Chrome crash when dragging node from or in DevTools |
||||||||||||
Issue descriptionVersion: 53.0.2753.0 OS: Ubuntu 16.04 64bit What steps will reproduce the problem? (1) Open DevTools and go to Elements panel on new tab page (Ctrl + Shift + I) (2) Click and drag on a DOM node pulling it into the page. Say towards the search input box. What is the expected output? The node should get stringified and inserted as text. What do you see instead? Observe that shortly after bringing the node into the page space, the page will go black and flicker. It may reload to plain white or it may stay black. Last known working version: 52.0.2743.10 Dump from command line during failure: Received signal 11 SEGV_MAPERR 00000000001c #0 0x55aacdac4fe7 base::debug::(anonymous namespace)::StackDumpSignalHandler() #1 0x7f48bce883d0 <unknown> #2 0x7f48b0adab29 <unknown> #3 0x7f48b0ad98ad <unknown> #4 0x7f48b0ae1a61 <unknown> #5 0x55aacab1626a gpu::gles2::GLES2DecoderImpl::Initialize() #6 0x55aacabd428f gpu::GpuCommandBufferStub::Initialize() #7 0x55aacabd38f0 gpu::GpuCommandBufferStub::Create() #8 0x55aacabd1c65 gpu::GpuChannel::CreateCommandBuffer() #9 0x55aacabcd538 gpu::GpuChannel::OnCreateCommandBuffer() #10 0x55aacabcd36a _ZN3IPC8MessageTI38GpuChannelMsg_CreateCommandBuffer_MetaSt5tupleIJ28GPUCreateCommandBufferConfigiN4base14FileDescriptorEEES2_IJbN3gpu12CapabilitiesEEEE8DispatchINS7_10GpuChannelESC_vMSC_FvRKS3_iS5_PbPS8_EEEbPKNS_7MessageEPT_PT0_PT1_T2_ #11 0x55aacabcd19a gpu::GpuChannel::OnControlMessageReceived() #12 0x55aacabd1912 gpu::GpuChannel::HandleMessageHelper() #13 0x55aacabd18a0 gpu::GpuChannel::HandleMessage() #14 0x55aac9af4cc3 _ZN4base8internal7InvokerINS_13IndexSequenceIJLm0ELm1EEEENS0_9BindStateINS0_15RunnableAdapterIM25ThreadHopResourceThrottleFvRKNS_9TimeTicksEEEEFvPS6_S9_EJNS_7WeakPtrIS6_EES7_EEENS0_12InvokeHelperILb1EvSC_EEFvvEE3RunEPNS0_13BindStateBaseE #15 0x55aacdac60f6 base::debug::TaskAnnotator::RunTask() #16 0x55aacdadc655 base::MessageLoop::RunTask() #17 0x55aacdadc948 base::MessageLoop::DeferOrRunPendingTask() #18 0x55aacdadcc6b base::MessageLoop::DoWork() #19 0x55aacdade45a base::(anonymous namespace)::WorkSourceDispatch() #20 0x7f48bf2bf127 g_main_context_dispatch #21 0x7f48bf2bf380 <unknown> #22 0x7f48bf2bf42c g_main_context_iteration #23 0x55aacdade336 base::MessagePumpGlib::Run() #24 0x55aacdaf760e base::RunLoop::Run() #25 0x55aacdadbe5a base::MessageLoop::Run() #26 0x55aacd7d37c8 content::GpuMain() #27 0x55aacda9fbc7 content::ContentMainRunnerImpl::Run() #28 0x55aacda9e700 content::ContentMain() #29 0x55aac9a346cb ChromeMain #30 0x7f48b9ebe830 __libc_start_main #31 0x55aac9a345a9 <unknown> r8: 00001c50f5443b14 r9: 00001c50f5444894 r10: 0000000000000001 r11: 00007f48ba032730 r12: 00001c50f5a5f8f0 r13: 00001c50f5443a38 r14: 0000000000000000 r15: 00001c50f54ecc08 di: 00001c50f5443a00 si: 00001c50f552e3c0 bp: 0000000000000000 bx: 00001c50f5443a00 dx: 00000000ffffffff ax: 0000000000000000 cx: 0000000000000000 