Certain SVG causes Chrome tab to hang/crash
Reported by
tsulli...@elastic.co,
Jan 16 2018
|
||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 Steps to reproduce the problem: 1. Load Kibana.html 2. The page tab hangs and eventually crashes, which is evident by the animated gif not working 3. Run `Kibana_files/kibana.svg` through http://www.svgminify.com/ 4. The page loads fine What is the expected behavior? Page should load fine without the need to minify any SVG files to avoid crashing What went wrong? Chrome seems to be getting stuck on some parts of one of the paths in the SVG code Did this work before? N/A Does this work in other browsers? Yes Chrome version: 63.0.3239.132 Channel: stable OS Version: OS X 10.13.2 Flash Version: - Other than the zip file, the test case code can be found in https://github.com/tsullivan/chrome-crash-test-case. The fix for the SVG can be pulled in by switching branches in the repo - crash dump from `~/Library/Application Support/Google/Chrome/Crashpad/completed` - settings.dat from `~/Library/Application Support/Google/Chrome/Crashpad`
,
Jan 17 2018
This issue seems to be related to rasterization in chromium and not to the Mac Book actually. I assume that just MacBooks with a dedicated graphics card have rasterization turned on by default. If I use `about:flags` to turn on "GPU rasterization" and try to load the above example, the tab never renders, but will be stuck with 100% CPU load forever (according to Chromium task manager). I am running Chromium 63.0.3239.132 on Archlinux and attached the output of `about:gpu` and `about:vesion` after turning on the "GPU rasterization" flag. I can reproduce this error every time trying to load the HTML. I can also verify, that it doesn't matter whether you open the file via HTTP or file protocol.
,
Jan 17 2018
I of course always meant "GPU rasterization" when talking about rasterization in the above comment.
,
Jan 17 2018
And apparently my `about:gpu` wasn't attached correctly, so here again.
,
Jan 17 2018
,
Jan 17 2018
Unable to reproduce the issue on reported chrome version 63.0.3239.132 and on the latest canary 65.0.3322.0 using Mac 10.13.1 with the below mentioned steps. 1. Launched Chrome 2. Downloaded and extracted the test file "simpletestcase.zip " 3. Navigated to http://www.svgminify.com/ 4. Loaded Kibana.html and in other tab loaded kibana.svg After hitting start button in one tab we see an error and in the other some script is shown, in the process we didn't see any crash/hang. Attaching the screen cast for reference. @Reporter: Could you please have a look at the screen cast and let us know if we have missed any steps while reproducing the issue. Any further inputs from your end may help us. Thanks!
,
Jan 17 2018
The screencast seems to be broken for me. Thus I will rephrase the reproduction steps: 1. Go to `about:flags` 2. Enable "GPU Rasterization" 3. Restart Chrome 4. Download and extract "simpletestcase.zip" somewhere 5. Open the "Kibana.html" in the browser. 6. Wait a bit and the tab should freeze very soon (i.e. the GIF is not playing anymore), also you can check the chrome task manager, for me the tab was stuck with 100% CPU load
,
Jan 17 2018
I am also not able to view the screencast. Comment #7 has the right steps. From my report: > 2. The page tab hangs and eventually crashes, which is evident by the animated gif not working > 3. Run `Kibana_files/kibana.svg` through http://www.svgminify.com/ Step 2 is sufficient for seeing the tab hang - the page will not finish rendering correctly and as said in Comment #7, CPU load goes all the way up. Step 3 is for "fixing" one of the SVGs on the page to make it somehow usable by Chrome to render in the test case without getting stuck.
