Chrome and Firefox goes in crash with Prebid.js with IAB CMP

[salvoaranzulla]

Type of issue

Chrome and Firefox goes in crash with Prebid.js with IAB CMP while reading the consent.

Description

Chrome and Firefox goes in crash with Prebid.js when IAB CMP invalidates old consent.

Steps to reproduce

1. Close browser and open the browser in incognito mode https://www.aranzulla.it/DEBUG-iubenda-articolo.html?forceDate=2022-01-01&debug=true. Press "X" button on the right top.

2. Open https://www.aranzulla.it/DEBUG-iubenda-articolo.html?forceDate=2022-12-01&debug=true e do not nothing.

3. Refresh the page. On JS console, you will see a Prebid.js error:

Uncaught (in promise) SyntaxError: Unexpected end of JSON input
at JSON.parse ()
at prebid6.21.1.js:10:1222
at Array.forEach ()
at Object.getId (prebid6.21.1.js:10:1177)
at ee (prebid6.21.1.js:18:11998)
at prebid6.21.1.js:18:12774
at Array.reduce ()
at ne (prebid6.21.1.js:18:12745)
at prebid6.21.1.js:18:7832
at prebid6.21.1.js:18:7729

4. If you press "Accetta" button, you will see that the browser goes in crash because of RAM consumption by Prebid.js.

I have recorded a video: https://drive.google.com/file/d/1MyMwgTS35eN1p1YfU8fifN6htRX1h6U5/view?usp=sharing

Test page

I have recorded a video: https://drive.google.com/file/d/1MyMwgTS35eN1p1YfU8fifN6htRX1h6U5/view?usp=sharing

Expected results

No browser crashes.

Actual results

Browser crashes.

Platform details

Chrome / FF
Prebid.js 6.21.1

Other information

[muuki88]

Hi @salvoaranzulla

You probably discovered #7707 .

Do you have index exchange (ix) as a bidder? The fix is easy: upgrade Prebid 🤗

[dgirardi]

This bug was introduced in #8201 - if you're able to cause an exception in user ID retrieval (I haven't tried to understand why that odd series of steps with the CMP does), it causes an infinite loop and runaway heap memory allocation. Fix is in #8362

[salvoaranzulla]

@muuki88 We are using the latest Prebid version. So it's not the bug you have linked to me.

@dgirardi Yes, if you need you can follow my steps to reproduce CMP error. I have also recorded a video: https://drive.google.com/file/d/1MyMwgTS35eN1p1YfU8fifN6htRX1h6U5/view?usp=sharing

[dgirardi]

@salvoaranzulla the video was very helpful, thank you - bug reports are one of those things that get no comments when they're well done :)

[salvoaranzulla]

@dgirardi I have updated my examples with latest version of Prebid.js. I keep seeing the error:

VM193:1 Uncaught (in promise) SyntaxError: Unexpected end of JSON input
at JSON.parse ()
at prebid6.23.0.js:10:1222
at Array.forEach ()
at Object.getId (prebid6.23.0.js:10:1177)
at ne (prebid6.23.0.js:18:12119)
at prebid6.23.0.js:18:12896
at Array.reduce ()
at te (prebid6.23.0.js:18:12867)
at prebid6.23.0.js:18:7927
at prebid6.23.0.js:18:7824

The browser is not crashing anymore. Is that the expected behaviour of your bugfix?

[salvoaranzulla]

@dgirardi With that error, the bidding is not starting. So no calls are made by Prebid.js when I see that error in JS console. The problem seems to be generated by ID5 module.

[salvoaranzulla]

@dgirardi I have found the problem. The problem is generated by this line code in ID5 module:

The module tries to interpret the cookie pbjs-id5id as JSON but that cookie contains just a white space (which is a not a JSON):

I think that the problem is in this function:

Prebid.js/modules/id5IdSystem.js

Line 252 in bcfb127

function getLegacyCookieSignature() {

Because that, Prebid crashes and bidding is not starting. Before your fix in the latest version, also the browser crashes.

[patmmccann]

@smenzer fyi

[dgirardi]

@salvoaranzulla would you be able to verify #8401 ?

The error you see is, as far as I can tell, due to your repro steps forcing an invalid cookie for ID5 (First set date A, which causes Prebid to try to expire the cookie with it; then roll the date back, so that Prebid sees that cookie as no longer expired - but its contents are not valid). To me that seems unlikely to happen in practice - did you run into it in production?

[smenzer]

we're on it...will post a PR shortly.

[patmmccann]

@smenzer could you review 8401

[smenzer]

you guys beat me too it! the PR looks good, thanks