sp: 00007fffc8f71a80 ip: 00007f48b0adab29 efl: 0000000000010202 cgf: 0000000000000033 erf: 0000000000000004 trp: 000000000000000e msk: 0000000000000000 cr2: 000000000000001c [end of stack trace] Received signal 11 SEGV_MAPERR 00000000001c #0 0x564dff6e8fe7 base::debug::(anonymous namespace)::StackDumpSignalHandler() #1 0x7f6a9be183d0 <unknown> #2 0x7f6a8fa6ab29 <unknown> #3 0x7f6a8fa698ad <unknown> #4 0x7f6a8fa71a61 <unknown> #5 0x564dfc73a26a gpu::gles2::GLES2DecoderImpl::Initialize() #6 0x564dfc7f828f gpu::GpuCommandBufferStub::Initialize() #7 0x564dfc7f78f0 gpu::GpuCommandBufferStub::Create() #8 0x564dfc7f5c65 gpu::GpuChannel::CreateCommandBuffer() #9 0x564dfc7f1538 gpu::GpuChannel::OnCreateCommandBuffer() #10 0x564dfc7f136a _ZN3IPC8MessageTI38GpuChannelMsg_CreateCommandBuffer_MetaSt5tupleIJ28GPUCreateCommandBufferConfigiN4base14FileDescriptorEEES2_IJbN3gpu12CapabilitiesEEEE8DispatchINS7_10GpuChannelESC_vMSC_FvRKS3_iS5_PbPS8_EEEbPKNS_7MessageEPT_PT0_PT1_T2_ #11 0x564dfc7f119a gpu::GpuChannel::OnControlMessageReceived() #12 0x564dfc7f5912 gpu::GpuChannel::HandleMessageHelper() #13 0x564dfc7f58a0 gpu::GpuChannel::HandleMessage() #14 0x564dfb718cc3 _ZN4base8internal7InvokerINS_13IndexSequenceIJLm0ELm1EEEENS0_9BindStateINS0_15RunnableAdapterIM25ThreadHopResourceThrottleFvRKNS_9TimeTicksEEEEFvPS6_S9_EJNS_7WeakPtrIS6_EES7_EEENS0_12InvokeHelperILb1EvSC_EEFvvEE3RunEPNS0_13BindStateBaseE #15 0x564dff6ea0f6 base::debug::TaskAnnotator::RunTask() #16 0x564dff700655 base::MessageLoop::RunTask() #17 0x564dff700948 base::MessageLoop::DeferOrRunPendingTask() #18 0x564dff700c6b base::MessageLoop::DoWork() #19 0x564dff70245a base::(anonymous namespace)::WorkSourceDispatch() #20 0x7f6a9e24f127 g_main_context_dispatch #21 0x7f6a9e24f380 <unknown> #22 0x7f6a9e24f42c g_main_context_iteration #23 0x564dff702336 base::MessagePumpGlib::Run() #24 0x564dff71b60e base::RunLoop::Run() #25 0x564dff6ffe5a base::MessageLoop::Run() #26 0x564dff3f77c8 content::GpuMain() #27 0x564dff6c3bc7 content::ContentMainRunnerImpl::Run() #28 0x564dff6c2700 content::ContentMain() #29 0x564dfb6586cb ChromeMain #30 0x7f6a98e4e830 __libc_start_main #31 0x564dfb6585a9 <unknown> r8: 0000297f1f836514 r9: 0000297f1f837294 r10: 0000000000000000 r11: 00007f6a98fc2730 r12: 0000297f1f86e370 r13: 0000297f1f836438 r14: 0000000000000000 r15: 0000297f1f8ac908 di: 0000297f1f836400 si: 0000000000000000 bp: 0000000000000000 bx: 0000297f1f836400 dx: 00000000ffffffff ax: 0000000000000000 cx: 0000000000000000 sp: 00007ffc41b00500 ip: 00007f6a8fa6ab29 efl: 0000000000010246 cgf: 0000000000000033 erf: 0000000000000004 trp: 000000000000000e msk: 0000000000000000 cr2: 000000000000001c [end of stack trace]
,
Jun 1 2016
Yes, I was using dual-monitors when it reproduced. Just tested on my laptop (solo monitor) and it doesn't fail on the latest build. In the morning I'll retest on my desktop between dual and single monitors to get full verification if that is a cause of the problem.
