Example URL:
See attached PDF

Steps to reproduce the problem:
1. Open attached PDF in chromium (e.g.: "chromium timeout") or run it with pdfium_fuzzer (e.g.: "pdfium_fuzzer timeout").
2. Wait and wait and wait.
3. Eventually give up on waiting for chromium or have pdfium_fuzzer timeout.

What is the expected behavior?
Something is displayed in a timely fashion like firefox or xpdf do.

What went wrong?
The pdfium_fuzzer timed out after the default timeout of 20 minutes. Then running the resulting pdf in chromium never renders the PDF for me (though I didn't wait much longer than 20 minutes).

Does it occur on multiple sites: No

Is it a problem with a plugin? N/A 

Did this work before? N/A 

Does this work in other browsers? Yes

Chrome version: 6a917fd8663e32b65066fee2afdb2d463ee357eb-refs/heads/master@{#449289}  Channel: n/a
OS Version: kernel 4.9.8 on Arch Linux
Flash Version: (Disabled)

Attached is the reproducer PDF. Here is the libfuzzer output from when pdfium_fuzzer times out:

ALARM: working on the last Unit for 1201 seconds
       and the timeout value is 1200 (use -timeout=N to change)
==7780== ERROR: libFuzzer: timeout after 1201 seconds
    #0 0x4d2d60 in __sanitizer_print_stack_trace (/home/joseph/chromium-fuzz/chromium/src/out/libfuzzer/pdfium_fuzzer+0x4d2d60)
    #1 0x5138f2 in fuzzer::Fuzzer::AlarmCallback() third_party/libFuzzer/src/FuzzerLoop.cpp:319:7
    #2 0x7f4ed383e07f  (/usr/lib/libpthread.so.0+0x1107f)
    #3 0x769adf in CPDF_MeshStream::GetVertexRow(CPDF_MeshVertex*, int, CFX_Matrix*) third_party/pdfium/core/fpdfapi/page/cpdf_meshstream.cpp:214:17
    #4 0x701462 in DrawLatticeGouraudShading third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:533:17
    #5 0x701462 in CPDF_RenderStatus::DrawShading(CPDF_ShadingPattern*, CFX_Matrix*, FX_RECT&, int, bool) third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:2079
    #6 0x702f5e in CPDF_RenderStatus::DrawShadingPattern(CPDF_ShadingPattern*, CPDF_PageObject const*, CFX_Matrix const*, bool) third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:2130:3
    #7 0x6ed62f in DrawPathWithPattern third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:2357:5
    #8 0x6ed62f in CPDF_RenderStatus::ProcessPathPattern(CPDF_PathObject*, CFX_Matrix const*, int&, bool&) third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:2367
    #9 0x6eb633 in CPDF_RenderStatus::ProcessPath(CPDF_PathObject*, CFX_Matrix const*) third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:1245:3
    #10 0x6e84d5 in CPDF_RenderStatus::ProcessObjectNoClip(CPDF_PageObject*, CFX_Matrix const*) third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:1133:14
    #11 0x6e4e0b in CPDF_RenderStatus::RenderSingleObject(CPDF_PageObject*, CFX_Matrix const*) third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:1054:3
    #12 0x6e453d in CPDF_RenderStatus::RenderObjectList(CPDF_PageObjectHolder const*, CFX_Matrix const*) third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:1026:5
    #13 0x6ecc37 in CPDF_RenderStatus::ProcessForm(CPDF_FormObject const*, CFX_Matrix const*) third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:1232:10
    #14 0x6e82f1 in CPDF_RenderStatus::ProcessObjectNoClip(CPDF_PageObject*, CFX_Matrix const*) third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:1142:14
    #15 0x6e8c79 in CPDF_RenderStatus::ContinueSingleObject(CPDF_PageObject*, CFX_Matrix const*, IFX_Pause*) third_party/pdfium/core/fpdfapi/render/cpdf_renderstatus.cpp:1095:3
    #16 0x6df48b in CPDF_ProgressiveRenderer::Continue(IFX_Pause*) third_party/pdfium/core/fpdfapi/render/cpdf_progressiverenderer.cpp:78:30
    #17 0x565db6 in (anonymous namespace)::RenderPageImpl(CPDF_PageRenderContext*, CPDF_Page*, CFX_Matrix const&, FX_RECT const&, int, bool, IFSDK_PAUSE_Adapter*) third_party/pdfium/fpdfsdk/fpdfview.cpp:115:26
    #18 0x565141 in FPDF_RenderPage_Retail third_party/pdfium/fpdfsdk/fpdfview.cpp:994:3
    #19 0x565141 in FPDF_RenderPageBitmap third_party/pdfium/fpdfsdk/fpdfview.cpp:728
    #20 0x4f8c09 in RenderPage pdf/pdfium/fuzzers/pdfium_fuzzer.cc:72:5
    #21 0x4f8c09 in RenderPdf pdf/pdfium/fuzzers/pdfium_fuzzer.cc:164
    #22 0x4f8c09 in LLVMFuzzerTestOneInput pdf/pdfium/fuzzers/pdfium_fuzzer.cc:220
    #23 0x516764 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:550:13
    #24 0x516f17 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long) third_party/libFuzzer/src/FuzzerLoop.cpp:501:3
    #25 0x4fa02a in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) third_party/libFuzzer/src/FuzzerDriver.cpp:268:6
    #26 0x4fefc0 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) third_party/libFuzzer/src/FuzzerDriver.cpp:517:9
    #27 0x521bf8 in main third_party/libFuzzer/src/FuzzerMain.cpp:20:10
    #28 0x7f4ed3298290 in __libc_start_main (/usr/lib/libc.so.6+0x20290)

SUMMARY: libFuzzer: timeout

 

Deleted: timeout-7af137a97c1fc4e84994f846269765d77c7df6f2 23.2 KB

timeout-7af137a97c1fc4e84994f846269765d77c7df6f2 23.2 KB View Download