Two follow up questions, please:

1. Which policies are set on the browser? Please provide a list or a dump from the chrome://policy page (after stripping whatever privacy sensitive bits you feel might be present in there).
2. Can you please run the "!analyze -v" command and provide the whole stack of the crash and as much of the information provided by the command as possible.

Sure, find the policies attached.  One additional info: We have the McAfee DLP running which already caused issues in the past with chrome (e.g. freezing browser process).

And here is the analyze result:

0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify checksum for USER32.dll
*** WARNING: Unable to verify checksum for ole32.dll
GetUrlPageData2 (WinHttp) failed: 12002.

DUMP_CLASS: 2

DUMP_QUALIFIER: 400

CONTEXT:  (.ecxr)
rax=000007fedb682a50 rbx=0000000000000000 rcx=000006ed6ff7a958
rdx=0000051d6be69bf0 rsi=0000051d6be69bf8 rdi=0000051d6be69b40
rip=000007fedaf16446 rsp=00000000002be240 rbp=00000000002be380
 r8=0000000000000012  r9=0000000005b000c0 r10=0000051d6be69b38
r11=000007fedc191810 r12=0000000000000001 r13=0000000000000000
r14=00000000002bea00 r15=00000000002be3d0
iopl=0         nv up ei ng nz ac po cy
cs=0033  ss=0000  ds=0000  es=0000  fs=0053  gs=002b             efl=00010297
chrome_child!blink::AXARIAGrid::CalculateNumColumns+0x2a:
000007fe`daf16446 ff90e0050000    call    qword ptr [rax+5E0h] ds:000007fe`db683030=7669747265737361
Resetting default scope

FAULTING_IP: 
chrome_child!blink::AXARIAGrid::CalculateNumColumns+2a [c:\b\c\b\win64_pgo\src\third_party\webkit\source\modules\accessibility\axariagrid.cpp @ 79]
000007fe`daf16446 ff90e0050000    call    qword ptr [rax+5E0h]

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 000007fedaf16446 (chrome_child!blink::AXARIAGrid::CalculateNumColumns+0x000000000000002a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

PROCESS_NAME:  chrome.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%p verwies auf Arbeitsspeicher bei 0x%p. Der Vorgang %s konnte im Arbeitsspeicher nicht durchgef hrt werden.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - Die Anweisung in 0x%p verwies auf Arbeitsspeicher bei 0x%p. Der Vorgang %s konnte im Arbeitsspeicher nicht durchgef hrt werden.

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

FOLLOWUP_IP: 
chrome_child!blink::AXARIAGrid::CalculateNumColumns+2a [c:\b\c\b\win64_pgo\src\third_party\webkit\source\modules\accessibility\axariagrid.cpp @ 79]
000007fe`daf16446 ff90e0050000    call    qword ptr [rax+5E0h]

READ_ADDRESS:  ffffffffffffffff 

WATSON_BKT_PROCSTAMP:  5a27254c

WATSON_BKT_PROCVER:  63.0.3239.84

PROCESS_VER_PRODUCT:  Google Chrome

WATSON_BKT_MODULE:  chrome_child.dll

WATSON_BKT_MODSTAMP:  5a276e0a

WATSON_BKT_MODOFFSET:  2956446

WATSON_BKT_MODVER:  63.0.3239.84

MODULE_VER_PRODUCT:  Google Chrome

BUILD_VERSION_STRING:  6.1.7601.23915 (win7sp1_ldr.170913-0600)

MODLIST_WITH_TSCHKSUM_HASH:  e5079bbcf23a5c2fd6dcf25aad3da5654ae1f46e

MODLIST_SHA1_HASH:  bd346936fec8278b64d10193e5feac4daaea1f67

NTGLOBALFLAG:  0

PROCESS_BAM_CURRENT_THROTTLED: 0

PROCESS_BAM_PREVIOUS_THROTTLED: 0

TIMELINE_TIMES: 4

Timeline: Process
    Name: !analyze
    Time: 2017-12-14T13:26:07Z
    Diff: 101463

