1385200 - Whole Firefox crash in win10 x86

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[Iris]

Attachment: multi_proxy-crash4.html

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36

Steps to reproduce:

I download firefox54.0.2  win32 version and run testcase.html




Actual results:

 my firefox broswer get crashed and exit and has no crash report. I use winDbg to debug the execute file, my be it is a UAF .

Comment 1

[Ryan VanderMeulen [:RyanVM]]

I haven't been able to reproduce a crash. I just get a slow script warning and a never-ending throbber.

Comment 2

[Tyson Smith [:tsmith]]

I ran on an ASan x64 build.
The browser hangs for a moment then on the JS console: "too much recursion"
Possible OOM?

Comment 3

[Andrew McCreight [:mccr8]]

This doesn't sound like a security issue.

Comment 4

[Ted Campbell [:tcampbell]]

Running the example while debugger is open completely destabilizes the browser. The test also inflates memory usage, so the crashes is likely OOM-related (especially if 32-bit). What is surprising to me is the log spam causes the instability.

Running the following in the devtools console locks up full browser for a long while. |for (var i = 0; i < 1000000; ++i) { console.log("SPAM"); console.log("HAM") }|