New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 802896 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Mac
Pri: 2
Type: Bug



Sign in to add a comment

Certain SVG causes Chrome tab to hang/crash

Reported by tsulli...@elastic.co, Jan 16 2018

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36

Steps to reproduce the problem:
1. Load Kibana.html
2. The page tab hangs and eventually crashes, which is evident by the animated gif not working
3. Run `Kibana_files/kibana.svg` through http://www.svgminify.com/
4. The page loads fine

What is the expected behavior?
Page should load fine without the need to minify any SVG files to avoid crashing

What went wrong?
Chrome seems to be getting stuck on some parts of one of the paths in the SVG code

Did this work before? N/A 

Does this work in other browsers? Yes

Chrome version: 63.0.3239.132  Channel: stable
OS Version: OS X 10.13.2
Flash Version: 

- Other than the zip file, the test case code can be found in https://github.com/tsullivan/chrome-crash-test-case. The fix for the SVG can be pulled in by switching branches in the repo
- crash dump from `~/Library/Application Support/Google/Chrome/Crashpad/completed`
- settings.dat from `~/Library/Application Support/Google/Chrome/Crashpad`
 
simpletestcase.zip
8.1 MB Download
ccf0acdc-c277-4d29-af6d-def6b1fac944.dmp
274 KB Download
settings.dat
40 bytes Download
with fix.png
1.6 MB View Download
without fix.png
421 KB View Download
Further note: there are 2 other SVGs in the test case package. It seems to be necessary to have those in the mix to trigger the crash issue. Try removing any 1 of them, and the test case will start working.

For the most part, the test case code has been whittled down to the bare essentials.
This issue seems to be related to rasterization in chromium and not to the Mac Book actually. I assume that just MacBooks with a dedicated graphics card have rasterization turned on by default.

If I use `about:flags` to turn on "GPU rasterization" and try to load the above example, the tab never renders, but will be stuck with 100% CPU load forever (according to Chromium task manager).

I am running Chromium 63.0.3239.132 on Archlinux and attached the output of `about:gpu` and `about:vesion` after turning on the "GPU rasterization" flag.

I can reproduce this error every time trying to load the HTML. I can also verify, that it doesn't matter whether you open the file via HTTP or file protocol.
about-version.html
3.0 KB View Download
I of course always meant "GPU rasterization" when talking about rasterization in the above comment.
And apparently my `about:gpu` wasn't attached correctly, so here again.
gpu.html
69.0 KB View Download

Comment 5 by f...@opera.com, Jan 17 2018

Components: Internals>GPU>Rasterization
Cc: vamshi.k...@techmahindra.com
Labels: Needs-Triage-M63 Triaged-ET Needs-Feedback
Unable to reproduce the issue on reported chrome version 63.0.3239.132 and on the latest canary 65.0.3322.0 using Mac 10.13.1 with the below mentioned steps.
1. Launched Chrome 
2. Downloaded and extracted the test file "simpletestcase.zip "
3. Navigated to http://www.svgminify.com/
4. Loaded Kibana.html and in other tab loaded kibana.svg
After hitting start button in one tab we see an error and in the other some script is shown, in the process we didn't see any crash/hang. Attaching the screen cast for reference.

@Reporter: Could you please have a look at the screen cast and let us know if we have missed any steps while reproducing the issue. Any further inputs from your end may help us.

Thanks!
802896.mp4
7.3 MB View Download
The screencast seems to be broken for me.

Thus I will rephrase the reproduction steps:

1. Go to `about:flags`
2. Enable "GPU Rasterization"
3. Restart Chrome
4. Download and extract "simpletestcase.zip" somewhere
5. Open the "Kibana.html" in the browser.
6. Wait a bit and the tab should freeze very soon (i.e. the GIF is not playing anymore), also you can check the chrome task manager, for me the tab was stuck with 100% CPU load

I am also not able to view the screencast.

Comment #7 has the right steps.

From my report:

> 2. The page tab hangs and eventually crashes, which is evident by the animated gif not working
> 3. Run `Kibana_files/kibana.svg` through http://www.svgminify.com/

Step 2 is sufficient for seeing the tab hang - the page will not finish rendering correctly and as said in Comment #7, CPU load goes all the way up.

Step 3 is for "fixing" one of the SVGs on the page to make it somehow usable by Chrome to render in the test case without getting stuck.
Project Member

Comment 9 by sheriffbot@chromium.org, Jan 17 2018

Labels: -Needs-Feedback
Thank you for providing more feedback. Adding requester "vamshi.kommuri@techmahindra.com" to the cc list and removing "Needs-Feedback" label.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
This issue seems to require a dedicated GPU for MacBook hardware (so you most likely need a 15" MBP).

