1376692 - OOM crash when creating CSS error message

Status: RESOLVED WORKSFORME

(Core :: CSS Parsing and Computation, defect, P5)

Description

[hyp3rlinx]

Attachment: Firefox-DOS.html

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36

Steps to reproduce:

Dynamically creating HTML elements IMG,FORM,DIV,P,A,H2,IFRAME,TABLE,TEXTAREA and assign very long string of junk chars to the "style.color" property results in Firefox browser crash (not tab).


Actual results:

Firefox crash, possible out of memory... no time to research yet. So I will check the security option below.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Crash report: https://crash-stats.mozilla.com/report/index/816adb14-42d0-475e-b3fd-fd2280170629

Comment 2

[Andrew McCreight [:mccr8]]

Thanks for the crash report, Ryan. It looks like we're trying to generate a very large CSS error message, and we crash safely in an OOM.

Comment 3

[Andrew McCreight [:mccr8]]

mozilla::dom::HTMLMediaElement::ReportLoadError() seems to also hit a similar crash signature.

Comment 4

[hyp3rlinx]

Yea I figured it was OOM, this will be be fix etc? thanks...

Comment 5

[Andrew McCreight [:mccr8]]

Generally we prioritize OOM crashes based on how common they are. This one doesn't appear to be particularly common.

Comment 6

[hyp3rlinx]

So not being common means which priority?

Comment 7

[Nathan Froyd [:froydnj]]

(In reply to hyp3rlinx from comment #6)
> So not being common means which priority?

It means low priority.

Although...we limit CSS error messages to something short so they don't cause these sorts of problems, IIRC.  Maybe we should be limiting load errors similarly?

Comment 8

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.