Regression: Google sheets/docs crashes on upgrading to latest 57.0.2938.0 dev |
||||||
Issue descriptionChrome Version: 57.0.2938.0 dev OS: Ubuntu 14.04,Windows What steps will reproduce the problem? (1)Upgrade to 57.0.2938.0 dev >> Open any google sheets/docs and observe Expected: Google sheets should not crash even when upgraded. Actual: Instead tab crash is seen on opening any sheet. This is a regression issue broken in M57. Good Build: 57.0.2937.0 dev Bad Build: 57.0.2938.0 dev Crash ids: 9c789a5f00000000 , b22d568f00000000
,
Dec 1 2016
Stack trace of the crash id:9c789a5f00000000 Thread 0 CRASHED [SIGILL @ 0x000055ddaa49dc77 ] MAGIC SIGNATURE THREAD Stack Quality82%Show frame trust levels 0x000055ddaa49dc77 (chrome -./out/Release/../../v8/include/v8.h:8435 ) <name omitted> 0x000055ddaa49d0a2 (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp:514 ) <name omitted> 0x000055ddaa478c4d (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:182 ) <name omitted> 0x000055ddaa48b88e (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8Binding.cpp:855 ) blink::toV8Context(blink::Frame*, blink::DOMWrapperWorld&) 0x000055ddaa47cd07 (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/ScriptState.cpp:98 ) <name omitted> 0x000055ddaa479c27 (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:420 ) <name omitted> 0x000055ddaa479de8 (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:402 ) <name omitted> 0x000055ddac173381 (chrome -./out/Release/../../third_party/WebKit/Source/core/dom/ScriptLoader.cpp:548 ) <name omitted> 0x000055ddac174783 (chrome -./out/Release/../../third_party/WebKit/Source/core/dom/ScriptLoader.cpp:433 ) <name omitted> 0x000055ddac173f98 (chrome -./out/Release/../../third_party/WebKit/Source/core/dom/ScriptLoader.cpp:105 ) <name omitted> 0x000055ddaa76f0e4 (chrome -./out/Release/../../third_party/WebKit/Source/core/dom/ContainerNode.cpp:237 ) <name omitted> 0x000055ddaa76e5b0 (chrome -./out/Release/../../third_party/WebKit/Source/core/dom/ContainerNode.cpp:660 ) <name omitted> 0x000055ddaa4de0cc (chrome -./out/Release/gen/blink/bindings/core/v8/V8Node.cpp:735 ) blink::NodeV8Internal::appendChildMethodCallbackForMainWorld(v8::FunctionCallbackInfo<v8::Value> const&) 0x000055dda7207745 (chrome -./out/Release/../../v8/src/api-arguments.cc:19 ) <name omitted> 0x000055dda7240239 (chrome -./out/Release/../../v8/src/builtins/builtins-api.cc:106 ) v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments) 0x000055dda723fb04 (chrome -./out/Release/../../v8/src/builtins/builtins-api.cc:135 ) v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*) 0x000023314b884426 0x000023314b9184b9 0x000023314b906f9c 0x000023314b917e39 0x000023314b906f9c 0x000023314b917e39 0x000023314b906f9c 0x000023314b885e54 0x000023314b906542 0x000023314b8b6360 0x000055dda7532125 (chrome -./out/Release/../../v8/src/execution.cc:139 ) v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*, v8::internal::Handle<v8::internal::Object>) 0x000055dda7531e84 (chrome -./out/Release/../../v8/src/execution.cc:176 ) <name omitted> 0x000055dda733ff38 (chrome -./out/Release/../../v8/src/api.cc:4996 ) <name omitted> 0x000055ddaa499b4f (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:638 ) blink::V8ScriptRunner::callFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*) 0x000055ddaa4b9388 (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp:111 ) <name omitted> 0x000055ddaa4ba35c (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:142 ) <name omitted> 0x000055ddaa4ba18f (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:101 ) <name omitted> 0x000055ddaa4b9e4a (chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:89 ) <name omitted> 0x000055ddaa8d7ab5 (chrome -./out/Release/../../third_party/WebKit/Source/core/events/EventTarget.cpp:691 ) <name omitted> 0x000055ddaa8d6f92 (chrome -./out/Release/../../third_party/WebKit/Source/core/events/EventTarget.cpp:554 ) <name omitted> 0x000055ddaa8cffeb (chrome -./out/Release/../../third_party/WebKit/Source/core/events/EventDispatcher.cpp:206 ) <name omitted> 0x000055ddaa8cf678 (chrome -./out/Release/../../third_party/WebKit/Source/core/events/EventDispatcher.cpp:59 ) <name omitted> 0x000055ddaac90983 (chrome -./out/Release/../../third_party/WebKit/Source/core/loader/FrameLoader.cpp:716 ) <name omitted> 0x000055ddaac90ba3 (chrome -./out/Release/../../third_party/WebKit/Source/core/loader/FrameLoader.cpp:753 ) <name omitted> 0x000055ddaac95c67 (chrome -./out/Release/../../third_party/WebKit/Source/core/loader/FrameLoader.cpp:630 ) <name omitted> 0x000055ddaa7a91ca (chrome -./out/Release/../../third_party/WebKit/Source/core/dom/Document.cpp:5277 ) <name omitted> 0x000055ddaaa3cc6a (chrome -./out/Release/../../third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:931 ) <name omitted> 0x000055ddaaa4039f (chrome -./out/Release/../../third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:525 ) <name omitted> 0x000055ddaaa3e471 (chrome -./out/Release/../../third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:612 ) <name omitted> 0x000055ddaaa3df1b (chrome -./out/Release/../../third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:1061 ) <name omitted> 0x000055dda862546d (chrome -./out/Release/../../base/callback.h:68 ) <name omitted> 0x000055ddaa3b3e78 (chrome -./out/Release/../../third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:359 ) <name omitted> 0x000055ddaa3b33ab (chrome -./out/Release/../../third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:251 ) <name omitted> 0x000055dda862546d (chrome -./out/Release/../../base/callback.h:68 ) <name omitted> 0x000055dda85bf4ff (chrome -./out/Release/../../base/message_loop/message_loop.cc:413 ) <name omitted> 0x000055dda85beff4 (chrome -./out/Release/../../base/message_loop/message_loop.cc:422 ) <name omitted> 0x000055dda85c0b84 (chrome -./out/Release/../../base/message_loop/message_pump_default.cc:33 ) base::MessagePumpDefault::Run(base::MessagePump::Delegate*) 0x000055dda85dc10f (chrome -./out/Release/../../base/run_loop.cc:35 ) <name omitted> 0x000055ddab2fd91d (chrome -./out/Release/../../content/renderer/renderer_main.cc:200 ) content::RendererMain(content::MainFunctionParams const&) 0x000055dda823f51b (chrome -./out/Release/../../content/app/content_main_runner.cc:344 ) content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*) 0x000055dda8240613 (chrome -./out/Release/../../content/app/content_main_runner.cc:786 ) content::ContentMainRunnerImpl::Run() 0x000055dda8240e3d (chrome -./out/Release/../../content/app/content_main.cc:20 ) content::ContentMain(content::ContentMainParams const&) 0x000055dda6f23f9c (chrome -./out/Release/../../chrome/app/chrome_main.cc:108 ) ChromeMain 0x00007f28d7a5eec4 (libc-2.19.so -libc-start.c:287 ) __libc_start_main 0x000055dda6f23e40 (chrome + 0x00b39e40 ) _start Top of the stack trace looks similar to Issue 669968 and matches to regression range. Suspected CL has been reverted and this probably would be fixed in next M-57 build. Keeping it open till next build to see the behavior.
,
Dec 1 2016
Seems like we are still missing crash symbols here. ivanpe@, could you please look into it? Thank you!
,
Dec 1 2016
Including Scott. Scott, I believe this is the same issue that is tracked by: https://bugs.chromium.org/p/chromium/issues/detail?id=627529 I thought it was fixed in dev channel, but apparently we are seeing this issue in Chrome Linux M57. Here is a sample report: http://crash/bd2c5a5f00000000
,
Dec 1 2016
That looks different to me. The thing I tried to fix was that we were reverting to stack scanning after the initial context. In http://crash/bd2c5a5f00000000 all frames down to the V8 JIT are CFI. I don't know why they're not symbolized though.
,
Dec 1 2016
I am able to reproduce this crash on Mac OS X 10.11.6 and Win 7/10 after updating to Latest Canary#57.0.2938.0. ivanpe@, do we have any other tracking bug for this Linux crash symbol issue? if not will create one. This crash looks very similar to crbug.com/669968, so i am planning to merge into that. Thank you!
,
Dec 1 2016
Sure, please file a new bug. Scott, do you mind taking a look a this? It looks like dump_syms was unable to read the function names. The offset of the instruction pointer (from the context record) withing chrome is 0x40B3C77 (0x000055ddaa49dc77-0x000055dda63ea000) Here is what I'm getting for function names around that offset: grep "FUNC 40b3" ~/symbols/chrome/EDE5B5F90B46A5B7FD9E3444FB361A350/chrome.sym FUNC 40b3360 43d 0 <name omitted> FUNC 40b37a0 232 0 <name omitted> FUNC 40b39e0 80 0 <name omitted> FUNC 40b3a60 219 0 <name omitted> FUNC 40b3c80 3ec 0 <name omitted> I can share the minidump in and the symbols that we have on the server with you? Or you can use the symbol extractor tool as described on this page: https://sites.google.com/a/google.com/crash/users/how-to/how-to-process-crash-reports-from-the-command-line
,
Dec 2 2016
Here is the tracking bug for missing crash symbols: https://bugs.chromium.org/p/chromium/issues/detail?id=670533 Thank you! |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by sc00335...@techmahindra.com
, Dec 1 20161.8 MB
1.8 MB View Download