1286763 - Canvas OOM crash after using 2GB+ of heap-unclassified memory when adding segments in infinite loop

Status: UNCONFIRMED

(Core :: Graphics: Canvas2D, defect, P3)

Description

[John Tapsell]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0
Build ID: 20160606113944

Steps to reproduce:

Visit https://jsfiddle.net/oaj6pjz6/2/


Actual results:

Firefox crashes


Expected results:

It shouldn't crash :)

Comment 1

[Tooru Fujisawa [:arai]]

The following code is infinite loop:

>         for(var x = this.minX + this.iteration; x <= this.maxX; x += this.iteration) {
>           context.lineTo(x, equation(x));
>         }

because the following variables are all 0.
  * this.minX
  * this.iteration
  * this.maxX

So, it's creating a path with infinite segments, and hits OOM.