New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 757446 link

Starred by 3 users

Issue metadata

Status: Duplicate
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 1
Type: Bug-Regression



Sign in to add a comment

Overflow on unicode of symbol

Reported by jaydipmo...@gmail.com, Aug 21 2017

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.101 Safari/537.36

Steps to reproduce the problem:
1. Make a html page or visit a browser with the unicode symbol just pasted into a very very large paragraph.

The unicode symbol is ৣ

What is the expected behavior?
the page should display the page with all the symbols as per usual.

What went wrong?
The browser keeps overflowing on the unicode symbol making it load forever or crash.

Crashed report ID: No

How much crashed? Just one tab

Is it a problem with a plugin? No 

Did this work before? N/A 

Chrome version: 60.0.3112.101  Channel: stable
OS Version: 10.0
Flash Version: Shockwave Flash 26.0 r0

here's a pastebin paste that contains the symbol spammed, it crashes the browser. 
https://pastebin.com/8wK1x27k
 
Labels: Needs-Triage-M60
Cc: pnangunoori@chromium.org
Labels: Needs-Feedback
Tested on latest Stable #60.0.3112.101 and Canary #62.0.3192.0 on Windows 7 and Windows 10 and unable to reproduce the issue mentioned. Please refer the screencast attached.

@jaydipmodhwadia52-- Could you please try by removing the extensions and creating a new profile to verify if the issue still persists.

Please let us know if we have missed anything. Or please provide the sample html file where we can reproduce the issue. This would help us in reproducing and triaging the issue.

Thanks in advance.

757446.webm
9.0 MB View Download

Comment 3 by spenso...@gmail.com, Aug 22 2017

Try visiting this page. https://steamcommunity.com/groups/cheatgiveaways
Yes, that link crashes for me too.. it has the same text...
Project Member

Comment 5 by sheriffbot@chromium.org, Aug 22 2017

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding requester "pnangunoori@chromium.org" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Cc: -pnangunoori@chromium.org
Owner: pnangunoori@chromium.org
Components: Internals>Network>Certificate Internals>Network>CertTrans
Labels: -Type-Bug -Pri-2 hasbisect-per-revision M-62 OS-Linux OS-Mac Pri-1 Type-Bug-Regression
Owner: rsleevi@chromium.org
Status: Assigned (was: Unconfirmed)
Able to reproduce the issue on Windows 10, Ubuntu 14.04 and Mac 10.12.6 using chrome stable version #60.0.3112.101 and latest canary #62.0.3193.0.

Bisect Information:
=====================
Good build: 56.0.2916.0	 Revision(431463)
Bad Build : 56.0.2917.0	 Revision(431726)

Change Log URL: 
https://chromium.googlesource.com/chromium/src/+log/6d47d44ba4c0ba026223adb94d7f236fbc5efa22..ec8e431e9a0f80ace76368ce7edce006f3d409f2

From the above change log suspecting below change
Review URL: https://codereview.chromium.org/2495583002

rsleevi@ - Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks...!!

Comment 8 by spenso...@gmail.com, Aug 23 2017

I tested some versions I could access.

52.0.2743.83 (64-bit) Hang without Rendering.
51.0.2704.84 (64-bit) Hang after rendering top portion of page.
50.0.2661.75 (64-bit) and earlier renders page entirely no hanging.

It appears the issue showed up between 50.0.2661.75 and 51.0.2704.84
Components: -Internals>Network>CertTrans -Internals>Network>Certificate
Owner: krajshree@chromium.org
Status: Untriaged (was: Assigned)
There's no way this CL is related. Assigning back for triage - suspect the bisect stopping there was entirely unrelated, and may be worth bisecting again
Labels: -hasbisect-per-revision Needs-Bisect
Components: Blink>Layout
Labels: -Needs-Bisect hasbisect-per-revision
Owner: kojii@chromium.org
Status: Assigned (was: Untriaged)
spenson66@ - Thanks for more clarification...!!

Able to reproduce the issue on Windows 10, Ubuntu 14.04 and Mac 10.12.6 using chrome stable version #60.0.3112.101 and latest canary #62.0.3193.0.