    Name: Origin
    Time: 2017-12-13T09:15:04Z
    Diff: 0

    Name: SystemStart
    Time: 2017-12-13T09:15:04Z
    Diff: 0

    Name: ProcessStart
    Time: 2017-12-13T09:12:01Z
    Diff: 183


DUMP_FLAGS:  0

DUMP_TYPE:  2

ANALYSIS_SESSION_HOST:  JX1C

ANALYSIS_SESSION_TIME:  12-14-2017 14:26:07.0504

ANALYSIS_VERSION: 10.0.17030.1002 amd64fre

THREAD_ATTRIBUTES: 
OS_LOCALE:  DEU

PROBLEM_CLASSES: 

    ID:     [0n307]
    Type:   [@ACCESS_VIOLATION]
    Class:  Addendum
    Scope:  BUCKET_ID
    Name:   Omit
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x123c]
    Frame:  [0] : chrome_child!blink::AXARIAGrid::CalculateNumColumns

    ID:     [0n279]
    Type:   [INVALID_POINTER_READ]
    Class:  Primary
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [Unspecified]
    TID:    [0x123c]
    Frame:  [0] : chrome_child!blink::AXARIAGrid::CalculateNumColumns

    ID:     [0n104]
    Type:   [IN_CALL]
    Class:  Addendum
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [0x16b8]
    TID:    [0x123c]
    Frame:  [0] : chrome_child!blink::AXARIAGrid::CalculateNumColumns

BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_IN_CALL

DEFAULT_BUCKET_ID:  INVALID_POINTER_READ_IN_CALL

PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT

LAST_CONTROL_TRANSFER:  from 000007fedaf162bd to 000007fedaf16446

STACK_TEXT:  
00000000`002be240 000007fe`daf162bd : 000006ed`6ff67bb8 00000000`00000000 00000000`002be380 00000000`00000000 : chrome_child!blink::AXARIAGrid::CalculateNumColumns+0x2a
00000000`002be270 000007fe`daf0a618 : 00000000`00000000 00000000`00000001 00000000`002be378 000007fe`d8947ad5 : chrome_child!blink::AXARIAGrid::AddChildren+0x45
00000000`002be2b0 000007fe`daefe6ea : 00000000`00000000 00000000`00000001 00000000`002be400 00000000`00000000 : chrome_child!blink::AXLayoutObject::UpdateChildrenIfNecessary+0x34
00000000`002be2e0 000007fe`da447adc : 00000000`002be400 00000000`002be370 00000000`002be3d0 00000000`002bea00 : chrome_child!blink::AXTableRow::Cells+0x12
00000000`002be310 000007fe`da556afb : 00000000`0310b2b8 00000000`002be380 00000000`0310b318 00000000`0310b318 : chrome_child!blink::WebAXObject::ChildCount+0x28
00000000`002be340 000007fe`da51c9fc : 00000000`00000000 000007fe`dc1c0f78 00000000`0000000a 00000000`002be450 : chrome_child!content::BlinkAXTreeSource::GetChildren+0xbf
00000000`002be3b0 000007fe`da51ca3c : 000004b1`2fa8fd30 00000000`0000000a 00000000`0310b318 00000000`002be4a0 : chrome_child!ui::AXTreeSerializer<blink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData>::WalkAllDescendants+0x58
00000000`002be400 000007fe`da51ca3c : 000004b1`2fa8f370 00000000`00000018 00000000`0310b318 00000000`002be4f0 : chrome_child!ui::AXTreeSerializer<blink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData>::WalkAllDescendants+0x98
00000000`002be450 000007fe`da51ca3c : 000004b1`2fa8f430 00000000`00000000 00000000`0310b318 00000000`002be540 : chrome_child!ui::AXTreeSerializer<blink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData>::WalkAllDescendants+0x98
00000000`002be4a0 000007fe`da51ca3c : 000004b1`2fa8fff0 00000000`00000004 00000000`0310b318 00000000`002be590 : chrome_child!ui::AXTreeSerializer<blink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData>::WalkAllDescendants+0x98
00000000`002be4f0 000007fe`da51ca3c : 000004b1`2fa8fa30 00000000`00000000 00000000`0310b318 00000000`002be5c0 : chrome_child!ui::AXTreeSerializer<blink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData>::WalkAllDescendants+0x98
00000000`002be540 000007fe`da51c2fc : 000004b1`2fa8ed90 000007fe`db636888 00000000`00000000 00000000`0310b318 : chrome_child!ui::AXTreeSerializer<blink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData>::WalkAllDescendants+0x98
00000000`002be590 000007fe`da51b6fb : 00000000`00000000 00000000`0310b270 00000000`06841810 00000000`0310b270 : chrome_child!ui::AXTreeSerializer<blink::WebAXObject,content::AXContentNodeData,content::AXContentTreeData>::SerializeChanges+0x204
00000000`002be700 000007fe`d86d13c2 : 00000000`002bf050 00000000`06611c60 00000000`01382880 00000000`00000000 : chrome_child!content::RenderAccessibilityImpl::SendPendingAccessibilityEvents+0x237
00000000`002beb70 000007fe`d875eb8e : 00000000`002bec28 00000000`002bede0 00000000`01382a80 00000000`002beda0 : chrome_child!base::internal::Invoker<base::internal::BindState<void (__cdecl cc::ResourcePool::*)(void) __ptr64,base::WeakPtr<cc::ResourcePool> >,void __cdecl(void)>::RunOnce+0x3e
00000000`002bebb0 000007fe`d86f0106 : 00000000`01314ae0 00000000`002beda0 00000000`01382800 00000000`01382800 : chrome_child!base::debug::TaskAnnotator::RunTask+0xda
00000000`002beca0 000007fe`d875e2a6 : 00000001`d11ed200 00000000`01382880 00000000`002bf200 000007fe`dbffa700 : chrome_child!blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue+0x1b2
00000000`002bef60 000007fe`d86e8a3b : 00000000`0317a5b0 000007fe`d875ec00 00000000`00000000 00000000`013829e0 : chrome_child!blink::scheduler::TaskQueueManager::DoWork+0x18e
00000000`002bf0e0 000007fe`d875eb8e : 00000000`002bf198 00000000`01382ae0 00000000`00000000 00000000`00000003 : chrome_child!base::internal::Invoker<base::internal::BindState<void (__cdecl blink::scheduler::TaskQueueManager::*)(bool) __ptr64,base::WeakPtr<blink::scheduler::TaskQueueManager>,bool>,void __cdecl(void)>::Run+0x4b
00000000`002bf120 000007fe`d86eedd1 : 00000000`013826f8 00000000`013826f8 00000000`002bf200 00000000`002bf300 : chrome_child!base::debug::TaskAnnotator::RunTask+0xda
00000000`002bf210 000007fe`d875f052 : 00000000`01381f00 00000000`01381f00 000007fe`db3bb480 00000000`01381f00 : chrome_child!base::MessageLoop::RunTask+0xb9
00000000`002bf330 000007fe`d875e035 : 00000001`d10880c8 00000000`01381f00 00000000`01382640 00000000`01381f10 : chrome_child!base::MessageLoop::DoWork+0x1aa
00000000`002bf480 000007fe`d886f55c : 00000000`01381f10 00000001`d0f97166 00000001`d0f97166 00000000`01382648 : chrome_child!base::MessagePumpDefault::Run+0x31
00000000`002bf510 000007fe`d886f4fc : 00000000`01382648 00000000`002bf5a0 00000000`01382640 00000000`01381170 : chrome_child!base::MessageLoop::Run+0x28
00000000`002bf540 000007fe`d8b815a6 : 00000000`002bf638 00000000`01351801 00000000`002bf8d0 00000000`01382640 : chrome_child!base::RunLoop::Run+0x68
00000000`002bf5b0 000007fe`d8a5f612 : 00000000`00000003 00000000`00000006 000007fe`db6da6a0 00000000`002bfb80 : chrome_child!content::RendererMain+0x1ee
00000000`002bf750 000007fe`d8933b7c : 00000000`013150a0 00000000`002bf920 00000000`01351830 00000000`00000000 : chrome_child!content::RunNamedProcessTypeMain+0xb6
00000000`002bf8a0 000007fe`d8a6018f : 00000000`0135bf20 00000000`002bfae0 00000000`00000003 ffffffff`ffffffff : chrome_child!content::ContentMainRunnerImpl::Run+0xbc
00000000`002bf930 000007fe`d8715b87 : 00000000`00f25e60 00000000`00951f00 00000000`002bfc30 00000000`00000000 : chrome_child!service_manager::Main+0x1e7
00000000`002bfac0 000007fe`d8715b2a : 00000000`00951f00 00000000`002bfae0 00000001`3f3f0000 00000000`00000000 : chrome_child!content::ContentMain+0x27
00000000`002bfb30 00000001`3f3f7164 : 00000000`01351f70 00000001`c636082e 00000000`01351f70 00000000`00000007 : chrome_child!ChromeMain+0x17e
00000000`002bfbe0 00000001`3f3f256e : 00000000`00ee7b60 00000000`00000000 00000000`00f25e50 00000000`0000000f : chrome!MainDllLoader::Launch+0x3c4
00000000`002bfd10 00000001`3f4c73e3 : 00000000`00000000 00000000`0000000a 00000000`00000000 00000000`00000000 : chrome!wWinMain+0x336
00000000`002bff00 00000000`779259cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : chrome!__scrt_common_main_seh+0x117
00000000`002bff40 00000000`77b5a561 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`002bff70 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d


