reporter)

Comment 1

6 years ago
FWIW, I would have expected to have only one event showing up ("hidden") and only after the active tab becomes inactive but that might be another issue.
Hmm.  Shouldn't we put a "stop these alerts" thing on that page at some point?  How do we handle just a setInterval() that alerts?

In any case, I see no way to fix this on the DOM side; the UI is what switches to the tab that's trying to put up the alert.
Component: DOM → Tabbed Browser
Product: Core → Firefox
QA Contact: general → tabbed.browser
(Reporter)

Comment 3

6 years ago
(In reply to Boris Zbarsky (:bz) from comment #2)
> Hmm.  Shouldn't we put a "stop these alerts" thing on that page at some
> point?

Even if we do, my expectation would have to get the alert showing on the page *after* being put in background. At least, it shouldn't prevent the tab switching. Blocking alerts for the page seems like a workaround but not the correct behavior nor a real fix.
See also bug 700080. Fixing bug 391834 properly would solve a lot of these types of issues...
> Even if we do, my expectation would have to get the alert showing on the page

When a background tab puts up an alert, the Firefox UI brings it to the foreground.  I agree that that's a bug, but it's not one that has anything to do with visibilitychange handlers.
(Reporter)

Comment 6

6 years ago
(In reply to Boris Zbarsky (:bz) from comment #5)
> > Even if we do, my expectation would have to get the alert showing on the page
> 
> When a background tab puts up an alert, the Firefox UI brings it to the
> foreground.  I agree that that's a bug, but it's not one that has anything
> to do with visibilitychange handlers.

Oh, I didn't know that... I guess I don't see that many alert()'s.
Do we have a bug filed for that? It seems like we could simply have the tab to be highlighted like we do for app tabs that have their title changed...
No idea on preexisting bugs; worst case this can be the bug for it.  ;)

Comment 8

2 years ago
This brings back memories...
Simply make a page that immediately executes this code for a fun game:

window.addEventListener('visibilitychange', function() {
    if (document.hidden) {
        window.open(location.href);
        alert("Whack-a-mole!");
    }
});

alert(!opener ? 'Want to play whack-a-mole?' : 'Enjoy more whack-a-mole!');
location.reload();
You need to log in before you can comment on or make changes to this bug.