,
Jun 9 2016
,
Jun 9 2016
It is reproducing on Chromium 53.0.2763.0 both with single monitor and dual monitors.
,
Jun 9 2016
,
Jun 9 2016
Although, it could be Linux-specific so marking that. I run Linux as well as the other report I merged in. I'll test on Windows 10 later today with Canary to see if the problem persists.
,
Jun 9 2016
Thank you! I'm still not able to reproduce it on Linux machine. I think it can be related to hardware configuration or windows manager in linux. Stack points to GPU internal. @piman, please take a look.
,
Jun 9 2016
Can you attach the contents of about:gpu on the machine where you reproduce the failure? Is there a crash report you could link to?
,
Jun 10 2016
I can confirm now it is *linux* specific. I'll grab the GPU data and look for a crash report once I am back in Linux after my insider preview update installs on the Windows disk. Version: 53.0.2764.0 on Windows works perfect.
,
Jun 10 2016
Exact crash ID from current Dev channel: 4e02db8600000000 chrome://gpu info: Graphics Feature Status Canvas: Software only, hardware acceleration unavailable Flash: Hardware accelerated Flash Stage3D: Hardware accelerated Flash Stage3D Baseline profile: Hardware accelerated Compositing: Hardware accelerated Multiple Raster Threads: Enabled Native GpuMemoryBuffers: Software only. Hardware acceleration disabled Rasterization: Software only. Hardware acceleration disabled Video Decode: Software only, hardware acceleration unavailable Video Encode: Hardware accelerated WebGL: Hardware accelerated Driver Bug Workarounds clear_uniforms_before_first_program_use count_all_in_varyings_packing disable_post_sub_buffers_for_onscreen_surfaces force_cube_complete init_gl_position_in_vertex_shader init_vertex_attributes remove_pow_with_constant_exponent scalarize_vec_and_mat_constructor_args use_current_program_after_successful_link use_virtualized_gl_contexts Problems Detected Accelerated 2d canvas is unstable in Linux at the moment Disabled Features: accelerated_2d_canvas Accelerated video decode is unavailable on Linux: 137247 Disabled Features: accelerated_video_decode Always call glUseProgram after a successful link to avoid a driver bug: 349137 Applied Workarounds: use_current_program_after_successful_link Program link fails in NVIDIA Linux if gl_Position is not set: 286468 Applied Workarounds: init_gl_position_in_vertex_shader Clear uniforms before first program use on all platforms: 124764, 349137 Applied Workarounds: clear_uniforms_before_first_program_use Mesa drivers in Linux handle varyings without static use incorrectly: 333885 Applied Workarounds: count_all_in_varyings_packing Linux NVIDIA drivers don't have the correct defaults for vertex attributes: 351528 Applied Workarounds: init_vertex_attributes Disable partial swaps on linux drivers: 339493 Applied Workarounds: disable_post_sub_buffers_for_onscreen_surfaces Always rewrite vec/mat constructors to be consistent: 398694 Applied Workarounds: scalarize_vec_and_mat_constructor_args MakeCurrent is slow on Linux with NVIDIA drivers Applied Workarounds: use_virtualized_gl_contexts NVIDIA 331 series drivers shader compiler may crash