New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 670243 link

Starred by 2 users

Issue metadata

Status: Duplicate
Owner: ----
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Regression: Google sheets/docs crashes on upgrading to latest 57.0.2938.0 dev

Project Member Reported by sc00335...@techmahindra.com, Dec 1 2016

Issue description

Chrome Version: 57.0.2938.0 dev 
OS: Ubuntu 14.04,Windows

What steps will reproduce the problem?
(1)Upgrade to 57.0.2938.0 dev >> Open any google sheets/docs and observe

Expected: Google sheets should not crash even when upgraded.
Actual: Instead tab crash is seen on opening any sheet.

This is a regression issue broken in M57.

Good Build: 57.0.2937.0 dev 
Bad Build: 57.0.2938.0 dev 

Crash ids: 9c789a5f00000000 , b22d568f00000000


 
NOTE: Issue is fine on fresh installation.

Attaching video for reference.
Actual_sheets_docs.ogv
1.8 MB View Download

Comment 2 by ajha@chromium.org, Dec 1 2016

Labels: OS-Linux
Status: Untriaged (was: Unconfirmed)
Stack trace of the crash id:9c789a5f00000000 

Thread 0 CRASHED [SIGILL @ 0x000055ddaa49dc77 ] MAGIC SIGNATURE THREAD
Stack Quality82%Show frame trust levels
0x000055ddaa49dc77	(chrome -./out/Release/../../v8/include/v8.h:8435 )	<name omitted>
0x000055ddaa49d0a2	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp:514 )	<name omitted>
0x000055ddaa478c4d	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:182 )	<name omitted>
0x000055ddaa48b88e	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8Binding.cpp:855 )	blink::toV8Context(blink::Frame*, blink::DOMWrapperWorld&)
0x000055ddaa47cd07	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/ScriptState.cpp:98 )	<name omitted>
0x000055ddaa479c27	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:420 )	<name omitted>
0x000055ddaa479de8	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp:402 )	<name omitted>
0x000055ddac173381	(chrome -./out/Release/../../third_party/WebKit/Source/core/dom/ScriptLoader.cpp:548 )	<name omitted>
0x000055ddac174783	(chrome -./out/Release/../../third_party/WebKit/Source/core/dom/ScriptLoader.cpp:433 )	<name omitted>
0x000055ddac173f98	(chrome -./out/Release/../../third_party/WebKit/Source/core/dom/ScriptLoader.cpp:105 )	<name omitted>
0x000055ddaa76f0e4	(chrome -./out/Release/../../third_party/WebKit/Source/core/dom/ContainerNode.cpp:237 )	<name omitted>
0x000055ddaa76e5b0	(chrome -./out/Release/../../third_party/WebKit/Source/core/dom/ContainerNode.cpp:660 )	<name omitted>
0x000055ddaa4de0cc	(chrome -./out/Release/gen/blink/bindings/core/v8/V8Node.cpp:735 )	blink::NodeV8Internal::appendChildMethodCallbackForMainWorld(v8::FunctionCallbackInfo<v8::Value> const&)
0x000055dda7207745	(chrome -./out/Release/../../v8/src/api-arguments.cc:19 )	<name omitted>
0x000055dda7240239	(chrome -./out/Release/../../v8/src/builtins/builtins-api.cc:106 )	v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::BuiltinArguments)
0x000055dda723fb04	(chrome -./out/Release/../../v8/src/builtins/builtins-api.cc:135 )	v8::internal::Builtin_Impl_HandleApiCall(v8::internal::BuiltinArguments, v8::internal::Isolate*)
0x000023314b884426		
0x000023314b9184b9		
0x000023314b906f9c		
0x000023314b917e39		
0x000023314b906f9c		
0x000023314b917e39		
0x000023314b906f9c		
0x000023314b885e54		
0x000023314b906542		
0x000023314b8b6360		
0x000055dda7532125	(chrome -./out/Release/../../v8/src/execution.cc:139 )	v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, bool, v8::internal::Handle<v8::internal::Object>, v8::internal::Handle<v8::internal::Object>, int, v8::internal::Handle<v8::internal::Object>*, v8::internal::Handle<v8::internal::Object>)
0x000055dda7531e84	(chrome -./out/Release/../../v8/src/execution.cc:176 )	<name omitted>
0x000055dda733ff38	(chrome -./out/Release/../../v8/src/api.cc:4996 )	<name omitted>
0x000055ddaa499b4f	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8ScriptRunner.cpp:638 )	blink::V8ScriptRunner::callFunction(v8::Local<v8::Function>, blink::ExecutionContext*, v8::Local<v8::Value>, int, v8::Local<v8::Value>*, v8::Isolate*)
0x000055ddaa4b9388	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8EventListener.cpp:111 )	<name omitted>
0x000055ddaa4ba35c	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:142 )	<name omitted>
0x000055ddaa4ba18f	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:101 )	<name omitted>
0x000055ddaa4b9e4a	(chrome -./out/Release/../../third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp:89 )	<name omitted>
0x000055ddaa8d7ab5	(chrome -./out/Release/../../third_party/WebKit/Source/core/events/EventTarget.cpp:691 )	<name omitted>
0x000055ddaa8d6f92	(chrome -./out/Release/../../third_party/WebKit/Source/core/events/EventTarget.cpp:554 )	<name omitted>
0x000055ddaa8cffeb	(chrome -./out/Release/../../third_party/WebKit/Source/core/events/EventDispatcher.cpp:206 )	<name omitted>
0x000055ddaa8cf678	(chrome -./out/Release/../../third_party/WebKit/Source/core/events/EventDispatcher.cpp:59 )	<name omitted>
0x000055ddaac90983	(chrome -./out/Release/../../third_party/WebKit/Source/core/loader/FrameLoader.cpp:716 )	<name omitted>
0x000055ddaac90ba3	(chrome -./out/Release/../../third_party/WebKit/Source/core/loader/FrameLoader.cpp:753 )	<name omitted>
0x000055ddaac95c67	(chrome -./out/Release/../../third_party/WebKit/Source/core/loader/FrameLoader.cpp:630 )	<name omitted>
0x000055ddaa7a91ca	(chrome -./out/Release/../../third_party/WebKit/Source/core/dom/Document.cpp:5277 )	<name omitted>
0x000055ddaaa3cc6a	(chrome -./out/Release/../../third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:931 )	<name omitted>
0x000055ddaaa4039f	(chrome -./out/Release/../../third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:525 )	<name omitted>
0x000055ddaaa3e471	(chrome -./out/Release/../../third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:612 )	<name omitted>
0x000055ddaaa3df1b	(chrome -./out/Release/../../third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp:1061 )	<name omitted>
0x000055dda862546d	(chrome -./out/Release/../../base/callback.h:68 )	<name omitted>
0x000055ddaa3b3e78	(chrome -./out/Release/../../third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:359 )	<name omitted>
0x000055ddaa3b33ab	(chrome -./out/Release/../../third_party/WebKit/Source/platform/scheduler/base/task_queue_manager.cc:251 )	<name omitted>
0x000055dda862546d	(chrome -./out/Release/../../base/callback.h:68 )	<name omitted>
0x000055dda85bf4ff	(chrome -./out/Release/../../base/message_loop/message_loop.cc:413 )	<name omitted>
0x000055dda85beff4	(chrome -./out/Release/../../base/message_loop/message_loop.cc:422 )	<name omitted>
0x000055dda85c0b84	(chrome -./out/Release/../../base/message_loop/message_pump_default.cc:33 )	base::MessagePumpDefault::Run(base::MessagePump::Delegate*)
0x000055dda85dc10f	(chrome -./out/Release/../../base/run_loop.cc:35 )	<name omitted>
0x000055ddab2fd91d	(chrome -./out/Release/../../content/renderer/renderer_main.cc:200 )	content::RendererMain(content::MainFunctionParams const&)
0x000055dda823f51b	(chrome -./out/Release/../../content/app/content_main_runner.cc:344 )	content::RunZygote(content::MainFunctionParams const&, content::ContentMainDelegate*)
0x000055dda8240613	(chrome -./out/Release/../../content/app/content_main_runner.cc:786 )	content::ContentMainRunnerImpl::Run()
0x000055dda8240e3d	(chrome -./out/Release/../../content/app/content_main.cc:20 )	content::ContentMain(content::ContentMainParams const&)
0x000055dda6f23f9c	(chrome -./out/Release/../../chrome/app/chrome_main.cc:108 )	ChromeMain
0x00007f28d7a5eec4	(libc-2.19.so -libc-start.c:287 )	__libc_start_main
0x000055dda6f23e40	(chrome + 0x00b39e40 )	_start

