Bug 129559 - Huge memory consumption while opening a properly crafted SVG
Summary: Huge memory consumption while opening a properly crafted SVG
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: SVG (show other bugs)
Version: 528+ (Nightly build)
Hardware: Macintosh OS X 10.8
: P2 Critical
Assignee: Nobody
Keywords: InRadar
Depends on:
Reported: 2014-03-01 13:58 PST by Adenilson Cavalcanti Silva
Modified: 2015-04-15 11:06 PDT (History)
7 users (show)

See Also:

Screenshot of memory use (492.65 KB, image/png)
2014-03-01 14:08 PST, Adenilson Cavalcanti Silva
no flags Details
PoC (346 bytes, text/html)
2014-03-01 14:17 PST, Adenilson Cavalcanti Silva
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Adenilson Cavalcanti Silva 2014-03-01 13:58:36 PST
Open a 6 lines SVG and watch safari use up to 13GB of ram. Potentially  harmful in embedded (even for desktop).
Comment 1 Adenilson Cavalcanti Silva 2014-03-01 14:08:08 PST
Created attachment 225564 [details]
Screenshot of memory use
Comment 2 Adenilson Cavalcanti Silva 2014-03-01 14:17:20 PST
Created attachment 225565 [details]

In a 16GB ram machine, it will use up to 13GB. I haven't tested in a 8GB or 6GB machine, maybe it will crash?
Comment 3 Dirk Schulze 2014-10-28 10:34:08 PDT
Adding thorten. Not sure if it is an CG issue or an actual issue in WebCore yet.
Comment 4 Radar WebKit Bug Importer 2014-10-28 11:34:15 PDT
Comment 5 Said Abou-Hallawa 2015-04-13 12:14:07 PDT
Yes the svg is 6 lines of script but its height="18446744073709551697". Chrome does not have any problem rendering this SVG.  But FireFox does have similar problem rendering this SVG.
Comment 6 Said Abou-Hallawa 2015-04-15 09:23:45 PDT
This is the simplest reduction I could get to repro this bug:

<svg xmlns="http://www.w3.org/2000/svg">
  <line stroke-dasharray="10,10" x1="0" y1="100" x2="1000000000" y2="0" style="stroke:black;stroke-width:2"/>

Without the stroke-dash-array in the <line> tag, the memory usage is normal and the bug does not happen. With shorter line, the bug also does not happen.
Comment 7 Said Abou-Hallawa 2015-04-15 11:06:14 PDT
This bug happens because of a CG bug. <rdar://problem/20554955> tracks this issue. Nothing needs to be done in WebKit to resolve this issue. But this bug has to stay open till the CG bug is fixed.