blocked fonts (or restricted CSS) causes browser to freeze/memory usage to rise

[Meriipu]

I found a site that has some weird issue with blocked fonts.

https://porofessor.gg/live/euw/randomusername

I have reproduced it on a new profile of firefox-88 with noscript 11.2.8 on linux x86_64

• set riotgames.com to trusted
• set google-analytics, googletagmanager, nitropay to untrusted
• set gstatic to either allow(script, media) or untrusted
• set porofessor.gg to allow(script, media, fetch)

Then hard-refresh the page some times. At a point the brower will stop responding to most actions. In the browser console log (not for the tab, I can not get that to open), I see a lot of messages of a combination of

[NoScript]:23527 Message not in NSCL-specific format: {"__prefetchCSSResources__":{"type":"enableCORS","opts":{"url":"https://fonts.googleapis.com/css?family=Open+Sans:300,400,500,700#b94f84c7-9b49-41d3-870e-be3cfeffd56e"}}}

and

GET https://fonts.googleapis.com/css?family=Open+Sans:...

In order to "fix" the issue I have to either

• Restart firefox and avoid loading the tab
• Temporarily disable noscript (if I can reach the addons-page before the freeze that is)
• Kill the "Web Content"-process, which will have a ridiculous memory usage (1GB-10GB++)

I have not experimented too much with combinations of block/allow-settings.

It started occurring sometime the last year, as I have automatic updates of extensions disabled and one of my firefox-profiles had an older version where I was not able to reproduce it until I updated noscript.

[Meriipu]

It may be due to not allowing unrestricted CSS too, as I can have it happen with fonts enabled but CSS restricted.

[hackademix]

It is surely restricted CSS. Have you got customized settings (either globally in the TRUSTED preset or as a CUSTOM per site configuration) with the restricted CSS capability is disabled but scripts are enabled?

[Meriipu]

Yes, for the domain porofessor.gg I had a custom setting with scripts enabled but "unrestricted css" toggled off.

It seems to not occur if I toggle the "unrestricted css"-setting for the domain on before visiting.

[hackademix]

11.2.11rc2 fixes issue #199 (at least the OP test case) and, as far as I can tell, this one as well. Please verify, thank you.

[Meriipu]

unable to reproduce with 11.2.11rc2 so inclined to agree it is fixed

thanks