Bug 24796

Summary: Page can create many workers and lock up browser and os
Product: WebKit Reporter: Jason Arbon <jarbon>
Component: DOMAssignee: Nobody <webkit-unassigned>
Status: UNCONFIRMED    
Severity: Normal CC: ap, dimich, dslomov, levin
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Mac (Intel)   
OS: OS X 10.5   
Attachments:
Description Flags
Script that creates 1000s of workers
none
web worker js that naively calculates primes to emulate a busy worker none

Jason Arbon
Reported 2009-03-24 22:26:02 PDT
A script on a page that creates many (1000's) of workers, can lock up the browser, and even the OS. The concern is that poorly written web apps, or malicious users could DOS the browser/os. Repro: run the attached script (note the worker js file should be in a 'resources' subfolder). Actual: 1. Browser and OS become unresponsive Expected: 1. Browser and OS do not become unrsponsive 2. Perhaps the unresponsive scipt dialog appears for misbehaving webapps 3. Perhaps we use a thread pool and/or throttle on cpu/resource consumption to prevent this from happening.
Attachments
Script that creates 1000s of workers (970 bytes, text/html)
2009-03-24 22:26 PDT, Jason Arbon 		no flags
Details
web worker js that naively calculates primes to emulate a busy worker (395 bytes, text/html)
2009-03-24 22:27 PDT, Jason Arbon 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Jason Arbon
Comment 1 2009-03-24 22:26:45 PDT
Created attachment 28924 [details] Script that creates 1000s of workers
Jason Arbon
Comment 2 2009-03-24 22:27:27 PDT
Created attachment 28925 [details] web worker js that naively calculates primes to emulate a busy worker
Dmitry Titov
Comment 3 2009-06-24 14:17:55 PDT
WHATWG discussion on this topic seems to come to consensus that FF solution (based on thread pool) is the way to go: http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2009-June/020286.html
Note You need to log in before you can comment on or make changes to this bug.