Thanks for the crash report.

Update: 
1. Change in Bug Title: it's not overtime, its every time. 
2. Updated to the latest version of chrome, stable build. 
3. Re booted my mac too. 
4. Chrome is consistently crashing every time. 

Deleted: chrome-crash-latest.txt 88.6 KB

chrome-crash-latest.txt 88.6 KB View Download

Have you replaced the system font or have any unusual font management system?


Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       EXC_I386_GPFLT

Thread 0 Crashed:: CrBrowserMain  Dispatch queue: com.apple.main-thread
0   com.apple.CoreText            	0x00007fff8c1c0553 OpenTypeReorderingOutput::getStringIndex(long) const + 41
1   com.apple.CoreText            	0x00007fff8c1c1ac4 OpenTypeShapingEngine::ApplyScriptShaping(unsigned int*) + 850
2   com.apple.CoreText            	0x00007fff8c0f3289 void TOpenTypeMorph::ApplyShapingEngine<TInlineVector<unsigned int, 30ul> >(OTL::GSUB&, OTL::GlyphLookups&, unsigned int*, CFRange, TInlineVector<unsigned int, 30ul>&, bool&, SyncState&) + 617
3   com.apple.CoreText            	0x00007fff8c0f2918 TOpenTypeMorph::ShapeGlyphs(SyncState&) + 402
4   com.apple.CoreText            	0x00007fff8c0f8393 TShapingEngine::ShapeGlyphs(TLine&, TCharStream const*) + 295
5   com.apple.CoreText            	0x00007fff8c1472ff TTypesetter::FinishEncoding(std::__1::tuple<TLine const*, TCharStream const*, void const* (*)(__CTRun const*, __CFString const*, void*), void*, std::__1::shared_ptr<TBidiLevelsProvider>*, unsigned int, unsigned char> const&, TLine&, signed char) + 235
6   com.apple.CoreText            	0x00007fff8c0d159c TTypesetterAttrString::Initialize(__CFAttributedString const*) + 682
7   com.apple.CoreText            	0x00007fff8c0d0f62 CTLineCreateWithAttributedString + 63
8   com.google.Chrome.framework   	0x000000010851fc1c gfx::RenderTextMac::EnsureLayoutInternal(std::__1::basic_string<unsigned short, base::string16_char_traits, std::__1::allocator<unsigned short> > const&, base::ScopedTypeRef<__CFArray*, base::internal::ScopedCFTypeRefTraits<__CFArray*> >*) + render_text_mac.mm:296
9   com.google.Chrome.framework   	0x000000010851f9e3 gfx::RenderTextMac::EnsureLayout() + scoped_typeref.h:85
10  com.google.Chrome.framework   	0x000000010851eda9 gfx::RenderTextMac::GetStringSizeF() + render_text_mac.mm:104
11  com.google.Chrome.framework   	0x0000000108512f01 gfx::RenderText::Elide(std::__1::basic_string<unsigned short, base::string16_char_traits, std::__1::allocator<unsigned short> > const&, float, float, gfx::ElideBehavior) + size_f.h:30
12  com.google.Chrome.framework   	0x0000000108512281 gfx::RenderText::UpdateDisplayText(float) + string:1735
13  com.google.Chrome.framework   	0x000000010851f756 gfx::RenderTextMac::OnLayoutTextAttributeChanged(bool) + scoped_typeref.h:107
14  com.google.Chrome.framework   	0x000000010850f6e4 gfx::RenderText::OnTextAttributeChanged() + render_text.cc:1389
15  com.google.Chrome.framework   	0x000000010850ea00 gfx::RenderText::SetText(std::__1::basic_string<unsigned short, base::string16_char_traits, std::__1::allocator<unsigned short> > const&) + render_text.cc:477
16  com.google.Chrome.framework   	0x00000001085234ce gfx::ElideText(std::__1::basic_string<unsigned short, base::string16_char_traits, std::__1::allocator<unsigned short> > const&, gfx::FontList const&, float, gfx::ElideBehavior) + text_elider.cc:213
17  com.google.Chrome.framework   	0x000000010ad4f6e1 HistoryMenuBridge::AddItemToMenu(HistoryMenuBridge::HistoryItem*, NSMenu*, long, long) + history_menu_bridge.mm:293
18  com.google.Chrome.framework   	0x000000010ad4fd7e HistoryMenuBridge::OnVisitedHistoryResults(history::QueryResults*) + history_menu_bridge.mm:361
19  com.google.Chrome.framework   	0x000000010b8d38e1 base::internal::Invoker<base::IndexSequence<0ul>, base::internal::BindState<base::Callback<void (history::QueryResults*), (base::internal::CopyMode)1>, void (history::QueryResults*), base::internal::OwnedWrapper<history::QueryResults> >, base::internal::InvokeHelper<false, void, base::Callback<void (history::QueryResults*), (base::internal::CopyMode)1> >, void ()>::Run(base::internal::BindStateBase*) + callback_internal.h:108
