Closed
Bug 111400
Opened 23 years ago
Closed 23 years ago
deadly loop that allocates 40M/s until mozilla or the computer dies
Categories
(Core :: DOM: Events, defect)
Tracking
()
People
(Reporter: db, Assigned: joki)
References
()
Details
Go to http://www.webcalendarcreator.com and there you see a drop down box saying " -- More information --". When I activate this and selects something then mozilla goes in to a infinite loop allocating more and more memory. After a small period of time my computer (640M memory, 1.5G swap) starts to swap really really bad. This is using moz 0.9.6 in linux (rh71).
Comment 1•23 years ago
|
||
Ouch. Yup, that kills 0.9.6 stone cold dead on Win98SE Confirming, OS->all. If I read this right, the problem is due to a really ugly coding error in the javascript on the page : <select name="select1" onChange="selectaplace(this.form)" size="1"> The thing is, the function selectaplace() _changes the select tag_, thereby triggering the onChange event, which calls function selectaplace(), which changes the select tag, which triggers the onChange event, which calls function selectaplace(), which changes... [repeat until your head explodes] Don't you just LURVE infinite recursion? There's [dodgy] browser-sniffing in there too, which (if I read it right) will only change the select tag on browsers which ID themselves as netscape, version 3 or better. 1) get some tech evangelism going to sort that client sniffing out (moz could probably cope just fine with the code that's fed to IE). 2) how practical would it be to get some kind of safety net in place to cope with this kind of disaster-waiting-to-happen in JS? I'll go out on a limb and hike this up to critical, since this one appears to be trivially easy to adapt into malicious code which would crash moz just by loading the page. ->DOM Events. I appreciate that might not be the right place for this one, but it's the best I can manage, and you guys should know where it belongs.
Assignee: asa → rogerl
Severity: major → critical
Status: UNCONFIRMED → NEW
Component: Browser-General → Javascript Engine
Ever confirmed: true
OS: Linux → All
QA Contact: doronr → pschwartau
Comment 2•23 years ago
|
||
Really reassigning to DOM events -
Assignee: rogerl → joki
Component: Javascript Engine → DOM Events
QA Contact: pschwartau → vladimire
Comment 3•23 years ago
|
||
In fact, is this bug a duplicate of bug 77271, "Need to filter recursive events to prevent crashes" ?
Comment 4•23 years ago
|
||
1) doh! Yes, someday, I'll get the hang of assigning bugs properly. 2) Phil, you're right, this sounds just like the kind of thing described in bug 77271. Marking as a dupe of 77271. *** This bug has been marked as a duplicate of 77271 ***
Status: NEW → RESOLVED
Closed: 23 years ago
Resolution: --- → DUPLICATE
You need to log in
before you can comment on or make changes to this bug.
Description
•