search

NeilFraser / JS-Interpreter

A sandboxed JavaScript interpreter in JavaScript.
Apache License 2.0
1.96k stars 352 forks source link

`REGEXP_MODE=2` causes leak and eventual crash in Chrome #237

Closed ijc8 closed 1 year ago

ijc8 commented 1 year ago

Hello! Running a script involving regex such as

for (var i = 0; i < 1000; i++) {
    /\d/.test("5")
}

on https://neil.fraser.name/software/JS-Interpreter/ (or any instance with the default regex mode) crashes the tab in Chromium-based browsers.

This appears to be due to more and more workers being created (once per call) without getting freed:

Chrome Dev Console showing many workers all running the regex handler

It seems explicitly calling .terminate() on a worker (or close() from inside it) is enough to tell Chrome it should free it. I'll submit a PR for this later today.

(I'm not sure whether this constitutes a Chromium bug or not. Firefox cleans up the workers and doesn't crash, but I'm unclear on whether this is required by the spec in the absence of close()/.terminate().)