Differing Behavior Between HTTP and HTTPS sites

I have a function whose purpose is to prompt the user for input and apply that to the selected text.

It works fine, and can generate multiple popups if included in the code, as in the case of a URL wizard, of generate a quote where, if the user name is left blank, then an equal sign is added.

What would be passed into the function is an argument like this:
{{zzpopup,i18n.INS_AUTHOR,##authorQuote##,=","}}[quote##authorQuote##]Stuff_in_Clipboard[/quote]

It will process a popup, and if a name is entered you get:
[quote="NAME"]Stuff_in_Clipboard[/quote]

and if you enter nothing , you get:
[quote]Stuff_in_Clipboard[/quote]

This works fine on an insecure site, but on a secure (HTTPS) site, you have to enter the dialogue box 3 times, and I get a timeout message in the console log:
Error: Timeout after 1000ms dom.js:243:28

Am I missing something here in basic JavaScript functionality?

Function below:

function popThisUp(popArg) {
  while (popArg.includes("zzpopup")) { // cycle through multiple popups until done
        let popStartIdx = popArg.indexOf("{{zzpopup"); // start of popup argument in commend string
        let popEndIdx = popArg.indexOf("}}", popStartIdx) + 2; // end of popup argument in command string
        let popWork = popArg.substring(popStartIdx, popEndIdx); // extract the portion of the argument that has to do with making the popup
        popWork = popWork.substring(10, popWork.length - 2); //remove the "{{zzpopup," from the beginning of  argument, and "}}" from the end.
        let popTitle = popWork.substring(0, popWork.indexOf(",")); // popup title, possibly including i18n localization tag
          if (popTitle.includes("i18n")) { //if there is a localization tag
            popTitle = browser.i18n.getMessage(popTitle.substring(5));  // replace with i18n value
          }
        let popToReplaceStart = popWork.indexOf("##"); //start index of string to replace
        let popToReplaceEnd = popWork.indexOf("##",popToReplaceStart + 1); //end index of string to replace.
        var textToReplace = popWork.substring(popToReplaceStart,popToReplaceEnd +2);
        popWork = popWork.substring(popWork.indexOf(",") + 1); //drop title from popWork
        popWork = popWork.substring(popWork.indexOf(",") + 1); //drop string to be replaced from popWork
        popupBefore = popWork.substring(0, popWork.indexOf(",")); //text to be added before entered text
        popupAfter = popWork.substring(popWork.lastIndexOf(",")+1); //text to be added before entered text
        let popupResp = prompt(popTitle);
        if (popupResp === null || popupResp === "") { // if the prompt is left blank, produce empty response
          popupResp = "";
          popupBefore = "";
          popupAfter = "";
        }
        let popUpHere = (popupBefore + popupResp + popupAfter);
    		// add stuff to allow '\n\' to creat new line from popup
    		popUpHere = popUpHere.replace(/\\\\n/g,'~_~_~n'); // use '\\n' to actually enter '\n\'
    		popUpHere = popUpHere.replace(/\\n/g,'\n');
    		popUpHere = popUpHere.replace(/~_~_~n/g,'\\n');
        popArg = popArg.substring(0, popStartIdx) + popArg.substring(popEndIdx); //string it together with popup removed
        popArg = popArg.replace(new RegExp(textToReplace,"g"),popUpHere); //replace hashtag with word prompt results
    }
    //send back whatever you got from  the dialog box
        return popArg; 
}

I am unclear as to why this is looping and timing out.

OK, I was wrong on the behavior.

It is not occurring as a result of secure domains, it is occurring as a result of the text being in a rich text content editable box.

I just tried it out on another phpBB bbs that uses https, and it worked fine.

Ignore this inquiry. It turns out that I called a new function from a library that I was using, and (still figuring it out) something is not working in it.