It also reproduces on my Windows desktop, which has a dedicated NVidia GeForce GTX 960. I can make the page load by disabling hardware acceleration via the Chrome flags menu, but all browsing becomes noticeably slower.

Running:

Chrome version: Chrome/63.0.3239.132
Operating system: Windows NT 10.0.16299
Software rendering list version: 13.13
Driver bug list version: 10.34
ANGLE commit id: 2ff870db3a3b
2D graphics backend: Skia/63 dbae7001c9805fb0a4b18fd0cbc889941cb39db4-

GL_VENDOR: Google Inc.
GL_RENDERER: ANGLE (NVIDIA GeForce GTX 960 Direct3D11 vs_5_0 ps_5_0)
GL_VERSION: OpenGL ES 3.0 (ANGLE 2.1.0.2ff870db3a3b)
Owner: senorblanco@chromium.org
Status: Assigned (was: Unconfirmed)
Crash report for #0: crash/b85cd7037245be02

It looks like the SVG takes a very long time to render and it causes the renderer process to hang and be killed. Not sure why it takes so much longer to render on some devices than others.

The stack of thread #11 in the crash report makes it look tessellation-related. +senorblanco
Note to self: attached is a Skia reduction. Reproduce with
    out/Debug/viewer --match thinconcavepaths --pr tess --msaa 4
    switch to GPU device ('d')
crbug-802896.patch
2.2 KB Download
Patch to self: here's a quick fix (will need formatting, testing, unit test).
crbug-802896-fix.patch
1.1 KB Download
Project Member

Comment 14 by bugdroid1@chromium.org, Mar 28 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/050c86768a2c24c62655f53ef9b685d40477eccb

commit 050c86768a2c24c62655f53ef9b685d40477eccb
Author: Stephen White <senorblanco@chromium.org>
Date: Wed Mar 28 19:55:34 2018

GrTessellator: hang fix.

Some edges are not coincident with their own endpoints (because floating
point). If this happens for an edge which is a right-enclosing-edge
during the Bentley-Ottman simplify() pass, we end up an infinite loop
attempting to split the edge, since the edge is never to the right of its
endpoint.

The easiest fix is to simply remove the right-enclosing-edge splitting
code. This code was originally added before we had proper
active-edge-list rewinding, and should no longer be necessary.

BUG= 802896 

Change-Id: Id9f2942b73f01152af8c0088e8c6b1389891d827
Reviewed-on: https://skia-review.googlesource.com/116920
Reviewed-by: Robert Phillips <robertphillips@google.com>
Commit-Queue: Stephen White <senorblanco@chromium.org>

[modify] https://crrev.com/050c86768a2c24c62655f53ef9b685d40477eccb/tests/TessellatingPathRendererTests.cpp
[modify] https://crrev.com/050c86768a2c24c62655f53ef9b685d40477eccb/src/gpu/GrTessellator.cpp

Project Member

Comment 15 by bugdroid1@chromium.org, Mar 29 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6c53fca4e23945d1b4333e2e423ca60de82f1be4

commit 6c53fca4e23945d1b4333e2e423ca60de82f1be4
Author: Stephen White <senorblanco@chromium.org>
Date: Thu Mar 29 12:42:27 2018

Mark a test to be rebaselined after Skia roll.

BUG= 802896 
TBR=robertphillips@google.com

Change-Id: Icd668b70b66a8ba7349bbdf16e453599901acc2a
Reviewed-on: https://chromium-review.googlesource.com/986332
Reviewed-by: Stephen White <senorblanco@chromium.org>
Commit-Queue: Stephen White <senorblanco@chromium.org>
Cr-Commit-Position: refs/heads/master@{#546795}
[modify] https://crrev.com/6c53fca4e23945d1b4333e2e423ca60de82f1be4/third_party/WebKit/LayoutTests/TestExpectations

Project Member

Comment 16 by bugdroid1@chromium.org, Mar 29 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/f2590303b73b5fda90bf3873f380ba1739ca861c

commit f2590303b73b5fda90bf3873f380ba1739ca861c
Author: Mike Klein <mtklein@chromium.org>
Date: Thu Mar 29 13:21:16 2018

Revert "GrTessellator: hang fix."

This reverts commit 050c86768a2c24c62655f53ef9b685d40477eccb.

Reason for revert: layout test diff in Chrome roll?