when attempting to optimize pow(): 477306 Applied Workarounds: remove_pow_with_constant_exponent NVIDIA drivers before 346 lack features in NV_path_rendering and related extensions to implement driver level path rendering.: 344330 NVIDIA fails glReadPixels from incomplete cube map texture: 518889 Applied Workarounds: force_cube_complete Accelerated rasterization has been disabled, either via blacklist, about:flags or the command line. Disabled Features: rasterization Native GpuMemoryBuffers have been disabled, either via about:flags or command line. Disabled Features: native_gpu_memory_buffers Version Information Data exported 6/10/2016, 11:27:13 AM Chrome version Chrome/53.0.2763.0 Operating system Linux 4.4.0-22-generic Software rendering list version 11.1 Driver bug list version 8.69 ANGLE commit id 768996c058da 2D graphics backend Skia Command Line Args --user-data-dir=/home/jonathan/.config/google-chrome-unstable --window-depth=24 --x11-visual-id=33 --wm-user-time-ms=371075 --flag-switches-begin --flag-switches-end Driver Information Initialization time 98 In-process GPU false Sandboxed true GPU0 VENDOR = 0x10de, DEVICE= 0x0dc4 Optimus false AMD switchable false Driver vendor Mesa Driver version 11.2.0 Driver date Pixel shader version 1.30 Vertex shader version 1.30 Max. MSAA samples 8 Machine model name Machine model version GL_VENDOR nouveau GL_RENDERER Gallium 0.4 on NVC3 GL_VERSION 3.0 Mesa 11.2.0 GL_EXTENSIONS GL_AMD_conservative_depth GL_AMD_draw_buffers_blend GL_AMD_performance_monitor GL_AMD_shader_trinary_minmax GL_ANGLE_texture_compression_dxt3 GL_ANGLE_texture_compression_dxt5 GL_APPLE_packed_pixels GL_APPLE_vertex_array_object GL_ARB_ES2_compatibility GL_ARB_ES3_compatibility GL_ARB_arrays_of_arrays GL_ARB_base_instance GL_ARB_blend_func_extended GL_ARB_buffer_storage GL_ARB_clear_buffer_object GL_ARB_clear_texture GL_ARB_clip_control GL_ARB_color_buffer_float GL_ARB_compressed_texture_pixel_storage GL_ARB_conditional_render_inverted GL_ARB_conservative_depth GL_ARB_copy_buffer GL_ARB_copy_image GL_ARB_debug_output GL_ARB_depth_buffer_float GL_ARB_depth_clamp GL_ARB_depth_texture GL_ARB_derivative_control GL_ARB_draw_buffers GL_ARB_draw_buffers_blend GL_ARB_draw_elements_base_vertex GL_ARB_draw_instanced GL_ARB_explicit_attrib_location GL_ARB_explicit_uniform_location GL_ARB_fragment_coord_conventions GL_ARB_fragment_program GL_ARB_fragment_program_shadow GL_ARB_fragment_shader GL_ARB_framebuffer_object GL_ARB_framebuffer_sRGB GL_ARB_get_program_binary GL_ARB_get_texture_sub_image GL_ARB_half_float_pixel GL_ARB_half_float_vertex GL_ARB_instanced_arrays GL_ARB_internalformat_query GL_ARB_invalidate_subdata GL_ARB_map_buffer_alignment GL_ARB_map_buffer_range GL_ARB_multi_bind GL_ARB_multisample GL_ARB_multitexture GL_ARB_occlusion_query GL_ARB_occlusion_query2 GL_ARB_pipeline_statistics_query GL_ARB_pixel_buffer_object GL_ARB_point_parameters GL_ARB_point_sprite GL_ARB_program_interface_query GL_ARB_provoking_vertex GL_ARB_query_buffer_object GL_ARB_robustness GL_ARB_sample_shading GL_ARB_sampler_objects GL_ARB_seamless_cube_map GL_ARB_separate_shader_objects GL_ARB_shader_atomic_counters