User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.106 Safari/537.36

Steps to reproduce:

open index.html

and then wait a few minutes and then it fully crashes

Actual results:

it crashes

Expected results:

it should not crash

keeping this hidden mainly because as it seems to impact TOR

here is some crash logs https://crash-stats.mozilla.org/report/index/8c975b29-c26b-494e-97ef-f7e9f0200619

here is some more https://crash-stats.mozilla.org/report/index/b3ca6220-e247-4f62-a239-8e5150200619

https://crash-stats.mozilla.org/report/index/b7eb86d0-0190-44f8-b6af-706900200619

It takes 5 to 10 minutes or more to crash

All of these crashes are shutdown hangs, so they do not pinpoint the issue.

But checking this locally, the issue in the testcase appears to be about spamming blobs into the parent for downloads, plus some history navigation (for which I'm not sure whether it's related or not...).

:baku, I seem to recall you worked on this before? Maybe this is a dupe?

I think the main issue is that we allow multiple simultaneous downloads. I would block the issue at that level. See bug 1463527.

(In reply to Andrea Marchesini [:baku] from comment #6)

I think the main issue is that we allow multiple simultaneous downloads. I would block the issue at that level. See bug 1463527.

I don't understand why you believe that would help. The blobs get created and we have to at least start to load them before we even realize it's a download, so we'd incur the memory/IPC penalty already, no?

I don't understand why you believe that would help. The blobs get created and we have to at least start to load them before we even realize it's a download, so we'd incur the memory/IPC penalty already, no?

You are right. I haven't realized that the page reloads itself.
Something nice Chrome does is to detect IPC messages "abuse" and it blocks the content process.

seems fixed on firefox 83

The testcase has:

    <script>while(true)document.location.href="#",window.history.back(),window.history.forward();</script>

I guess this was busted by bug 1314912 (thanks :pbz !)

Are we confident there aren't other issues left here with the blob URI stuff itself that could be abused some other way?

Johann, do you know?

I don't off-hand, and it's unlikely I can look more closely into this in the future. :)