Re: Bug Report: LibreJS can freeze the browser in an infinite loop.

[sagdanoha]

Hello,

I notice this hasn't had a response in nearly a month. While I have no intention

of rushing anyone to make a fix, I would like to at least verify that this bug

report has reached the right place.

Could I please get an acknowledgement that this report has reached the right people?

If I've posted this to the wrong place or more details are needed from me,

please let me know.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

On Thursday, May 14, 2020 3:48 PM, Ted Jameson <ted.jameson@protonmail.com> wrote:

I have run into a similar issue when visiting https://scratch.mit.edu/

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

On Saturday, May 9, 2020 8:59 AM, sagdanoha <sagdanoha@protonmail.com> wrote:

In short, on some sites in certain circumstances (details below), LibreJS enters

an infinite loop which blocks the browser from loading anything whatsoever on

any page, including newly opened pages, until the browser is killed. While I

would expect LibreJS's script blocking to break some sites, I don't expect

it's script blocking to ever block all loading of all parts of all webpages.

If LibreJS is disabled, then these issues immediately vanish. Additionally, I

tested blocking scripts with the NoScript plugin instead and I could not cause

any such issue no matter what combination of scripts I tried blocking or

unblocking. For this reason, I believe the core issue is something in LibreJS as

opposed to bad configurations with the sites themselves.

The simplest way I've found to reproduce the issue is to do a clean install of

GNU IceCat 60.7.0 and visit https://lichess.org/ to promptly trigger an infinite

loop that freezes the browser. I've reproduced the issue with LibreJS 7.20.2 and

seemingly any version of IceCat since at least version 60, though earlier

versions may have the issue as well. I've also verified that the issue is

present when LibreJS is installed as a plugin to the latest version of Firefox

(version 76.0).

I suggest testing with Lichess's website since so far, it's the only site I've

found that reproduces the issue with 100% consistency. Additionally, Lichess is

known to be open source under the GNU AGPL 3.0, so in theory there should be no

risk of running non-free _javascript_ while testing.

I have also seen this issue occur on sites other than Lichess however. For

example, I have occasionally run into this issue when performing a search

through the URL bar with DuckDuckGo as the search engine. I don't recommend

trying to reproduce the issue that way though both because that happens far more

rarely and because it may cause you to run non-free _javascript_ while debugging

the issue.