20  com.google.Chrome.framework   	0x0000000107cbf47c (anonymous namespace)::RunIfNotCanceledThenUntrack(base::CancellationFlag const*, base::Callback<void (), (base::internal::CopyMode)1> const&, base::Callback<void (), (base::internal::CopyMode)1> const&) + callback.h:397
21  com.google.Chrome.framework   	0x0000000107cc98b9 base::(anonymous namespace)::PostTaskAndReplyRelay::RunReplyAndSelfDestruct() + post_task_and_reply_impl.cc:61
22  com.google.Chrome.framework   	0x0000000107c6fdfb base::debug::TaskAnnotator::RunTask(char const*, base::PendingTask const&) + callback.h:397
23  com.google.Chrome.framework   	0x0000000107c92613 base::MessageLoop::RunTask(base::PendingTask const&) + vector:640
24  com.google.Chrome.framework   	0x0000000107c9290c base::MessageLoop::DeferOrRunPendingTask(base::PendingTask const&) + message_loop.cc:487
25  com.google.Chrome.framework   	0x0000000107c92c6b base::MessageLoop::DoWork() + message_loop.cc:604
26  com.google.Chrome.framework   	0x0000000107c649ed base::MessagePumpCFRunLoopBase::RunWork() + message_pump_mac.mm:330
27  com.google.Chrome.framework   	0x0000000107c886da base::mac::CallWithEHFrame(void () block_pointer) + 
28  com.google.Chrome.framework   	0x0000000107c643f4 base::MessagePumpCFRunLoopBase::RunWorkSource(void*) + message_pump_mac.mm:309
29  com.apple.CoreFoundation      	0x00007fff97195881 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
30  com.apple.CoreFoundation      	0x00007fff97174fbc __CFRunLoopDoSources0 + 556
31  com.apple.CoreFoundation      	0x00007fff971744df __CFRunLoopRun + 927
32  com.apple.CoreFoundation      	0x00007fff97173ed8 CFRunLoopRunSpecific + 296
33  com.apple.HIToolbox           	0x00007fff93e8b935 RunCurrentEventLoopInMode + 235
34  com.apple.HIToolbox           	0x00007fff93e8b76f ReceiveNextEventCommon + 432
35  com.apple.HIToolbox           	0x00007fff93e8b5af _BlockUntilNextEventMatchingListInModeWithFilter + 71
36  com.apple.AppKit              	0x00007fff8426ddf6 _DPSNextEvent + 1067
37  com.apple.AppKit              	0x00007fff8426d226 -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454
38  com.apple.AppKit              	0x00007fff84261d80 -[NSApplication run] + 682
39  com.google.Chrome.framework   	0x0000000107c65216 base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) + message_pump_mac.mm:682
40  com.google.Chrome.framework   	0x0000000107c64844 base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) + message_pump_mac.mm:246
41  com.google.Chrome.framework   	0x0000000107caa4a1 base::RunLoop::Run() + run_loop.cc:36
42  com.google.Chrome.framework   	0x000000010778b055 ChromeBrowserMainParts::MainMessageLoopRun(int*) + chrome_browser_main.cc:1910
43  com.google.Chrome.framework   	0x000000010b1046e4 content::BrowserMainLoop::RunMainMessageLoopParts() + browser_main_loop.cc:974
44  com.google.Chrome.framework   	0x000000010b106bb2 content::BrowserMainRunnerImpl::Run() + memory:2724
45  com.google.Chrome.framework   	0x000000010b100a5d content::BrowserMain(content::MainFunctionParams const&) + browser_main.cc:46
46  com.google.Chrome.framework   	0x0000000107c220a0 content::ContentMainRunnerImpl::Run() + content_main_runner.cc:787
47  com.google.Chrome.framework   	0x0000000107c212e6 content::ContentMain(content::ContentMainParams const&) + content_main.cc:20
48  com.google.Chrome.framework   	0x00000001076ec57a ChromeMain + chrome_main.cc:84
49  com.google.Chrome             	0x0000000107482d42 main + chrome_exe_main_mac.c:91
50  com.google.Chrome             	0x0000000107482b24 start + 

Hi, 

Thanks for looking into the issue. I have not installed any new fonts. 
However, the issue is not reproducible now, after
1. Uninstalled chrome.
2. Cleared all files with app cleaner. 
3. Perform a fresh installation of chrome. 

OK, thanks for letting us know.

Based on the stack trace, it looks like a specific item in your history had a character in its title that was causing problems when trying to typeset it. Please ping this bug or file a new one if this problem returns.