New issue
Advanced search Search tips

Issue 627688 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 394296
Owner: ----
Closed: Aug 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Feature



Sign in to add a comment

history.pushState can be used to make Chrome use up all the system's memory until Windows crashes

Reported by runem...@gmail.com, Jul 13 2016

Issue description

UserAgent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.60 Safari/537.36

Steps to reproduce the problem:
1. Run the following line in the Chrome developer tools console: while(true) { history.pushState(0, "X"); }
2. Watch as system memory grows infinitely until Windows crashes. 

What is the expected behavior?

What went wrong?
The chrome.exe process uses up memory until the system runs out of memory.

Did this work before? N/A 

Chrome version: 52.0.2743.60  Channel: beta
OS Version: 6.3
Flash Version: Shockwave Flash 22.0 r0

This bug is used on http://security-scan3.tk/chrm/index2.html
 

Comment 1 by ta...@google.com, Jul 13 2016

Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Feature
This doesn't sound like a security bug. It sounds like an expected behaviour, though I agree that there should be a memory limit for each web page. I'll change this to feature request and remove security label.

Comment 2 by ta...@google.com, Jul 13 2016

Components: Infra>Client>V8

Comment 3 by runem...@gmail.com, Jul 13 2016

Something such as "var arr = []; while(true) { arr.push(0); }" will not cause Chrome to crash. Only the tab will fail to load and show the "Aw, snap!" message (once it reaches about 1.5 GB).

Shouldn't the same thing happen when the cause of the high memory usage is history.pushState instead of an array that's growing infinitely large?
Status: Untriaged (was: Unconfirmed)
Components: -Infra>Client>V8 Blink>JavaScript
Components: -Blink>JavaScript UI>Browser>Navigation

Comment 7 by creis@chromium.org, Aug 10 2016

Cc: kinuko@chromium.org
Mergedinto: 394296
Status: Duplicate (was: Untriaged)
This has already been discussed in  issue 394296 .  I don't think we have any systems for preventing IPC DoS or memory exhaustion in the browser process, though kinuko@ was looking into something related there (comment 21).

Sign in to add a comment