[Bug 1638610]

2020-08-04 Thread Dlee-t
*** Bug 1612533 has been marked as a duplicate of this bug. ***

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1638610]

2020-01-14 Thread Zitrobugs
1.Step: open https://mozhelp.dynvpn.de/dateien/wl
2.Step: click on a bookmark in Firefox. For example http://example.org/foo (not 
a mozilla.org bookmark)
Expected result: it should open your bookmark in the same tab.

In Google Chrome/Opera it opens the wanted bookmark when I click on it. 
In IE 11 and Edge and Firefox i can not override the actual tab with my bookmark

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1638610]

2019-12-19 Thread Gingerbread-man-2
*** Bug 1604720 has been marked as a duplicate of this bug. ***

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1638610]

2019-09-02 Thread Pbz-a
*** Bug 1576623 has been marked as a duplicate of this bug. ***

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1638610]

2019-01-18 Thread Gijskruitbosch+bugs
*** Bug 1404513 has been marked as a duplicate of this bug. ***

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1638610]

2019-01-12 Thread Annevk
No, the situation around this specification-wise hasn't really improved
from three years ago unfortunately.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1638610]

2019-01-12 Thread Bzbarsky
> I assume that the second of these now does mean that we can avoid
navigation from within beforeunload itself, right?

Yes, and we do.  See nsDocShell::IsNavigationAllowed.

> we don't unload the current document (ie we don't hit the first cited
condition) until we start getting a response for the initial navigation

That's correct.  It has to be that way, because the response could be a
type that we'd hand off to a helper app instead of handling internally,
so we can't know whether we'll be unloading at all until we get the
response headers.

I too would be interested in what other browsers do.  Conceptually,
treating "user-triggered" and "page just randomly did it" navigations
differently makes sense to me.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1638610]

2019-01-12 Thread Gijskruitbosch+bugs
(In reply to Boris Zbarsky [:bzbarsky, bz on IRC] from comment #3)
> > are there spec reasons we can't just stop navigation permanently as soon as 
> > we fire beforeunload
> 
> At first blush, per spec you can't stop navigation inside beforeunload at
> all.  Or something.  Figuring out what the spec says here is rocket science.
> :(

(In reply to Anne (:annevk) from comment #5)
> First of all, agreed with bz that this is in need of heavy refactoring.
> Unfortunately there has been a lot of that, so I haven't gotten around to it
> yet. If we had more editors, maybe...
> 
> Having read through navigate and its various associated algorithms a few
> times now, I don't think anything there stops this, since the user is
> allowed to navigate elsewhere until the page navigated to actually starts
> arriving (at that point navigate starts blocking certain navigation
> attempts, though not all).
> 
> Now, we could make tweaks, but that's tricky. E.g., if the user clicks  onclick=window.location='/x'>test after dismissing the dialog, should
> that fail or work?


(In reply to Anne (:annevk) from comment #22)

> No, the situation around this specification-wise hasn't really
improved from three years ago unfortunately.

So... I'm going to be quite tentative here, because I'm very much not an
expert, and both of you are. But if I'm reading:

https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigate

Specifically,

> If there is a preexisting attempt to navigate browsingContext, and the
source browsing context is the same as browsingContext, and that attempt
is currently running the unload a document algorithm, then return
without affecting the preexisting attempt to navigate browsingContext.

> If the prompt to unload algorithm is being run for the active document
of browsingContext, then return without affecting the prompt to unload
algorithm.


I assume that the second of these now does mean that we can avoid navigation 
from within beforeunload itself, right?

I'm guessing (it's a bit hard to tell for me, not knowing where to look
in the spec) that we don't unload the current document (ie we don't hit
the first cited condition) until we start getting a response for the
initial navigation, and so between these two conditions (ie after
`beforeunload` and before `unload`), timers (setTimeout etc.) and any
other events may trigger JS that starts another navigation, and per spec
that should override the earlier navigation.

As Anne points out at the end of comment 5, blocking all navigation
after 1 navigation has started is tricky.

I'm tempted to suggest we try to pass whether a navigation was the
result of a user action (similar/using popup blocking state) down to
loadinfo in some way, and make user-triggered navigation be un-
overridable by webpage navigations. That would, AIUI fix this bug (and
all its variations).

It's also a bit complex, and I would be happy to hear other alternatives
- in particular, I'm quite curious if any of these bugs affect other
browsers and what, if any, mitigations they have in place.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1638610] Re: Dependency of JavaScript objects is Misconfigured Browser Crashes.

2019-01-10 Thread Bug Watch Updater
Launchpad has imported 22 comments from the remote bug at
https://bugzilla.mozilla.org/show_bug.cgi?id=1263100.

If you reply to an imported comment from within Launchpad, your comment
will be sent to the remote bug automatically. Read more about
Launchpad's inter-bugtracker facilities at
https://help.launchpad.net/InterBugTracking.