GL_ARB_shader_bit_encoding GL_ARB_shader_draw_parameters GL_ARB_shader_objects GL_ARB_shader_precision GL_ARB_shader_storage_buffer_object GL_ARB_shader_texture_image_samples GL_ARB_shader_texture_lod GL_ARB_shading_language_100 GL_ARB_shading_language_420pack GL_ARB_shading_language_packing GL_ARB_shadow GL_ARB_stencil_texturing GL_ARB_sync GL_ARB_texture_barrier GL_ARB_texture_border_clamp GL_ARB_texture_compression GL_ARB_texture_compression_bptc GL_ARB_texture_compression_rgtc GL_ARB_texture_cube_map GL_ARB_texture_cube_map_array GL_ARB_texture_env_add GL_ARB_texture_env_combine GL_ARB_texture_env_crossbar GL_ARB_texture_env_dot3 GL_ARB_texture_float GL_ARB_texture_gather GL_ARB_texture_mirror_clamp_to_edge GL_ARB_texture_mirrored_repeat GL_ARB_texture_multisample GL_ARB_texture_non_power_of_two GL_ARB_texture_query_levels GL_ARB_texture_query_lod GL_ARB_texture_rectangle GL_ARB_texture_rg GL_ARB_texture_rgb10_a2ui GL_ARB_texture_stencil8 GL_ARB_texture_storage GL_ARB_texture_storage_multisample GL_ARB_texture_swizzle GL_ARB_texture_view GL_ARB_timer_query GL_ARB_transform_feedback2 GL_ARB_transform_feedback3 GL_ARB_transform_feedback_instanced GL_ARB_transpose_matrix GL_ARB_uniform_buffer_object GL_ARB_vertex_array_bgra GL_ARB_vertex_array_object GL_ARB_vertex_attrib_binding GL_ARB_vertex_buffer_object GL_ARB_vertex_program GL_ARB_vertex_shader GL_ARB_vertex_type_10f_11f_11f_rev GL_ARB_vertex_type_2_10_10_10_rev GL_ARB_window_pos GL_ATI_blend_equation_separate GL_ATI_draw_buffers GL_ATI_separate_stencil GL_ATI_texture_compression_3dc GL_ATI_texture_env_combine3 GL_ATI_texture_float GL_ATI_texture_mirror_once GL_EXT_abgr GL_EXT_bgra GL_EXT_blend_color GL_EXT_blend_equation_separate GL_EXT_blend_func_separate GL_EXT_blend_minmax GL_EXT_blend_subtract GL_EXT_compiled_vertex_array GL_EXT_copy_texture GL_EXT_depth_bounds_test GL_EXT_draw_buffers2 GL_EXT_draw_instanced GL_EXT_draw_range_elements GL_EXT_fog_coord GL_EXT_framebuffer_blit GL_EXT_framebuffer_multisample GL_EXT_framebuffer_multisample_blit_scaled GL_EXT_framebuffer_object GL_EXT_framebuffer_sRGB GL_EXT_gpu_program_parameters GL_EXT_multi_draw_arrays GL_EXT_packed_depth_stencil GL_EXT_packed_float GL_EXT_packed_pixels GL_EXT_pixel_buffer_object GL_EXT_point_parameters GL_EXT_polygon_offset GL_EXT_polygon_offset_clamp GL_EXT_provoking_vertex GL_EXT_rescale_normal GL_EXT_secondary_color GL_EXT_separate_specular_color GL_EXT_shader_integer_mix GL_EXT_shadow_funcs GL_EXT_stencil_two_side GL_EXT_stencil_wrap GL_EXT_subtexture GL_EXT_texture GL_EXT_texture3D GL_EXT_texture_array GL_EXT_texture_compression_dxt1 GL_EXT_texture_compression_latc GL_EXT_texture_compression_rgtc GL_EXT_texture_compression_s3tc GL_EXT_texture_cube_map GL_EXT_texture_edge_clamp GL_EXT_texture_env_add GL_EXT_texture_env_combine GL_EXT_texture_env_dot3 GL_EXT_texture_filter_anisotropic GL_EXT_texture_integer GL_EXT_texture_lod_bias GL_EXT_texture_mirror_clamp GL_EXT_texture_object GL_EXT_texture_rectangle GL_EXT_texture_sRGB GL_EXT_texture_sRGB_decode GL_EXT_texture_shared_exponent GL_EXT_texture_snorm GL_EXT_texture_swizzle GL_EXT_timer_query GL_EXT_transform_feedback