nticompass@Could you please check the issue on latest dev 54.0.2824.0 and provide crash ID from chrome://crashes if issue still persists for further triaging the issue.

I installed Chrome Canary 54.0.2825.0 and opened one of the PDF files.  The PDF viewer crashed.

Opening chrome://crashes, I see the following Crash ID:
ba75743a-3cf8-4549-86ea-02a794a258d2

It also had the following Server ID:
Server ID: 50bbc38100000000

Is Report.pdf available somewhere?

BTW, the crash as seen on your terminal is useless because there's no debugging symbols. Every frame shows up as <unknown>.

If the PDF that triggers the crash can be attached to this bug, or perhaps shared with me via email, then I can verify any fixes we make actually works.

Note to self: See also crash id 1a94a38100000000

I realize that all the symbols say <unknown>, I guess the version of Chromium in Arch Linux doesn't have debugging symbols.

The PDF file contains private info, so I can't post it here.

I've emailed a PDF file to you that can hopefully help.

It is very helpful. The PDF hint table stream contains a value that's close to UINT_MAX. The PDFium code does not like that and just commits suicide. It's not obvious if the value is valid, and PDFium is interpreting it incorrectly, or if the PDF generator wrote out a bad value. Need to read the PDF spec a bit more to answer that question.

In any case, PDFium can definitely improve and handle this situation more gracefully. Since it's only a hint table, it is not required to load the PDF.

Assuming I read the spec correctly, the PDF generation software is writing out PDFs with bad values in the shared object hint table.

In the PDF 1.7 spec, Table F.6 says the entry we have with 4294967252 as the value should be interpreted as follows:

"A number that, when added to the least shared object group length (Table F.5,
item 6), gives the length of the object group in bytes."

The value to be added is 32, giving us 4294967284 bytes... The PDF isn't that big.

The crash looks something like the following from running pdfium_test.

#0  0x00007ffff695ec37 in __GI_raise (sig=sig@entry=6) at raise.c:56
#1  0x00007ffff6962028 in __GI_abort () at abort.c:89
#2  0x0000000000d50690 in pdfium::base::checked_cast<int, unsigned int> (value=4294967273) at third_party/base/numerics/safe_conversions.h:29
#3  0x0000000000d4f747 in CPDF_HintTables::ReadSharedObjHintTable (this=0x1d36080, hStream=0x7fffffffcea0, offset=412) at core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp:309
#4  0x0000000000d500c3 in CPDF_HintTables::LoadHintStream (this=0x1d36080, pHintStream=0x1d35c80) at core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp:458
#5  0x0000000000d3b6df in CPDF_DataAvail::CheckHintTables (this=0x1d3ac50, pHints=0x7fffffffd138) at core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp:779
#6  0x0000000000d3a450 in CPDF_DataAvail::CheckDocStatus (this=0x1d3ac50, pHints=0x7fffffffd138) at core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp:276
#7  0x0000000000d3a397 in CPDF_DataAvail::IsDocAvail (this=0x1d3ac50, pHints=0x7fffffffd138) at core/fpdfapi/fpdf_parser/cpdf_data_avail.cpp:213
#8  0x0000000000cab02c in FPDFAvail_IsDocAvail (avail=0x1d38400, hints=0x7fffffffd2b0) at fpdfsdk/fpdf_dataavail.cpp:129

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/e5d65196d13bbea473bd8c8b0cc481e12155543f

commit e5d65196d13bbea473bd8c8b0cc481e12155543f
Author: thestig <thestig@chromium.org>
Date: Fri Aug 12 04:09:23 2016

Roll PDFium 85af2a3..d0b6ed1

https://pdfium.googlesource.com/pdfium.git/+log/85af2a3..d0b6ed1

BUG= 603489 , 635565 , 635663 
TBR=ochang@chromium.org

Review-Url: https://codereview.chromium.org/2237223003
Cr-Commit-Position: refs/heads/master@{#411548}

[modify] https://crrev.com/e5d65196d13bbea473bd8c8b0cc481e12155543f/DEPS

Will be fixed in 54.0.2828.0 and newer.

 Issue 654708  has been merged into this issue.