723844 - Calling a function called onsubmit() from onsubmit handler causes recursive lock-up

Status: RESOLVED DUPLICATE of bug 682793

(Core :: DOM: Core & HTML, defect)

Description

[Craig Edwards]

Attachment: crash.txt

User Agent: Mozilla/5.0 (Windows NT 6.0; rv:10.0) Gecko/20100101 Firefox/10.0
Build ID: 20120129021758

Steps to reproduce:

Call a local function called onsubmit() from a form's onsubmit handler.


Actual results:

Firefox locks up, triggering the onsubmit() event recursively.


Expected results:

Internet explorer and other browsers call the local function as expected without crashing.

Comment 1

[Tim (fmdeveloper)]

Unable to reproduce on Mozilla/5.0 (Windows NT 5.1; rv:13.0a1) Gecko/20120202 Firefox/13.0a1

Does the issue still occur if you start Firefox in Safe Mode? http://support.mozilla.com/en-US/kb/Safe+Mode

How about with a new, empty profile? http://support.mozilla.com/en-US/kb/Basic%20Troubleshooting#w_8-make-a-new-profile

Comment 2

[:aceman]

Tim, but do you get the alert shown?
I do not, but I get this in error console, in FF13:
Timestamp: 7.2.2012 16:28:11
Error: too much recursion
Source File: https://bug723844.bugzilla.mozilla.org/attachment.cgi?id=594085
Line: 1

So the recursion is still there, just not a crash.

Comment 3

[Boris Zbarsky [:bzbarsky]]

The recursive behavior is the one the spec requires here.  Furthermore, it's the one I see in Safari, Chrome, and Opera; I'm not sure what "other browsers" means in comment 0 given that....

The reason for the behavior is that in inline event handlers the element the handler is bound to is placed on the scope chain, so a bareword lookup first looks for properties on that element.  So the testcase is equivalent to this one:

  <form id="test" onsubmit="document.getElementById("test").onsubmit();">

since form elements do in fact have an "onsubmit" property.

So the behavior from comment 2 is correct.

The lockup should not be happening, unless you have Firebug installed or something.  Craig, is that the case for you?

Comment 4

[Craig Edwards]

Hi,

I can confirm that in safe mode this does not happen and that i do run firebug so it is likely that it is trying to log the event or such.

Probably not-a-bug :-)

Comment 5

[Mounir Lamouri (:mounir)]

INVALID, per comment 3 and comment 4.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Yeah, exactly.  Firebug tries to report the infinite recursion exception, but we're out of stack space, so its attempt to do this throws an infinite recursion exception, and off we go.