New issue
Advanced search Search tips

Issue 691935 link

Starred by 5 users

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

Profile viewer crashing upon loading second profile

Reported by ken...@corp.sandstorm.io, Feb 14 2017

Issue description

UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.21 Safari/537.36

Steps to reproduce the problem:
1. Load a ~500MB heap profile from Node.js into the profile viewer.
2. Load another profile taken from the same process at a different time.

What is the expected behavior?
Profile loads and I can compare them.

What went wrong?
Crashes. Sometimes, crashes repeatedly in rapid succession, with no further input from me.

I happened to be running Chrome from a terminal so was able to get some crash dump IDs, although weirdly they all end in a lot of zeros which makes me wonder if they are somehow corrupt.

Crash dump id: bc5f4a3580000000 
Crash dump id: d081265280000000 
Crash dump id: c0cf4a3580000000 
Crash dump id: 37c0e4b040000000 
Crash dump id: 77c0e4b040000000 
Crash dump id: e881265280000000 
Crash dump id: 96b0ca3580000000 
Crash dump id: ca15a4b040000000 
Crash dump id: 0a77a4b040000000 
Crash dump id: 1be6265280000000 
Crash dump id: b13e265280000000 
Crash dump id: 6eb0ca3580000000 
Crash dump id: 625b265280000000 
Crash dump id: 87e6265280000000 
Crash dump id: fc96265280000000 
Crash dump id: c688ca3580000000 
Crash dump id: 9014ca3580000000 
Crash dump id: 7dcd3cb040000000

Did this work before? N/A 

Chrome version: 57.0.2987.21  Channel: n/a
OS Version: 4.9.0-1-amd64 Debian 4.9.6-3 (2017-01-28)
Flash Version: N/A

I have three profiles, each around 570MB. Loading *any two*, in any order, fails. Chrome crashes early on while loading the second profile. The first progress indicator seems to get to about 15% and then it crashes.

I don't think it's OOM because after loading the first profile the process is only using about 1GB of RAM with 51GB available (64GB total).

The profiles are taken from a Node.js 4.7.2 server process over the course of several hours.

Unfortunately these profiles are from production so I probably can't share the data.

 
Labels: Needs-Triage-M57

Comment 2 by l...@chromium.org, Feb 14 2017

Components: Platform>DevTools>Memory
Owner: alph@chromium.org
Status: Assigned (was: Unconfirmed)
Thank you for the report.  Those crash dump ids correspond to partitionOutOfMemory exceptions.  @alph, could you please take a look?
Just now I tried to load up a 700MB heapsnapshot and hit this:

An error occurred when a call to method 'buildSnapshot' was requested
RangeError: Array buffer allocation failed
    at new ArrayBuffer (<anonymous>)
    at new Uint8Array (native)
    at HeapSnapshotWorker.JSHeapSnapshot._buildPostOrderIndex (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https://chrome-devtools-frontend.appspot.com/serve_file/@ea2ea29d648ff1eddde17a09074e3ba943a21fd5/&can_dock=true&dockSide=undocked:969:702)
    at HeapSnapshotWorker.JSHeapSnapshot.initialize (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https://chrome-devtools-frontend.appspot.com/serve_file/@ea2ea29d648ff1eddde17a09074e3ba943a21fd5/&can_dock=true&dockSide=undocked:897:2591)
    at new HeapSnapshotWorker.JSHeapSnapshot (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https://chrome-devtools-frontend.appspot.com/serve_file/@ea2ea29d648ff1eddde17a09074e3ba943a21fd5/&can_dock=true&dockSide=undocked:1093:387)
    at HeapSnapshotWorker.HeapSnapshotLoader.buildSnapshot (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https://chrome-devtools-frontend.appspot.com/serve_file/@ea2ea29d648ff1eddde17a09074e3ba943a21fd5/&can_dock=true&dockSide=undocked:1203:85)
    at HeapSnapshotWorker.HeapSnapshotWorkerDispatcher.dispatchMessage (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https://chrome-devtools-frontend.appspot.com/serve_file/@ea2ea29d648ff1eddde17a09074e3ba943a21fd5/&can_dock=true&dockSide=undocked:1253:509)

But on a second attempt, it worked.

Is there some artificial limit being applied to the RAM usage of the profile viewer?