,
Jan 17 2018
Thank you for providing more feedback. Adding requester "vamshi.kommuri@techmahindra.com" to the cc list and removing "Needs-Feedback" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jan 17 2018
This issue seems to require a dedicated GPU for MacBook hardware (so you most likely need a 15" MBP). It also reproduces on my Windows desktop, which has a dedicated NVidia GeForce GTX 960. I can make the page load by disabling hardware acceleration via the Chrome flags menu, but all browsing becomes noticeably slower. Running: Chrome version: Chrome/63.0.3239.132 Operating system: Windows NT 10.0.16299 Software rendering list version: 13.13 Driver bug list version: 10.34 ANGLE commit id: 2ff870db3a3b 2D graphics backend: Skia/63 dbae7001c9805fb0a4b18fd0cbc889941cb39db4- GL_VENDOR: Google Inc. GL_RENDERER: ANGLE (NVIDIA GeForce GTX 960 Direct3D11 vs_5_0 ps_5_0) GL_VERSION: OpenGL ES 3.0 (ANGLE 2.1.0.2ff870db3a3b)
,
Jan 19 2018
Crash report for #0: crash/b85cd7037245be02 It looks like the SVG takes a very long time to render and it causes the renderer process to hang and be killed. Not sure why it takes so much longer to render on some devices than others. The stack of thread #11 in the crash report makes it look tessellation-related. +senorblanco
,
Jan 19 2018
Note to self: attached is a Skia reduction. Reproduce with
out/Debug/viewer --match thinconcavepaths --pr tess --msaa 4
switch to GPU device ('d')
,
Jan 19 2018
Patch to self: here's a quick fix (will need formatting, testing, unit test).
,
Mar 28 2018
The following revision refers to this bug: https://skia.googlesource.com/skia/+/050c86768a2c24c62655f53ef9b685d40477eccb commit 050c86768a2c24c62655f53ef9b685d40477eccb Author: Stephen White <senorblanco@chromium.org> Date: Wed Mar 28 19:55:34 2018 GrTessellator: hang fix. Some edges are not coincident with their own endpoints (because floating point). If this happens for an edge which is a right-enclosing-edge during the Bentley-Ottman simplify() pass, we end up an infinite loop attempting to split the edge, since the edge is never to the right of its endpoint. The easiest fix is to simply remove the right-enclosing-edge splitting code. This code was originally added before we had proper active-edge-list rewinding, and should no longer be necessary. BUG= 802896 Change-Id: Id9f2942b73f01152af8c0088e8c6b1389891d827 Reviewed-on: https://skia-review.googlesource.com/116920 Reviewed-by: Robert Phillips <robertphillips@google.com> Commit-Queue: Stephen White <senorblanco@chromium.org> [modify] https://crrev.com/050c86768a2c24c62655f53ef9b685d40477eccb/tests/TessellatingPathRendererTests.cpp [modify] https://crrev.com/050c86768a2c24c62655f53ef9b685d40477eccb/src/gpu/GrTessellator.cpp
,
Mar 29 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/6c53fca4e23945d1b4333e2e423ca60de82f1be4 commit 6c53fca4e23945d1b4333e2e423ca60de82f1be4 Author: Stephen White <senorblanco@chromium.org> Date: Thu Mar 29 12:42:27 2018 Mark a test to be rebaselined after Skia roll. BUG= 802896 TBR=robertphillips@google.com Change-Id: Icd668b70b66a8ba7349bbdf16e453599901acc2a Reviewed-on: https://chromium-review.googlesource.com/986332 Reviewed-by: Stephen White <senorblanco@chromium.org> Commit-Queue: Stephen White <senorblanco@chromium.org> Cr-Commit-Position: refs/heads/master@{#546795} [modify] https://crrev.com/6c53fca4e23945d1b4333e2e423ca60de82f1be4/third_party/WebKit/LayoutTests/TestExpectations
,
Mar 29 2018
The following revision refers to this bug: https://skia.googlesource.com/skia/+/f2590303b73b5fda90bf3873f380ba1739ca861c commit f2590303b73b5fda90bf3873f380ba1739ca861c Author: Mike Klein <mtklein@chromium.org> Date: Thu Mar 29 13:21:16 2018 Revert "GrTessellator: hang fix." This reverts commit 050c86768a2c24c62655f53ef9b685d40477eccb. Reason for revert: layout test diff in Chrome roll? Original change's description: > GrTessellator: hang fix. > > Some edges are not coincident with their own endpoints (because floating > point). If this happens for an edge which is a right-enclosing-edge > during the Bentley-Ottman simplify() pass, we end up an infinite loop > attempting to