[Webkit-unassigned] [Bug 83780] negative length applied to Array#slice

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=83780





--- Comment #3 from Gavin Barraclough <barraclough at apple.com>  2012-09-04 11:57:10 PST ---
> I understand ... (ad this was quite old too) but in this way is too easy to crash a browser via malicious code. Don't you think? :-)

With WebKit2 this does not actually crash the browser - the page will just take a long time loading; there are plenty of equally easy ways to write a web page that will take a long time to load, e.g. "while(1);" ;-)  In response to a slow loading page, the browser can choose to prompt to give the user the option of either waiting for the load to complete or to interrupt the load.  Killing the web process is a great way to asynchronously interrupt the load since it firmly guarantees all resources will be cleaned up correctly.

The approach of killing the web process does have a keep drawback, in that it currently affects all tabs open in the browser.  In the case where the user wishes to wait for the load, all other pages will also be held up.  Where the user chooses to interrupt the load, this will force all pages to reload.  The drawback is really associated with the fact that multiple tabs are using the same web processes, and the fix is likely to change this.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.