Thanks for reporting romi007r@gmail.com. Could you clarify a little more when this crash happens?  When you are starting chrome or when you're visiting certain website?

Acordding to the dmp file, it seems chrome failed at parsing some commandline argument. Are you aware any customized command line argument you used when start chrome?

hi thanks for the reply i used drmemory for initiating the crash 

after crashing its asked to debug the application when checked with windbg and analysis it gives 

User mode write access violations that are not near NULL are exploitable.
MEMORY_CORRUPTION_LARGE_EXPLOITABLE
 results 
it generates an additional dump file at 

C:\Users\AppData\Local\Google\Chrome\User Data\Crashpad\reports

after this i am able to execute the setup but chrome doesnt open 

this can be considered as the command line 
as one of the test cases 
drmemory.exe  "c:\Program Files (x86)\Google\Chrome\Application\chrome.exe"  "c:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\52.0.2743.116.manifest" 

More digging... This crash seems to happen in drmemory instead of chrome. I found a couple of similar crashes in drmemory issues. https://github.com/DynamoRIO/drmemory/search?q=NtMapViewOfSection&type=Issues&utf8=%E2%9C%93

yes attached crash happened in chrome for the same issues generated 

crashes 
 chrome 

FAILURE_IMAGE_NAME:  chrome_child.dll

User Mode Write AV near NULL starting at chrome_child!ChromeMain+0x0000000000e6aac3 (Hash=0x4a0f3d1e.0x205c0201)

Deleted: 6c0c6835-7a1b-4f5b-bd60-a1cb3c3464e8.dmp 163 KB

6c0c6835-7a1b-4f5b-bd60-a1cb3c3464e8.dmp 163 KB Download

attached are the files in Crashed.zip which cause crash enable appverifier for chrome.exe all tests and start fuzzing with minifuzz  dump and debug diag results are also shared interesting summary 

1. In 276bd086-2c0c-4da1-8a26-5723bb5e6336.dmp the assembly instruction at chrome_7fed2000000!base::debug::BreakDebugger+d in C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome.dll from Google Inc. has caused a breakpoint exception (0x80000003) on thread 0
 Please follow up with the vendor Google Inc. for C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\chrome.dll
 
Detected a serious critical section related problem  in 276bd086-2c0c-4da1-8a26-5723bb5e6336.dmp
Lock at 0x01a41d80 is Uninitialized

Impact analysis

3.57% of threads blocked
 


2. ntdll!ZwWaitForSingleObject+a 
ntdll!RtlpWaitOnCriticalSection+e8 
ntdll!RtlEnterCriticalSection+d1 
verifier!AVrfDebugPageHeapAllocate+12e 
ntdll!RtlDebugAllocateHeap+31 
ntdll!RtlpAllocateHeap+114 
ntdll!RtlAllocateHeap+16c 
vrfcore!VfCoreRtlAllocateHeap+36 
vfbasics!AVrfpRtlAllocateHeap+108 
chrome_7fed2000000!malloc+2f 
chrome_7fed2000000!utext_setup_56+52 
chrome_7fed2000000!utext_openUChars_56+4b 
chrome_7fed2000000!icu_56::RuleBasedBreakIterator::init+24 
chrome_7fed2000000!icu_56::RuleBasedBreakIterator::RuleBasedBreakIterator+2f 
chrome_7fed2000000!icu_56::BreakIterator::buildInstance+1fd 
chrome_7fed2000000!icu_56::BreakIterator::makeInstance+236 
chrome_7fed2000000!icu_56::BreakIterator::createInstance+dd 
chrome_7fed2000000!ubrk_open_56+111 
chrome_7fed2000000!base::i18n::BreakIterator::Init+a2 
chrome_7fed2000000!query_parser::QueryParser::ParseQueryImpl+71 
chrome_7fed2000000!query_parser::QueryParser::ParseQueryWords+2e 
chrome_7fed2000000!bookmarks::BookmarkIndex::ExtractQueryWords+9f 
chrome_7fed2000000!bookmarks::BookmarkIndex::Add+cd 
chrome_7fed2000000!bookmarks::`anonymous namespace'::AddBookmarksToIndex+33 
chrome_7fed2000000!bookmarks::`anonymous namespace'::AddBookmarksToIndex+58 
chrome_7fed2000000!bookmarks::`anonymous namespace'::LoadCallback+278 
chrome_7fed2000000!base::internal::Invoker<base::IndexSequence<0,1,2,3>,base::internal::BindState<base::internal::RunnableAdapter<void (__cdecl*)(base::FilePath const & __ptr64,base::WeakPtr<bookmarks::BookmarkStorage> const & __ptr64,std::unique_ptr<bookmarks::BookmarkLoadDetails,std::default_delete<bookmarks::BookmarkLoadDetails> >,base::SequencedTaskRunner * __ptr64)>,void __cdecl(base::FilePath const & __ptr64,base::WeakPtr<bookmarks::BookmarkStorage> const & __ptr64,std::unique_ptr<bookmarks::BookmarkLoadDetails,std::default_delete<bookmarks::BookmarkLoadDetails> >,base::SequencedTaskRunner * __ptr64),base::FilePath const & __ptr64,base::WeakPtr<bookmarks::BookmarkStorage>,base::internal::PassedWrapper<std::unique_ptr<bookmarks::BookmarkLoadDetails,std::default_delete<bookmarks::BookmarkLoadDetails> > >,base::internal::RetainedRefWrapper<base::SequencedTaskRunner> >,base::internal::InvokeHelper<0,void,base::internal::RunnableAdapter<void (__cdecl*)(base::FilePath const & __ptr64,base::WeakPtr<bookmarks::BookmarkStorage> const & __ptr64,std::unique_ptr<bookmarks::BookmarkLoadDetails,std::default_delete<bookmarks::BookmarkLoadDetails> >,base::SequencedTaskRunner * __ptr64)> >,void __cdecl(void)>::Run+42 
chrome_7fed2000000!base::SequencedWorkerPool::Inner::ThreadLoop+593 
chrome_7fed2000000!base::SequencedWorkerPool::Worker::Run+44 
chrome_7fed2000000!base::SimpleThread::ThreadMain+91 
chrome_7fed2000000!base::`anonymous namespace'::ThreadFunc+160 
vfbasics!AVrfpStandardThreadFunction+4d 
KERNEL32!BaseThreadInitThunk+d 
ntdll!RtlUserThreadStart+1d 

 

Deleted: 276bd086-2c0c-4da1-8a26-5723bb5e6336.dmp 10.7 MB

276bd086-2c0c-4da1-8a26-5723bb5e6336.dmp 10.7 MB Download

Deleted: CRASHED.ZIP 3.9 KB

CRASHED.ZIP 3.9 KB Download

Deleted: 276bd086-2c0c-4da1-8a26-5723bb5e6336_CrashHangAnalysis.mht 649 KB

276bd086-2c0c-4da1-8a26-5723bb5e6336_CrashHangAnalysis.mht 649 KB Download

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" C:\Users\310222344\Desktop\minifuzz\temp\all_6c-bds4ngdayzjro0-4.html 


above is the command line used for fuzz

Please provide the reproducible testcase to reproduce this. Will reopen if you can provide one.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot