Leaking sockets in a Chrome app crashes the browser |
|||||||||
Issue description
UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.41 Safari/537.36
Steps to reproduce the problem:
1. Start adb server. Make sure it listens on port 5037.
2. Create a Chrome app with tcp-connect permission
3. Open its background page
4. Run this script:
var c = 0, t = Date.now();
function test() {
chrome.socket.create('tcp', {}, ({socketId}) => {
if (socketId == 0) throw Error('failed to create socket');
chrome.socket.connect(socketId, '127.0.0.1', 5037, connectInfo => {
if (connectInfo < 0) throw Error('failed to connect');
var data = new ArrayBuffer(4);
new Uint8Array(data).set(Uint8Array.of(48, 48, 48, 48));
chrome.socket.write(socketId, data, writeInfo => {
if (writeInfo.bytesWritten == 0) throw Error('failed to write');
console.log(++c, Date.now() - t);
if (c < 10000) setTimeout(test, 0);
});
});
});
}
test();
What is the expected behavior?
What went wrong?
After ~7800 iterations the connection fails. After that moving the mouse over the background page causes rendering artifacts, and after a while Chrome crashes.
Crashed report ID: crash/a28315bc00000000
How much crashed? Whole browser
Is it a problem with a plugin? No
Did this work before? N/A
Chrome version: 52.0.2743.41 Channel: stable
OS Version: Ubuntu 14.04 LTS
Flash Version: Shockwave Flash 22.0 r0
,
Jun 22 2016
The crash ID is of the extension process, which is not great, but less concerning. Do you have the crash ID of the browser process? (Look in chrome://crashes.)
,
Jun 22 2016
That was the only crash ID for today. I'll check again tomorrow. Meanwhile, I tried to reproduce the bug on my Macbook Air. The connection failed after 4900 iterations, but the browser remained stable.
,
Jun 23 2016
New crash ID: 544313bc00000000
,
Jun 23 2016
Thank you for providing more feedback. Adding requester "davidben@chromium.org" for another review and adding "Needs-Review" label for tracking. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jun 23 2016
,
Jun 23 2016
No, sheriffbot, this should not have been assigned to me. The browser crash looks like we've exhausted file descriptors. rdevlin.cronin: Who does extensions these days? It looks like an extension can cause the browser to create unboundedly many file descriptors which seems rather poor.
,
Mar 13 2017
Cleaning up "Needs-Review" label as we are not using this label for triage anymore. Ref bug for this cleanup 684919
,
Jun 29 2017
,
Jun 29 2017
Sockets -> rkc@ for triage.
,
Jun 30 2017
|
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by sheriffbot@chromium.org
, Jun 22 2016