Race Condition resulting in false positives / false negatives

[forced-request]

For some reason, certain payloads, such as <img src='1' onerror='{JAVASCRIPT}' are generating race conditions in which legitimate XSS payload execution is not being marked as executed, and payloads that don't execute are being marked as validated.

For the time being throttling the requests seems to decrease the likelihood of running into this behavior, but I'm still looking into the real cause.

[forced-request]

Looks like the problem is that the document finishes being evaluated in these cases before the onAlert (and other) event handlers are processed.