Bug 1514413 Comment 7 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
I've found the problem.

A minimal example to reproduce the bug would be:

    <head>
    </head>
    <body>
    <script>
    h = document.getElementsByTagName("head")[0];
    let i = 0;
    function evilimpl() {
        s = document.createElement("script");
        s.type = "text/javascript";
        s.async = true;
        s.src = "http://127.0.0.1/echo_evil.js?" + i;
        i++;
        h.appendChild(s);
    }
    
    function evil() {
      for (let i = 0; i < 5; ++i) {
        evilimpl();
      }
    }
    evil();
    </script>
    </body>


Then use a server like nginx to serve the `echo_evil.js` with content

    evil()

Logging shows the content process is issuing far more http request than the parent can handle in this case. I may need some time to figure out what's is going on here...
Revision 1 by
on 
I've found the problem.

A minimal example to reproduce the bug would be:

    <head>
    </head>
    <body>
    <script>
    h = document.getElementsByTagName("head")[0];
    let i = 0;
    function evilimpl() {
        s = document.createElement("script");
        s.type = "text/javascript";
        s.async = true;
        s.src = "http://127.0.0.1/echo_evil.js?" + i;
        i++;
        h.appendChild(s);
    }
    
    function evil() {
      for (let i = 0; i < 5; ++i) {
        evilimpl();
      }
    }
    evil();
    </script>
    </body>


Then use a server like nginx to serve the `echo_evil.js` with content

    evil()

Logging shows the content process is issuing far more http request than the parent can handle in this case. I may need some time to figure out what is going on here...

Back to Bug 1514413 Comment 7