SaveFileResourceHandler::OnReadCompleted is called when the request associated with the handler completes a read.  It posts a task to write the data to a file and continues with the request.  If file writing is slow and resource reading is fast and the resource is large (which could be achieved with a hand crafted gzip payload + potentially several gzip content-encodings in series), this could conceivably be used as a DOS attack on browser memory.  Note that this only happens in response to user request (through Save Page As ...).

Lukasz: Would you be willing to speak to whether or not this could be done by an evil site without the gzip bomb being loaded in the page load preceding the SavePage (and presumably crashing the renderer)?  I'm imagining loading JS that changes subresource references, but I don't know what protections exist or don't exist in the renderer against that.

(I'll remove the RVG if this seems likely to crash the renderer ahead of time; otherwise, this seems unwise to broadcast.)