Top of the stack trace looks similar to Issue 669968 and matches to regression range. Suspected CL has been reverted and this probably would be fixed in next M-57 build. Keeping it open till next build to see the behavior.

Cc: ivanpe@chromium.org
Seems like we are still missing crash symbols here. ivanpe@, could you please look into it?

Thank you!
Cc: scottmg@chromium.org
Including Scott.

Scott, I believe this is the same issue that is tracked by: https://bugs.chromium.org/p/chromium/issues/detail?id=627529

I thought it was fixed in dev channel, but apparently we are seeing this issue in Chrome Linux M57.

Here is a sample report: http://crash/bd2c5a5f00000000
That looks different to me. The thing I tried to fix was that we were reverting to stack scanning after the initial context. In http://crash/bd2c5a5f00000000 all frames down to the V8 JIT are CFI. I don't know why they're not symbolized though.
Labels: OS-Mac OS-Windows
I am able to reproduce this crash on Mac OS X 10.11.6 and Win 7/10 after updating to Latest Canary#57.0.2938.0.

ivanpe@, do we have any other tracking bug for this Linux crash symbol issue? if not will create one. This crash looks very similar to crbug.com/669968, so i am planning to merge into that.

Thank you!
Sure, please file a new bug.

Scott, do you mind taking a look a this?  It looks like dump_syms was unable to read the function names.

The offset of the instruction pointer (from the context record) withing chrome is 0x40B3C77 (0x000055ddaa49dc77-0x000055dda63ea000)

Here is what I'm getting for function names around that offset:

grep "FUNC 40b3" ~/symbols/chrome/EDE5B5F90B46A5B7FD9E3444FB361A350/chrome.sym 
FUNC 40b3360 43d 0 <name omitted>
FUNC 40b37a0 232 0 <name omitted>
FUNC 40b39e0 80 0 <name omitted>
FUNC 40b3a60 219 0 <name omitted>
FUNC 40b3c80 3ec 0 <name omitted> 

I can share the minidump in and the symbols that we have on the server with you?  Or you can use the symbol extractor tool as described on this page: https://sites.google.com/a/google.com/crash/users/how-to/how-to-process-crash-reports-from-the-command-line

Mergedinto: 669968
Status: Duplicate (was: Untriaged)
Here is the tracking bug for missing crash symbols: https://bugs.chromium.org/p/chromium/issues/detail?id=670533

Thank you!

Sign in to add a comment