New issue
Advanced search Search tips

Issue 621297 link

Starred by 4 users

Issue metadata

Status: WontFix
Owner:
Closed: Jul 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Regression



Sign in to add a comment

Aw snap in PDF Viewer extension

Project Member Reported by rob@robwu.nl, Jun 18 2016

Issue description

Chrome Version: 53.0.2771.0 Canary (works fine in  53.0.2767.4 dev-m).
OS: Windows 10 (64-bit)
Crash ID:
6750a1a600000000 (911f1611-5464-4a2c-9c40-281aac31c27c)
5c7a21a600000000 (ef842ec0-2f87-4b31-9cd3-f612bc218c51)

Can you reproduce this crash?
I cannot reproduce the issue on Linux, but the original reporter states that the issue is consistently reproducible.

What steps will reproduce this crash (or if it's not reproducible,
what were you doing just before the crash)?
(1) Install the PDF Viewer extension - https://chrome.google.com/webstore/detail/pdf-viewer/oemmndcbldboiebfnladdacbdfmadadm
(2) Open http://arxiv.org/pdf/1604.00289.pdf
(3) Scroll to page 9.

Originally reported at https://github.com/mozilla/pdf.js/issues/7422

Please investigate the crash IDs and paste the stack traces in this report.
 

Comment 1 by qwer1...@gmail.com, Jun 18 2016

I'm the original reporter.
Crashes in PDF Viewer extension started as of several build back in Canary.
Notably, they do NOT occur in Chrome Version 53.0.2767.4 dev-m (64-bit).
They also occur e.g. at http://www.cs.toronto.edu/~rsalakhu/papers/LakeEtAl2015Science_supp.pdf
Crash ID:
616191a600000000 (c60b1a96-08af-4d03-9891-d4ddca1a73b6)
Components: Blink>JavaScript
Labels: -Pri-3 Pri-2
The crash is inside v8::internal::`anonymous namespace'::Invoke().

Comment 3 Deleted

Cc: jkummerow@chromium.org
Owner: cbruni@chromium.org
Reassigning to this week's sheriff.

Comment 6 by qwer1...@gmail.com, Jun 21 2016

Another one: 
http://cims.nyu.edu/~brenden/LakePhDThesis.pdf
Crash ID 5920ddc600000000 (33e7c0cc-99b8-493e-ae30-89990416d28d)
Crashes on page 67.

Comment 7 by cbruni@chromium.org, Jun 21 2016

So far I cannot repro under linux 53.0.2771.0 (Developer Build) (64-bit).

Comment 8 by cbruni@chromium.org, Jun 21 2016

Never mind, the moment I wrote this I got all 20 tabs crashed ;)

Comment 9 by rob@robwu.nl, Jun 21 2016

When an extension crashes, all tabs within the extension crash.

How did you reproduce it?
There is a difference between Aw snap caused by an out-of-memory condition (OOM), and a real bug. Since the OP reproduced it with a single tab, it seems to not be OOM.

(the fact that you tried 20 tabs may indicate an OOM)
again managed to crash it (still some 10gigs of RAM left), though seems to be an unrelated issue and only happening after a longer time of inactivity: 

ASSERTION FAILED: m_fetchedFonts.size() == hardMaxFonts() + 1
../../../third_party/WebKit/Source/core/html/canvas/CanvasFontCache.cpp(106) : blink::MutableStylePropertySet *blink::CanvasFontCache::parseFont(const WTF::String &)
1   0x7fffdf02d7df blink::CanvasFontCache::parseFont(WTF::String const&)
2   0x7fffdd01f8d7 blink::CanvasRenderingContext2D::setFont(WTF::String const&)
3   0x7fffdd78701a
4   0x7fffdd784db5
5   0x28aa55f570eb

Received signal 11 SEGV_MAPERR 0000fbadbeef
#0 0x7ffff79f192e base::debug::StackTrace::StackTrace()
#1 0x7ffff79f146f base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7fffe5442330 <unknown>
#3 0x7fffdf02d7e6 blink::CanvasFontCache::parseFont()
#4 0x7fffdd01f8d7 blink::CanvasRenderingContext2D::setFont()
#5 0x7fffdd78701a blink::CanvasRenderingContext2DV8Internal::fontAttributeSetter()
#6 0x7fffdd784db5 blink::CanvasRenderingContext2DV8Internal::fontAttributeSetterCallback()
#7 0x28aa55f570eb <unknown>
  r8: 00007fffd9980a40  r9: 0000000000000001 r10: 00007fffe3aa3be0 r11: 0000000000000000
 r12: 0000000000000016 r13: 00000ef14db440e0 r14: 00000ef14dce9860 r15: 00000ef14db45c18
  di: 0000000000000000  si: 00000000fbadbeef  bp: 00007fffffff9f00  bx: 00000ef14dce9860
  dx: 0000000000000000  ax: 09220b4e46bfb600  cx: 00000000fbadbeef  sp: 00007fffffff9e10
  ip: 00007fffdf02d7e6 efl: 0000000000010246 cgf: 0000000000000033 erf: 0000000000000006
 trp: 000000000000000e msk: 0000000000000000 cr2: 00000000fbadbeef

Cc: cbruni@chromium.org
Owner: junov@chromium.org
Might be related to some older bugs: 
https://crash.corp.google.com/browse?q=product.name%3D%27Chrome%27%20AND%20custom_data.ChromeCrashProto.magic_signature_1.name%3D%27blink%3A%3ACanvasFontCache%3A%3AhardMaxFonts%27%20AND%20product.version%3D%2750.0.2661.102%27&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D&stbtiq=&reportid=&index=0#4

Speculatively assigning to juno@ as it does not seem to be a v8 issue (not sure if what I experienced is really related to the original report 616191a600000000)

My repro was to open ~20 tabs of the mentioned pdfs above scroll through it and let it sit for some hours.

Comment 12 by qwer1...@gmail.com, Jun 22 2016

I can ALWAYS crash the tab on my Win 10 x64 machine, even when running a SINGLE tab.
Would be happy to help with debugging, if you tell me what you need.
BTW, I can NOT cause the crash on Chrome Version 53.0.2767.4 dev-m (64-bit) (same machine).
Owner: cbruni@chromium.org
ok so this does not repro under linux then, will have to create a debug build under windows.

Comment 14 by qwer1...@gmail.com, Jun 23 2016

I managed to fix the issue by creating a new user directory.
Note that creating a new profile did NOT fix the issue.
Project Member

Comment 15 by sheriffbot@chromium.org, Jul 4 2016

Labels: -M-53 M-54 MovedFrom-53
Moving this nonessential bug to the next milestone.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Status: WontFix (was: Available)
Sadly we get these kind of behavior from time to time.

Sign in to add a comment