MozillaZine

Mozilla Branches for 0.9.8

Wednesday January 23rd, 2002

mozilla.org today branched for Mozilla Milestone 0.9.8, as well as opened the tree for 0.9.9 checkins. Look for branch builds to start sometime later this week, as early as tomorrow. (While a certain site believes that without builds, you can't have a branch, that is not true.) Pre-0.9.9 trunk builds will start tomorrow, or possibly tonight. See our earlier story for what's new in 0.9.8.


#71 but now it is right

by jsgremlin <joshua@bluestarstudio.com>

Tuesday January 29th, 2002 10:29 PM

You are replying to this message

You are right that the script is messed up - that's what happens from cutting and pasting (from an old project) and editing without paying much attention. a corrected version is up at the same url. if you add ?x (where x is some integer) to the url, it will compute the towers of hanoi solution for x discs instead of 50. I have successfully run this as high as 20.

I know it won't work in C++. It won't work in anything. That's the point of the script. Nothing can compute more than 10^15 steps, and if it could, it couldn't store a more than 3000000 GB string. As to what the browser should do with this, it should realize the script is taking forever and at least give the user the option of nuking it. If you give MSIE a short novel and tell it to run a few thousand regexps on it, it will do this. If you try a more normal (but equally excessive) recursive function in Netscape, it will kill the script with the error: "Too much recursion". Whatever Mozilla does, it should not allow a javascript to lock up the entire browser indefinitely.

However, even if Mozilla continues to hang on this script, it's not in bad company. Opera 6, Netscape 4.x, and MSIE5+ all choke on it too.

Also, this little exploit means that if JS is enabled in email, I can kill your browser session without you having to do anything but try to read an email I send you.