Re: Running "Zombie" Script Elements

On Fri, May 22, 2009 at 11:36 PM, Ian Hickson <ian@hixie.ch> wrote:
> On Fri, 22 May 2009, Travis Leithead wrote:
>>
>> Here’s a quick markup and script sample:
>>
>> <body>
>>  <div>
>>   <span>
>>    <script>
>>     var d = document.querySelector(“body > div”);
>>     d.parentNode.removeChild(d);
>>    </script>
>>    <code>
>>     <script>
>>      alert(“a running zombie script?”);
>>     </script>
>>    </code>
>>   </span>
>>  </div>
>> </body>
>
> The second script gets executed by the "Run the script." sentence in
> 9.2.5.11 The "in CDATA/RCDATA" insertion mode, under "An end tag whose tag
> name is "script"".
>
> Basically when a <script> element is handled by the parser, it gets parsed
> regardless of what the DOM looks like.

Is there a reason for things to be designed this way? As Travis points
out, this is not how things work at least in firefox. Haven't tested
in other browsers.

I can't think of any strong arguments either way off the top of my
head. There are decent consistency arguments that can be made either
way. Either you can argue that it's consistent that all script
elements that are created by the parser are always run. Or you can
argue that scripts run when a consistent set of conditions are true,
which includes being part of the main document.

/ Jonas

Received on Sunday, 24 May 2009 05:06:05 UTC