THREAD_SHA1_HASH_MOD_FUNC:  3c50a6b85c116dad95f9ac76b2b1860eba8f14d5

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  4ec50f52358af5234304f8084461e4ec25718a62

THREAD_SHA1_HASH_MOD:  7faa6f94e19235c506f5004897a31995f44eeb94

FAULT_INSTR_CODE:  5e090ff

FAULTING_SOURCE_LINE:  c:\b\c\b\win64_pgo\src\third_party\webkit\source\modules\accessibility\axariagrid.cpp

FAULTING_SOURCE_FILE:  c:\b\c\b\win64_pgo\src\third_party\webkit\source\modules\accessibility\axariagrid.cpp

FAULTING_SOURCE_LINE_NUMBER:  79

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  chrome_child!blink::AXARIAGrid::CalculateNumColumns+2a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: chrome_child

IMAGE_NAME:  chrome_child.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  5a276e0a

STACK_COMMAND:  ~0s ; .ecxr ; kb

FAILURE_BUCKET_ID:  INVALID_POINTER_READ_IN_CALL_c0000005_chrome_child.dll!blink::AXARIAGrid::CalculateNumColumns

BUCKET_ID:  X64_APPLICATION_FAULT_INVALID_POINTER_READ_IN_CALL_chrome_child!blink::AXARIAGrid::CalculateNumColumns+2a

FAILURE_EXCEPTION_CODE:  c0000005

FAILURE_IMAGE_NAME:  chrome_child.dll

BUCKET_ID_IMAGE_STR:  chrome_child.dll

FAILURE_MODULE_NAME:  chrome_child

BUCKET_ID_MODULE_STR:  chrome_child

FAILURE_FUNCTION_NAME:  blink::AXARIAGrid::CalculateNumColumns

BUCKET_ID_FUNCTION_STR:  blink::AXARIAGrid::CalculateNumColumns

BUCKET_ID_OFFSET:  2a

BUCKET_ID_MODTIMEDATESTAMP:  5a276e0a

BUCKET_ID_MODCHECKSUM:  0

BUCKET_ID_MODVER_STR:  63.0.3239.84

BUCKET_ID_PREFIX_STR:  X64_APPLICATION_FAULT_INVALID_POINTER_READ_IN_CALL_

FAILURE_PROBLEM_CLASS:  APPLICATION_FAULT

FAILURE_SYMBOL_NAME:  chrome_child.dll!blink::AXARIAGrid::CalculateNumColumns

WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/chrome.exe/63.0.3239.84/5a27254c/chrome_child.dll/63.0.3239.84/5a276e0a/c0000005/02956446.htm?Retriage=1