Bisect Information:
=====================
Good build: 51.0.2702.0  Revision(385602)
Bad Build : 51.0.2703.0	 Revision(385938)

Change Log URL: 
https://chromium.googlesource.com/chromium/src/+log/3960b8b282030a4f91059cf25d6b01c8beab57b8..d12b58ef0005d24dff2047f566f5ff5a5f2e45fb

From the above change log suspecting below change
Review URL: https://codereview.chromium.org/1766243003

kojii@ - Could you please check whether this is caused with respect to your change, if not please help us in assigning it to the right owner.

Thanks...!!

Comment 12 by kojii@chromium.org, Aug 24 2017

Cc: krajshree@chromium.org
krajshree@, or can someone please attach an HTML file? I pasted the symbols to an HTML file but does not reproduce.

The pastebin.com URL can reproduce the hang on Chrome and on Edge, but then I'll need to download the whole page and try to minimize by removing all the UI parts.

A minimum HTML file is greatly appreciated.

Probably a dup of issue 749319, but hard to be sure without minimizing.
Visiting the page at URL: https://steamcommunity.com/groups/cheatgiveaways from comment #3 reproduced the issue i.e the page crashed.

Thanks...!!


Hello,

I have attempted to use a website copier to get the HTML File, please let me know if this is satisfactory.
8wK1x27k.html
24.5 KB View Download
cheatgiveaways.html
61.6 KB View Download
Here's a cut down version I made of the above HTML page, along with a screenshot showing my reproduction.

62.0.3194.0 Canary
Windows 10 Pro x64 v1607
V8 6.2.333
chromiumissue757446-test.html
3.1 KB View Download
aeb38e[1].png
98.6 KB View Download

Comment 16 by kojii@chromium.org, Aug 24 2017

Mergedinto: 749319
Status: Duplicate (was: Assigned)
#13, #14, #15: Thank you all for the help, if it occurs only when "word-wrap: break-word", this is the same one as issue 749319.
kojii@ Seems I can't view 749319, is it private in some form? Would like to track it since I'm using an electron app that is also vulnerable to this due to electron being based on Chromium.

Thanks!

Comment 18 by kojii@chromium.org, Aug 24 2017

#17: issue 749319 was once accidentally marked as security issue, but then cleared. I'm not sure if I can open it, I'll ask around.

Thank you for the background, I'm working on a fix and the current WIP no longer hangs up your HTML file attached to #15, hopefully it's not too far to land the fix. I'll make sure the fix is recorded to this issue too.
#18: Thanks for the info! Here my electron ticket where I intend to update when the fix is landed: https://github.com/electron/electron/issues/10332 (would have replied earlier but DB issues with monorail 👀)
#18 yea, I tried to add more info to this ticket but monorail :P

Anyways I have reported it to discordapp as well as they are using the same version of chromium.
Project Member

Comment 21 by bugdroid1@chromium.org, Aug 25 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/85b84a4d900effddac4b32e7774d23f51fd562e0

commit 85b84a4d900effddac4b32e7774d23f51fd562e0
Author: Koji Ishii <kojii@chromium.org>
Date: Fri Aug 25 16:15:31 2017

Fix mid-word-break to handle grapheme clusters

This patch fixes the mid-word-break logic, used by a few CSS properties:
- 'word-wrap: break-word'
- 'word-break: break-word'
- 'word-break: break-all'
to handle grapheme clusters correctly. Before this patch, it only
supported surrogate pairs.

The fix uses LazyLineBreakIterator and NonSharedCharacterBreakIterator
to detect grapheme cluster boundaries. Also adds tests/DCHECK to ensure
NextBreakOpportunity() returns the end of the input string if no more
break opportunities were found.

Bug: 749319,  757446 
Change-Id: I32046540d1cba8f9008e4adf4142e7dbd6d7ef8a
Reviewed-on: https://chromium-review.googlesource.com/628859
Reviewed-by: Emil A Eklund <eae@chromium.org>
Commit-Queue: Koji Ishii <kojii@chromium.org>
Cr-Commit-Position: refs/heads/master@{#497429}
[modify] https://crrev.com/85b84a4d900effddac4b32e7774d23f51fd562e0/third_party/WebKit/Source/core/layout/line/BreakingContextInlineHeaders.h
[modify] https://crrev.com/85b84a4d900effddac4b32e7774d23f51fd562e0/third_party/WebKit/Source/platform/text/TextBreakIterator.cpp
[modify] https://crrev.com/85b84a4d900effddac4b32e7774d23f51fd562e0/third_party/WebKit/Source/platform/text/TextBreakIteratorTest.cpp

Sign in to add a comment