1180976 - misuse of window.history.go() can result in denial-of-service/crash

Status: RESOLVED INCOMPLETE

(Core :: DOM: Core & HTML, defect)

Description

[Moshe Zioni]

User Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36

Steps to reproduce:

1. run firefox.exe
2. put in the address bar:
data:text/html,<h1>helll...p</h1><script type="text/javascript">window.history.go()</script>
(can be achieved by making a html to with <a href=... too)


Actual results:

firefox continuously reloading, fully locked down, consumption is up to 50% cpu, but it is still enough to lock the window as a whole and an deterministic (as of now) crash from time to time.


Expected results:

handling history.go() w/ no params properly; rapid reload mitigation

Comment 1

[Boris Zbarsky [:bzbarsky]]

history.go() with no parameters is the same thing as location.reload().

Doing a bunch of location.reload() will in fact chew up CPU (in all browsers, last I checked; for example in Chrome it prevents even opening the developer tools on the page) but certainly shouldn't cause crashes.  Do you have the incident IDs from about:crashes?

Comment 2

[YF (Yang)]

Unlimited reload works fine in 47.0a1 (2016-02-08) Win10.

Comment 3

[:Gijs (out for now; he/him)]

Considering needinfo was set 7 months ago -> incomplete. We can reopen if/when we have more details.