Why would this page crash a browser tab even with JavaScript turned off?

Question

In the course of trying to google an unknown temporary file found on my drive, I came across this Chinese webpage[0]. It crashed the browser tab in both Firefox and Chrome with Javascript turned off. Reading the source, it's clearly trying to do something nasty; its main script[1] just creates another script tag and injects something from Baidu into it, which doesn't load on its own (presumably only serves once per token, or only if it knows it's injected somehow). Much of the rest of the page looks to be the raw source of a PDF file with a lot of email links. Served this way, Cloudflare is replacing those mail links with cfemail protection.What I really can't figure out is why it crashes the tab, or what the purpose of it is. Put on a hazmat suit if you check this one out, and obviously turn off Javascript.[0] https://www.impact-gun.com/uf20211126/20211126104952_40894.html[1] https://www.impact-gun.com/templets/tj.js

ffhhj · Accepted Answer

Some time ago I managed to crash the browser with recursive async operations. Didn't save the bug, but it could be useful to kill spam bots. Also read in HN that Cloudflare uses or used deeply nested HTML tables to measure browser processing and detect bots. Some PDF's recursive or expensive operations might have this effect. For example PostScript has decompression functions that could be used to inflate huge streams.I'm making a next-gen search engine and will work on these anti-bot measures.