split the edge, since the edge is never to the right of its > endpoint. > > The easiest fix is to simply remove the right-enclosing-edge splitting > code. This code was originally added before we had proper > active-edge-list rewinding, and should no longer be necessary. > > BUG= 802896 > > Change-Id: Id9f2942b73f01152af8c0088e8c6b1389891d827 > Reviewed-on: https://skia-review.googlesource.com/116920 > Reviewed-by: Robert Phillips <robertphillips@google.com> > Commit-Queue: Stephen White <senorblanco@chromium.org> TBR=robertphillips@google.com,senorblanco@chromium.org Change-Id: Icb928db6c052a21c6d327da9492cb991f769186f No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: 802896 Reviewed-on: https://skia-review.googlesource.com/117120 Reviewed-by: Mike Klein <mtklein@chromium.org> Commit-Queue: Mike Klein <mtklein@chromium.org> [modify] https://crrev.com/f2590303b73b5fda90bf3873f380ba1739ca861c/tests/TessellatingPathRendererTests.cpp [modify] https://crrev.com/f2590303b73b5fda90bf3873f380ba1739ca861c/src/gpu/GrTessellator.cpp
,
Mar 29 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/8d1e65e4acdbf2472a086dbf68dd1ebceab1be22 commit 8d1e65e4acdbf2472a086dbf68dd1ebceab1be22 Author: skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Thu Mar 29 14:19:51 2018 Roll src/third_party/skia/ 6eba063b6..702a7dfc9 (7 commits) https://skia.googlesource.com/skia.git/+log/6eba063b63ef..702a7dfc91f9 $ git log 6eba063b6..702a7dfc9 --date=short --no-merges --format='%ad %ae %s' 2018-03-29 angle-skia-autoroll Roll skia/third_party/externals/angle2/ 78c5eb2ab..a3b220f36 (7 commits) 2018-03-28 skcms-skia-autoroll Roll skia/third_party/externals/skcms/ ed6a9bd48..5678b9d6a (1 commit) 2018-03-28 liyuqian Update trans limit after zoom changes in viewer 2018-03-14 rmistry Whitespace change 2018-02-15 bungeman Add color fonts. 2018-03-28 skcms-skia-autoroll Roll skia/third_party/externals/skcms/ 59fdb4e14..ed6a9bd48 (2 commits) 2018-03-28 senorblanco GrTessellator: hang fix. Created with: roll-dep src/third_party/skia BUG= chromium:802896 The AutoRoll server is located here: https://autoroll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel TBR=mtklein@chromium.org Change-Id: I2c578a2708dd3352bee91224db1d1ed0698a24a7 Reviewed-on: https://chromium-review.googlesource.com/985639 Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#546822} [modify] https://crrev.com/8d1e65e4acdbf2472a086dbf68dd1ebceab1be22/DEPS
,
Mar 29 2018
The following revision refers to this bug: https://skia.googlesource.com/skia/+/20010e80b637b9c6173c2d3d3c2070bb3b184104 commit 20010e80b637b9c6173c2d3d3c2070bb3b184104 Author: Stephen White <senorblanco@chromium.org> Date: Thu Mar 29 14:28:55 2018 Reland "GrTessellator: hang fix." This is a reland of 050c86768a2c24c62655f53ef9b685d40477eccb Original change's description: > GrTessellator: hang fix. > > Some edges are not coincident with their own endpoints (because floating > point). If this happens for an edge which is a right-enclosing-edge > during the Bentley-Ottman simplify() pass, we end up an infinite loop > attempting to split the edge, since the edge is never to the right of its > endpoint. > > The easiest fix is to simply remove the right-enclosing-edge splitting > code. This code was originally added before we had proper > active-edge-list rewinding, and should no longer be necessary. > > BUG= 802896 > > Change-Id: Id9f2942b73f01152af8c0088e8c6b1389891d827 > Reviewed-on: https://skia-review.googlesource.com/116920 > Reviewed-by: Robert Phillips <robertphillips@google.com> > Commit-Queue: Stephen White <senorblanco@chromium.org> Bug: 802896 Change-Id: I3e48346a8a358ae7d481299a586003e817a519ca Reviewed-on: https://skia-review.googlesource.com/117121 Reviewed-by: Mike Klein <mtklein@chromium.org> Commit-Queue: Mike Klein <mtklein@chromium.org> [modify] https://crrev.com/20010e80b637b9c6173c2d3d3c2070bb3b184104/tests/TessellatingPathRendererTests.cpp [modify] https://crrev.com/20010e80b637b9c6173c2d3d3c2070bb3b184104/src/gpu/GrTessellator.cpp
,
