Closed Bug 286905 Opened 20 years ago Closed 15 years ago

Hang and crash with recursive setInterval

Categories

(Core :: DOM: Core & HTML, defect)

Product:
Core
Component:
DOM: Core & HTML
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 261633

People

(Reporter: gparadee, Unassigned)

References

(
URL
)

Details

(Keywords: crash, hang, Whiteboard: [sg:dos] DUPEME) 

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050223 Firefox/1.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.6) Gecko/20050223 Firefox/1.0.1

With a speically crafted javascript code Firefox will crash. The code is

 <body onLoad="KillTheFox()">
</body>
<SCRIPT LANGUAGE="JavaScript">
function KillTheFox() {
    window.setInterval("KillTheFox()", 0);
window.status = "a";
}
</SCRIPT>

In Internet Explorer there is no crash.

Reproducible: Always

Steps to Reproduce:
1.Load the webpage


Actual Results:  
Firefox froze up and eventually closed. 

Expected Results:  
Display the page normally.

It just freezes so I would guess firefox.exe
I didn't see a crash, but saw 100% CPU as the script ran. Stopped when I closed
the window -- no crash. IE also loops forever, but manages to limit the CPU
resources taken up.

Do we not detect script loops if they're setInterval? guess not.
Assignee: dveditz → general
Group: security
Status: UNCONFIRMED → NEW
Component: Security → DOM: Level 0
Ever confirmed: true
Product: Firefox → Core
QA Contact: firefox → ian
Whiteboard: [sg;dos]
Version: unspecified → Trunk
Whiteboard: [sg;dos] → [sg:dos]
Greg Paradee: Could you provide Talkback incident id for your crash?
Keywords: crash
(In reply to comment #2)
> Greg Paradee: Could you provide Talkback incident id for your crash?

the Talkback incident id? I dont understand. 
We have existing bugs on this (exponential growth in number of pending timers).
Whiteboard: [sg:dos] → [sg:dos] DUPEME
Assignee: general → nobody
QA Contact: ian → general
Status: NEW → RESOLVED
Closed: 15 years ago
Keywords: hang
Resolution: --- → DUPLICATE
Summary: Crash with special javascript code → Hang and crash with recursive setInterval
You need to log in before you can comment on or make changes to this bug.