TARGET_TIME:  2017-12-13T09:15:04.000Z

OSBUILD:  7601

OSSERVICEPACK:  23915

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  0

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 7

OSEDITION:  Windows 7 WinNt (23915)

USER_LCID:  0

OSBUILD_TIMESTAMP:  2017-09-13 17:30:49

BUILDDATESTAMP_STR:  170913-0600

BUILDLAB_STR:  win7sp1_ldr

BUILDOSVER_STR:  6.1.7601.23915

ANALYSIS_SESSION_ELAPSED_TIME:  9a04

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:invalid_pointer_read_in_call_c0000005_chrome_child.dll!blink::axariagrid::calculatenumcolumns

FAILURE_ID_HASH:  {4f1986dc-0ff1-a918-aa0b-03f42226882d}

Followup:     MachineOwner
---------

Deleted: policies.json 7.2 KB

policies.json 7.2 KB View Download

Adding the Blink>Accessability label since the stack trace hints at it.

The policies are strict enough to prevent some external component if it is a plugin or extension to operate but I would not have expected this to collide with Aria code.

I'm not sure how we can debug this without a more complete stack trace or an HTML page demonstrating the problem.

Or a crash ID would work - can you reproduce the crash and then get a crash ID from chrome://crashes?

It'd be ideal if you could use the most recent possible version of Chrome to reproduce it too, but any version is okay.

@dmazzoni: I agree, it will be very hard reproducing this on another machine as we weren't able to reproduce it with other pc configs. Whereas we can easily reproduce the crash on several pcs (>50) with a similar company image. We do not / cannot upload the crash reports due to company browser policy so the crash id won't do you any good. 

But I could send you the dmp file to your company mail if that is ok? It simply contains too much sensitive information to post it publicly. But I trust you handling the information with care.

Yes, I believe that if you send me the dump along with the exact Chrome version string, I should be able to get a stack trace for that.

Does this happen when loading a particular site? Would it be possible to try to copy the DOM for that site (in developer tools) into a standalone .html file and strip out anything confidential, while still reproducing the crash?

Even if the crash goes away, seeing the HTML would be helpful.

I will send you a mail shortly with the dump attached. I nevertheless wasn't able to get the HTML out of the DEV tools after it entered "Detached" State when the tab crashed. Neither copy, nor "edit as html" works after the crash anymore. 

Any suggestions how to circumvent this?

I was able to dump the HTML using IE11. Checkmark on that.

Same crash is reported in bug 795235.

It's probably fixed in Canary. Reporter, can you check?

@jman883, do you have any markup with a <canvas role="[something]"> ?

Hi @aleventhal,

I attached a snippet of the relevant HTML where the crash happens to this answer. There is NO <canvas> element on the whole page. But lots of role="..." and other ARIA markup everywhere. Take a look for yourself.

Sadly I cannot test Canary on our corporate machines. No way to get an other release branch installed :-(

Deleted: chromium_79455_snippet.txt 10.8 KB

chromium_79455_snippet.txt 10.8 KB View Download

Hello!
This bug is receiving this notice because there has been no acknowledgment of its existence in quite a bit of time
- If you are currently working on this bug, please provide an update.
- If you are currently affected by this bug, please update with your current symptoms and relevant logs.

If there has been no updates provided by EOD Wednesday, 12/12/18 (5pm EST), this bug will be archived and can be re-opened at any time deemed necessary.

Thank you!

Due to lack of action this bug has been Archived. If work is still being done on this issue or you are still experiencing this issue please feel free to re-open with the appropriate information.