New issue
Advanced search Search tips

Issue 655148 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 3
Type: Bug



Sign in to add a comment

WebView shell crashes when navigating to very large URLs

Project Member Reported by torne@chromium.org, Oct 12 2016

Issue description

The WebView shell's implementation of shouldOverrideUrlLoading passes the URL to PackageManager.queryIntentActivities, which causes a binder transaction size error if the URL is too big (more than a few hundred kb) and crashes the shell. We should try to avoid this, either by limiting the size of URL that we're willing to query the system about, or just by catching the exception.

You can repro this by going to the following URL:
data:text/html;base64,PGh0bWw+DQo8aGVhZD48aHRtbD4NCjxoZWFkPg0KPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0KZnVuY3Rpb24gbXVsMyAoc3RyLCBudW0pIHsNCglpZiAoIW51bSkgcmV0dXJuICIiOw0KCXZhcglvcmlnID0gc3RyLA0KCQlzb0ZhciA9IFtzdHJdLA0KCQlhZGRlZCA9IDEsDQoJCWxlZnQsIGk7DQoJd2hpbGUgKGFkZGVkIDwgbnVtKSB7DQoJCWxlZnQgPSBudW0gLSBhZGRlZDsNCgkJc3RyID0gb3JpZzsNCgkJZm9yIChpID0gMjsgaSA8IGxlZnQ7IGkgKj0gMikgew0KCQkJc3RyICs9IHN0cjsNCgkJfQ0KCQlzb0Zhci5wdXNoKHN0cik7DQoJCWFkZGVkICs9IChpIC8gMik7DQoJfQ0KCXJldHVybiBzb0Zhci5qb2luKCIiKTsNCn0NCnZhciBqdW5rYSA9ICJhIg0KdmFyIGp1bmsgPSBtdWwzKGp1bmthLDIwOTcwMzMpOw0Kd2luZG93LmxvY2F0aW9uLmhyZWYgPSAiaHR0cDovLyIgKyBqdW5rOw0KPC9zY3JpcHQ+DQo8L2hlYWQ+DQo8Ym9keT4NCg0KPC9ib2R5Pg0KPC9odG1sPg0KPC9odG1sPg0K

which embeds a JS redirect to a ~2MB url (http://aaaaaaaaa.....)

There's also a related issue that when saving/restoring the shell state, if large URLs are in the back/forward history, the binder transaction limit will be exceeded when saving the state to the bundle.

Not urgent or anything but would be nice to avoid crashing in these cases.
 

Sign in to add a comment