Mar 29 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/555410b7ce91ef5cf31f480803c01c93d95c28cc commit 555410b7ce91ef5cf31f480803c01c93d95c28cc Author: skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Date: Thu Mar 29 18:34:24 2018 Roll src/third_party/skia/ 702a7dfc9..c3bc425bd (8 commits) https://skia.googlesource.com/skia.git/+log/702a7dfc91f9..c3bc425bd4d6 $ git log 702a7dfc9..c3bc425bd --date=short --no-merges --format='%ad %ae %s' 2018-03-28 halcanary SkDynamicMemoryWStream: clean up, asserts, etc. 2018-03-28 senorblanco Reland "GrTessellator: hang fix." 2018-03-29 angle-skia-autoroll Roll skia/third_party/externals/angle2/ a3b220f36..96310cdad (1 commit) 2018-03-29 skcms-skia-autoroll Roll skia/third_party/externals/skcms/ 5678b9d6a..3f0009288 (1 commit) 2018-03-28 kdonev Fixing build with SK_IGNORE_TO_STRING defined. 2018-03-28 ethannicholas fixed type mismatches in SkSL comparison operators 2018-03-28 csmartdalton Don't use gl_FragCoord on legacy Tegra hardware 2018-03-29 mtklein Revert "GrTessellator: hang fix." Created with: roll-dep src/third_party/skia BUG= chromium:825476 , chromium:802896 , chromium:802896 The AutoRoll server is located here: https://autoroll.skia.org Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+/master/autoroll/README.md If the roll is causing failures, please contact the current sheriff, who should be CC'd on the roll, and stop the roller if necessary. CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel TBR=mtklein@chromium.org Change-Id: Iad642d09e901c9392b9a24294e457a74dbe94a97 Reviewed-on: https://chromium-review.googlesource.com/986464 Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Commit-Queue: Mike Klein <mtklein@chromium.org> Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/master@{#546869} [modify] https://crrev.com/555410b7ce91ef5cf31f480803c01c93d95c28cc/DEPS
,
Mar 31 2018
This should be fixed as of r546822 above, and in the Chrome 67 Canary.
,
Oct 5
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/cb4b9ea75c3b039492373f114ab63f44aee476bc commit cb4b9ea75c3b039492373f114ab63f44aee476bc Author: Florin Malita <fmalita@chromium.org> Date: Fri Oct 05 14:54:50 2018 Rebaseline pending Skia suppressions virtual/gpu/fast/canvas/canvas-arc-circumference.html virtual/gpu/fast/canvas/canvas-drawImage-antiAlias.html virtual/gpu/fast/canvas/canvas-ellipse-circumference.html virtual/gpu/fast/canvas/canvas-ellipse-circumference-fill.html virtual/gpu/fast/canvas/fillrect_gradient.html virtual/gpu/fast/canvas/gradient-add-second-start-end-stop.html virtual/gpu-rasterization/images/cross-fade-background-size.html TBR= Bug: 884166, 889940 , 888675 , 802896 Change-Id: I43312a60d4e8784cd915533bda5cf54141160adb Reviewed-on: https://chromium-review.googlesource.com/c/1262895 Reviewed-by: Florin Malita <fmalita@chromium.org> Reviewed-by: Stephen White <senorblanco@chromium.org> Commit-Queue: Florin Malita <fmalita@chromium.org> Cr-Commit-Position: refs/heads/master@{#597120} [modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/TestExpectations [modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/platform/linux/virtual/gpu/fast/canvas/fillrect_gradient-expected.png [modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu-rasterization/images/cross-fade-background-size-expected.png [modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu/fast/canvas/fillrect_gradient-expected.png [modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/platform/win/virtual/gpu-rasterization/images/cross-fade-background-size-expected.png [modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/platform/win/virtual/gpu/fast/canvas/fillrect_gradient-expected.png [modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-arc-circumference-expected.png [modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-drawImage-antiAlias-expected.png [modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-ellipse-circumference-expected.png [add] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-ellipse-circumference-fill-expected.png [modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/gradient-add-second-start-end-stop-expected.png |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by tsulli...@elastic.co
, Jan 16 2018