Infinite loop in trigger function when window.parentNode is a DOM element

Reported by:	anonymous	Owned by:	dmethvin
Priority:	low	Milestone:	1.7
Component:	event	Version:	1.6.1
Keywords:		Cc:
Blocked by:		Blocking:

Description

The code at fault is:

cur = cur.parentNode || cur.ownerDocument || cur === event.target.ownerDocument && window;

The cur variable walks the DOM tree, then becomes the Document object en then the window object. When window has a parentNode variable, an infinite loop starts.

Forgetting to declare a temporary parentNode variable so it ends up in the window object is a client programmer error, but jQuery should not choke on it.

Attachments (0)

Change History (4)

Changed July 01, 2011 01:41PM UTC by dmethvin comment:1

component:	unfiled → event
priority:	undecided → low
status:	new → open

Hmmm, good point. We are using another browser sniff for a setInterval property to determine if something is a window, we can check for that, or perhaps checking for cur.nodeType===1 would be better.

In the meantime, don't declare a global with the name parentNode!

Changed July 02, 2011 07:24PM UTC by dmethvin comment:2

To continue my internal dialog, we don't want to check for .nodeType===1 because someone may be depending on plain objects to bubble ... not that we formally support it, but I discussed the possibility with Yehuda a few months back. So a window test may be our best bet.

Changed July 31, 2011 08:26PM UTC by dmethvin comment:3

milestone:	1.next → 1.7
owner:	→ dmethvin
status:	open → assigned

Changed September 20, 2011 01:02PM UTC by dmethvin comment:4

resolution:	→ fixed
status:	assigned → closed

Trigger was refactored and fixed here: https://github.com/jquery/jquery/commit/ecd10464e8659b008e52161cc029f9d6863e33b3

Side navigation