DOMStorage: Better defend against a tight loop maliciously using the API.

content/renderer/dom_storage/dom_storage_dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/dom_storage/dom_storage_dispatcher.h"
 
 #include <list>
 #include <map>
 
 #include "base/strings/string_number_conversions.h"
@@ skipping 121 matching lines @@
     int open_count_;
     CachedAreaHolder() : open_count_(0) {}
     CachedAreaHolder(DOMStorageCachedArea* area, int count)
         : area_(area), open_count_(count) {}
   };
   typedef std::map<std::string, CachedAreaHolder> CachedAreaMap;
   typedef std::list<CompletionCallback> CallbackList;
 
   ~ProxyImpl() override {}
 
-  // Sudden termination is disabled when there are callbacks pending
-  // to more reliably commit changes during shutdown.
   void PushPendingCallback(const CompletionCallback& callback) {
+    // Terminate the renderer if an excessive number of calls are made,
+    // This is indicative of script in an infinite loop or being malicious.
+    // It's better to crash intentionally than by running the system OOM
+    // and interfering with everything else running in the system.
+    const int kMaxPendingCompletionCallbacks = 1000000;
+    if (pending_callbacks_.size() > kMaxPendingCompletionCallbacks)
+      CHECK(false) << "Too many pending DOMStorage calls.";
+
+    // Sudden termination is disabled when there are callbacks pending
+    // to more reliably commit changes during shutdown.
     if (pending_callbacks_.empty())
       blink::Platform::Current()->SuddenTerminationChanged(false);
     pending_callbacks_.push_back(callback);
   }
 
   CompletionCallback PopPendingCallback() {
     CompletionCallback callback = pending_callbacks_.front();
     pending_callbacks_.pop_front();
     if (pending_callbacks_.empty())
       blink::Platform::Current()->SuddenTerminationChanged(true);
@@ skipping 171 matching lines @@
         params.page_url, session_namespace_for_event_dispatch,
         originating_area);
   }
 }
 
 void DomStorageDispatcher::OnAsyncOperationComplete(bool success) {
   proxy_->CompleteOnePendingCallback(success);
 }
 
 }  // namespace content