On 2016-04-08T09:06:10+00:00 Smylers-u wrote:

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:47.0) Gecko/20100101 
Firefox/47.0
Build ID: 20160405015839

Steps to reproduce:

When cautiously investigating a suspicious looking email, I tried to
report a page using ‘Report deceptive site...’, but doing so just
redirected me to another spam webpage instead of the report page.

An email tricked me into opening it by claiming to be from well-known
shop Marks & Spencer, but on reading it clearly wasn't. It linked to
this page, which I cautiously opened in a private window to find out
what it was doing and whether the site should be reported:
n.mobzones.com/uk/m-s?offer=271

I clicked on the answer ‘Marks & Spencer’, which went to a page with a
really long URL (but still http:, not data: or anything funky).

Then I pressed Alt+H and chose ‘Report deceptive site...’.


Actual results:

The question popped up asking if I was sure I wanted to leave the page.

I chose ‘Leave Page’, and was redirected (via a bunch of ad networks) to
a dating website.

I went back, repeated, chose ‘Stay on Page’, and was still redirected to
the same dating site.


Expected results:

I should've reached the site for reporting the page I was on.

Ideally ‘Report deceptive site...’ wouldn't ever trigger the
confirmation for leaving the page, but if it does then ‘Leave Page’
should go to the reporting site and ‘Stay on Page’ should stay there;
neither of them should redirect to a completely different page.

(Please note I'm not saying this specific site definitely merits being
reported. Merely the form for doing so should have been displayed.)

Reply at:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1638610/comments/0


On 2016-04-12T23:12:41+00:00 Dolske wrote:

Huh, yeah. When I load http://n.mobzones.com/uk/m-s?offer=271,
attempting to report the site does exactly what you describe. This isn't
actually a problem specifically to Report a Site, entering "google.com"
in the URL bar also results in the page somehow canceling that load and
you end up on another spam page. (http://play.leadzupc.com/...).

This seems pretty annoying, sites shouldn't be able to trap the user
like this.

Gijs/mconley: perhaps one of you could take a look to see what's
happening?

Reply at:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1638610/comments/1


On 2016-04-12T23:17:09+00:00 Gijskruitbosch+bugs wrote:

(In reply to Justin Dolske [:Dolske] from comment #1)
> Huh, yeah. When I load http://n.mobzones.com/uk/m-s?offer=271, attempting to
> report the site does exactly what you describe. This isn't actually a
> problem specifically to Report a Site, entering "google.com" in the URL bar
> also results in the page somehow canceling that load and you end up on
> another spam page. (http://play.leadzupc.com/...).
> 
> This seems pretty annoying, sites shouldn't be able to trap the user like
> this.
> 
> Gijs/mconley: perhaps one of you could take a look to see what's happening?

This page has:

$(window).on("beforeunload", function (e) {
$(window).unbind("beforeunload");

setTimeout(function () {
window.location = url;
}, 0);

e.returnValue = message;
return message;
});


Boris, are there spec reasons we can't just stop navigation permanently as soon 
as we fire beforeunload, until either the page has been unloaded / destroyed, 
or the user explicitly decides to stay on the page?

Reply at:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1638610/comments/2


On 2016-04-14T03:09:27+00:00 Bzbarsky wrote:

> are there spec reasons we can't just stop navigation permanently as
soon as we fire beforeunload

At first blush, per spec you can't stop navigation inside beforeunload
at all.  Or something.  Figuring out what the spec says here is rocket
science.  :(

Reply at:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1638610/comments/3


On 2016-04-20T20:32:01+00:00 Overholt-u wrote:

Anne, can you help (see comments 2 and 3).

Reply at:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1638610/comments/4


[Bug 1638610] Re: Dependency of JavaScript objects is Misconfigured Browser Crashes.

2016-11-17 Thread Bug Watch Updater
** Changed in: firefox
   Status: Unknown => Confirmed

** Changed in: firefox
   Importance: Unknown => Medium

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1638610] Re: Dependency of JavaScript objects is Misconfigured Browser Crashes.

2016-11-17 Thread Marc Deslauriers
** Bug watch added: Mozilla Bugzilla #1263100
   https://bugzilla.mozilla.org/show_bug.cgi?id=1263100

** Also affects: firefox via
   https://bugzilla.mozilla.org/show_bug.cgi?id=1263100
   Importance: Unknown
   Status: Unknown

** Changed in: firefox (Ubuntu)
   Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1638610] Re: Dependency of JavaScript objects is Misconfigured Browser Crashes.

2016-11-02 Thread Dhiraj
Hi ,

Please find the Link below :

https://bugzilla.mozilla.org/show_bug.cgi?id=1313918

Thanks

** Bug watch added: Mozilla Bugzilla #1313918
   https://bugzilla.mozilla.org/show_bug.cgi?id=1313918

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 1638610] Re: Dependency of JavaScript objects is Misconfigured Browser Crashes.

2016-11-02 Thread Seth Arnold
Can you please report this issue to upstream Firefox developers and then
link the bug reports?

Thanks

** Information type changed from Private Security to Public Security

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1638610

Title:
  Dependency of JavaScript objects is Misconfigured Browser Crashes.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/1638610/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs