New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 764649 link

Starred by 1 user

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug-Regression



Sign in to add a comment

Unbounded browser process memory growth due to WebSocket SafeBrowsing checks

Project Member Reported by ricea@chromium.org, Sep 13 2017

Issue description

You can cause the browser process to keep allocating memory by creating WebSockets in a loop like this:

while (true) {
  new WebSocket('ws://128.0.0.0');
}

This is basically a repeat of issue 459377, this time caused by the browser-side SafeBrowsing code allocating memory for every lookup.

The memory growth of the render process is faster than that of the browser process, so generally the render process will crash first, freeing the browser-side memory.

Still, it would be good to fix. Probably some kind of throttling would be appropriate.
 

Comment 1 by ricea@chromium.org, Sep 13 2017

Simple repro attached.
websocket-dos.html
71 bytes View Download

Comment 2 by yzshen@chromium.org, Sep 13 2017

When is the std::unique_ptr<blink::WebSocketHandshakeThrottle> for each websocket instance gets destroyed?

Some browser-side state will only be cleared after this object (more specifically, the mojom::SafeBrowsingUrlCheckerPtr member of this object) is reset or destroyed.

Comment 3 by yzshen@chromium.org, Sep 13 2017

Cc: yzshen@chromium.org

Comment 4 by ricea@chromium.org, Sep 14 2017

Labels: -Type-Bug Type-Bug-Regression
std::unique_ptr<blink::WebSocketHandshakeThrottle> will be destroyed once we receive a response.

I ran a modified version of the test where I periodically return to the event loop (with setTimeout) and it doesn't exhibit unbounded growth. So I think the problem is that the responses are never processed by the renderer.

I plan to address the problem by limiting the number of outstanding mojo requests to 64, and queuing inside the render process after that. While this is simple in principle, it will probably double the amount of code in practice.
Still happens. It's a very slow and boring DoS.

Sign in to add a comment