GL_EXT_vertex_array GL_EXT_vertex_array_bgra GL_IBM_multimode_draw_arrays GL_IBM_rasterpos_clip GL_IBM_texture_mirrored_repeat GL_INGR_blend_func_separate GL_KHR_context_flush_control GL_KHR_debug GL_MESA_pack_invert GL_MESA_texture_signed_rgba GL_MESA_window_pos GL_NV_blend_square GL_NV_conditional_render GL_NV_depth_clamp GL_NV_fog_distance GL_NV_light_max_exponent GL_NV_packed_depth_stencil GL_NV_primitive_restart GL_NV_texgen_reflection GL_NV_texture_barrier GL_NV_texture_env_combine4 GL_NV_texture_rectangle GL_NV_vdpau_interop GL_OES_EGL_image GL_OES_read_format GL_S3_s3tc GL_SGIS_generate_mipmap GL_SGIS_texture_border_clamp GL_SGIS_texture_edge_clamp GL_SGIS_texture_lod GL_SUN_multi_draw_arrays Disabled Extensions GL_NV_path_rendering Window system binding vendor SGI Window system binding version 1.4 Window system binding extensions GLX_ARB_create_context GLX_ARB_create_context_profile GLX_ARB_fbconfig_float GLX_ARB_framebuffer_sRGB GLX_ARB_multisample GLX_EXT_create_context_es_profile GLX_EXT_create_context_es2_profile GLX_EXT_fbconfig_packed_float GLX_EXT_framebuffer_sRGB GLX_EXT_import_context GLX_EXT_texture_from_pixmap GLX_EXT_visual_info GLX_EXT_visual_rating GLX_MESA_copy_sub_buffer GLX_OML_swap_method GLX_SGI_swap_control GLX_SGIS_multisample GLX_SGIX_fbconfig GLX_SGIX_pbuffer GLX_SGIX_visual_select_group GLX_INTEL_swap_event Window manager Compiz XDG_CURRENT_DESKTOP Unity GDMSESSION ubuntu Compositing manager Yes Direct rendering Yes Reset notification strategy 0x8261 GPU process crash count 0 Compositor Information Tile Update Mode One-copy Partial Raster Enabled GpuMemoryBuffers Status ATC Software only ATCIA Software only DXT1 Software only DXT5 Software only ETC1 Software only R_8 Software only BGR_565 Software only RGBA_4444 Software only RGBX_8888 Software only RGBA_8888 Software only BGRX_8888 Software only BGRA_8888 Software only YVU_420 Software only YUV_420_BIPLANAR Software only UYVY_422 Software only
,
Jun 10 2016
The crash points to inside the driver (nouveau), in the first glClear (during initialization). So it looks like a driver bug. Does it repro with the proprietary NVIDIA driver?
,
Jun 11 2016
,
Jun 14 2016
Yes, it is *only* with the open-source Nouveau drivers. Proprietary NVidia drivers cause no crashing. It also is not just when dragging into the page, but dragging even to drop one node into another on the DevTools to move element positions.
,
Jun 15 2016
Adding primary email to CC since I don't seem to actually get the updates to my Chromium for this bug.
,
Jun 20 2016
,
Jun 20 2016
Issue 619853 has been merged into this issue.
,
Jul 22 2016
Since it's driver issue I removed platform DevTools from this issue and reassigned it to @piman. Thanks.
,
Jul 22 2016
Can someone who can repro the issue file a bug following the instructions at https://nouveau.freedesktop.org/wiki/Bugs/ ?
,
Dec 7 2017
I'm assuming this bug is either gone, or no longer relevant. Please comment or file a new bug if there is still an issue here. |
||||||||||||
►
Sign in to add a comment |
||||||||||||
Comment 1 by kozyatinskiy@chromium.org
, May 31 2016Status: Assigned (was: Untriaged)