Comment 4 by wscha...@gmail.com, Feb 17 2017

I have encountered this issue as well. I take a heap snapshot of a tab with high memory utilization (~900MB), and it fails during "Building postorder index"

Console:

An error occurred when a call to method 'buildSnapshot' was requested
TypeError: Cannot read property '546318' of undefined
    at HeapSnapshotWorker.JSHeapSnapshotNode.name (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https….appspot.com/serve_file/@0e9a9a6f3676ae439b78cd9b3f62b4193c3ac7d5/:740:122)
    at HeapSnapshotWorker.JSHeapSnapshot._buildPostOrderIndex (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https….appspot.com/serve_file/@0e9a9a6f3676ae439b78cd9b3f62b4193c3ac7d5/:505:119)
    at HeapSnapshotWorker.JSHeapSnapshot.initialize (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https…appspot.com/serve_file/@0e9a9a6f3676ae439b78cd9b3f62b4193c3ac7d5/:425:2591)
    at new HeapSnapshotWorker.JSHeapSnapshot (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https….appspot.com/serve_file/@0e9a9a6f3676ae439b78cd9b3f62b4193c3ac7d5/:680:240)
    at HeapSnapshotWorker.HeapSnapshotLoader.buildSnapshot (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https…d.appspot.com/serve_file/@0e9a9a6f3676ae439b78cd9b3f62b4193c3ac7d5/:626:85)
    at HeapSnapshotWorker.HeapSnapshotWorkerDispatcher.dispatchMessage (chrome-devtools://devtools/bundled/heap_snapshot_worker.js?remoteBase=https….appspot.com/serve_file/@0e9a9a6f3676ae439b78cd9b3f62b4193c3ac7d5/:676:509)
Labels: Needs-Feedback
kenton@corp.sandstorm.io: Could you please help if you have sample files which can be shared to reproduce the crash and Crash Ids by the latest relevant to this to investigate it further. 
Sorry, but as I mentioned before, all my examples are from our live production servers and thus may contain PII of our users, so I cannot share them.

Comment 7 by wscha...@gmail.com, Feb 27 2017

The problem is that the the code path reached by the initialize method of
JSHeapSnapshot accesses a member _lazyStringCache before it is initialized.

Constructor of JSHeapSnapshot initializes its _lazyStringCache here:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/devtools/front_end/heap_snapshot_worker/HeapSnapshot.js?dr=CSs&l=2418
But the call to initialize() is the line before it.

Please assign to pfeldman, as the errors are in code he added in December
in this commit:
https://chromium.googlesource.com/chromium/src/+/2d6dcff9ac896f34b48945276029371eacbecc6a%5E%21/third_party/WebKit/Source/devtools/front_end/heap_snapshot_worker/HeapSnapshot.js

Comment 8 by alph@chromium.org, Feb 27 2017

The problem in comment 4 seems to be unrelated to the original one which is pure OOM. I'll take care of it.

Comment 9 by wscha...@gmail.com, Feb 28 2017

It does _seem_ unrelated, but heap profiles on small sites work just fine.
This only crashes on my memory-hog app. Looking at it, it seems as though
it should always crash in that code path, but maybe that path isn't getting
hit on small snapshots?

Comment 10 by co...@streak.com, May 9 2017

I'm experiencing the issue from comment 4 too in Chrome 59.0.3071.36 with about the same stacktrace (slightly different line numbers).

A dependable way to trigger the issue is to pick Memory -> Take Heap Snapshot within Gmail with the Streak chrome extension installed (completing the sign-in to Streak within Gmail is not necessary first to reproduce the issue).

I agree with comment 7 that issue seems to be because in HeapSnapshotWorker.JSHeapSnapshot's constructor, `this._lazyStringCache = {}` needs to be moved up a line to run before `this.initialize()` instead of after. Making this change with a second devtools window while I'm taking a heap snapshot of gmail+streak causes the heap snapshot to work.
Project Member

Comment 11 by bugdroid1@chromium.org, May 18 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/dd5a66b4a00a250bcf9476bd373544c4d75bd81c

commit dd5a66b4a00a250bcf9476bd373544c4d75bd81c
Author: alph <alph@chromium.org>
Date: Thu May 18 03:46:02 2017

DevTools: fix exception on heap snapshot error reporting.

The debug log may access node.name() property during initialize method.
Make sure the cache is allocated.

BUG= 691935 

Review-Url: https://codereview.chromium.org/2884403002
Cr-Commit-Position: refs/heads/master@{#472647}

[modify] https://crrev.com/dd5a66b4a00a250bcf9476bd373544c4d75bd81c/third_party/WebKit/Source/devtools/front_end/heap_snapshot_worker/HeapSnapshot.js

Comment 12 by alph@chromium.org, Oct 20 2017

Status: Fixed (was: Assigned)

Sign in to add a comment