It appears that Oracle end-user performance monitoring framework is the culprit for appending the oracle_smp_chronos.js SCRIPT element. So I suppose one 'workaround' is to turn off performance monitoring.
Note that just slapping a SCRIPT element at the end of everything will even make an HTML page not-well-formed, because it will come after the closing </html> tag.
What the hack !
But, the portlet HTML content was still going through the portal server, so the whole page was still getting the chronos SCRIPT element - actually each portlet HTML fragment was getting a SCRIPT element, so there were multiple copies in the page ! Either there is a bug in the chronos script, or the multiple inclusion causes a problem, because there is now a JS error in the page:
if (evt.target.orig_onS5qb812) !"£$%^&* evt has no properties
I was running into a similar problem with the js file always appending to ajax requests. After much trial and error, I found that changing the content type to text/plain prevented the js file from appending. I didn't try it, but I imaging setting it to xml would work too.
The script only uses the event to find the HTMLEntity where the handler was originally called - it then uses this reference to locate the original handler which it replaced - and calls it.
if ((!form.onsubmit) || form.onsubmit()) form.submit();
Chances are, the original onclick handler did not pass the event, and the event does not get passed to form.onsubmit(). Even if it did that just pushes the error further down - because oracle_smp_chronos.js replaces the onsubmit for forms too. So what happens is:
user clicks link, this calls Oracles handler
Oracles Handler does its thing, then identifies the link from the event and calls the original handler
Original Handler calls form.onsubmit, passing on the event
but since the onsubmit method has been replaced, its actually calling Oracle's handler again, which does its thing again, then sees that the event references the LINK (not the form) so it calls the backed up Original handler
Original Handler calls form.onsubmit()
...and so on until the stack overflows.
In the version I've got, this only happens where oracle_smp_chronos thinks the browser is Netscape Navigator or one of its descendants. There is a seperate branch of code for MSIE - it uses 'this' to track back to the original code, ignoring the event. Ironicaly, the MSIE code runs fine in Mozilla 5, and any version of Firefox (I don't have a copy of Navigator v4 to test) so a better solution would be to change the browser identification code to treat everything as MSIE