Original change's description:
> GrTessellator: hang fix.
> 
> Some edges are not coincident with their own endpoints (because floating
> point). If this happens for an edge which is a right-enclosing-edge
> during the Bentley-Ottman simplify() pass, we end up an infinite loop
> attempting to split the edge, since the edge is never to the right of its
> endpoint.
> 
> The easiest fix is to simply remove the right-enclosing-edge splitting
> code. This code was originally added before we had proper
> active-edge-list rewinding, and should no longer be necessary.
> 
> BUG= 802896 
> 
> Change-Id: Id9f2942b73f01152af8c0088e8c6b1389891d827
> Reviewed-on: https://skia-review.googlesource.com/116920
> Reviewed-by: Robert Phillips <robertphillips@google.com>
> Commit-Queue: Stephen White <senorblanco@chromium.org>

TBR=robertphillips@google.com,senorblanco@chromium.org

Change-Id: Icb928db6c052a21c6d327da9492cb991f769186f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug:  802896 
Reviewed-on: https://skia-review.googlesource.com/117120
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Mike Klein <mtklein@chromium.org>

[modify] https://crrev.com/f2590303b73b5fda90bf3873f380ba1739ca861c/tests/TessellatingPathRendererTests.cpp
[modify] https://crrev.com/f2590303b73b5fda90bf3873f380ba1739ca861c/src/gpu/GrTessellator.cpp

Project Member

Comment 17 by bugdroid1@chromium.org, Mar 29 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8d1e65e4acdbf2472a086dbf68dd1ebceab1be22

commit 8d1e65e4acdbf2472a086dbf68dd1ebceab1be22
Author: skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Thu Mar 29 14:19:51 2018

Roll src/third_party/skia/ 6eba063b6..702a7dfc9 (7 commits)

https://skia.googlesource.com/skia.git/+log/6eba063b63ef..702a7dfc91f9

$ git log 6eba063b6..702a7dfc9 --date=short --no-merges --format='%ad %ae %s'
2018-03-29 angle-skia-autoroll Roll skia/third_party/externals/angle2/ 78c5eb2ab..a3b220f36 (7 commits)
2018-03-28 skcms-skia-autoroll Roll skia/third_party/externals/skcms/ ed6a9bd48..5678b9d6a (1 commit)
2018-03-28 liyuqian Update trans limit after zoom changes in viewer
2018-03-14 rmistry Whitespace change
2018-02-15 bungeman Add color fonts.
2018-03-28 skcms-skia-autoroll Roll skia/third_party/externals/skcms/ 59fdb4e14..ed6a9bd48 (2 commits)
2018-03-28 senorblanco GrTessellator: hang fix.

Created with:
  roll-dep src/third_party/skia
BUG= chromium:802896 


The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
TBR=mtklein@chromium.org

Change-Id: I2c578a2708dd3352bee91224db1d1ed0698a24a7
Reviewed-on: https://chromium-review.googlesource.com/985639
Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#546822}
[modify] https://crrev.com/8d1e65e4acdbf2472a086dbf68dd1ebceab1be22/DEPS

Project Member

Comment 18 by bugdroid1@chromium.org, Mar 29 2018

The following revision refers to this bug:
  https://skia.googlesource.com/skia/+/20010e80b637b9c6173c2d3d3c2070bb3b184104

commit 20010e80b637b9c6173c2d3d3c2070bb3b184104
Author: Stephen White <senorblanco@chromium.org>
Date: Thu Mar 29 14:28:55 2018

Reland "GrTessellator: hang fix."

This is a reland of 050c86768a2c24c62655f53ef9b685d40477eccb

Original change's description:
> GrTessellator: hang fix.
> 
> Some edges are not coincident with their own endpoints (because floating
> point). If this happens for an edge which is a right-enclosing-edge
> during the Bentley-Ottman simplify() pass, we end up an infinite loop
> attempting to split the edge, since the edge is never to the right of its
> endpoint.
> 
> The easiest fix is to simply remove the right-enclosing-edge splitting
> code. This code was originally added before we had proper
> active-edge-list rewinding, and should no longer be necessary.
> 
> BUG= 802896 
> 
> Change-Id: Id9f2942b73f01152af8c0088e8c6b1389891d827
> Reviewed-on: https://skia-review.googlesource.com/116920
> Reviewed-by: Robert Phillips <robertphillips@google.com>
> Commit-Queue: Stephen White <senorblanco@chromium.org>

Bug:  802896 
Change-Id: I3e48346a8a358ae7d481299a586003e817a519ca
Reviewed-on: https://skia-review.googlesource.com/117121
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Mike Klein <mtklein@chromium.org>

[modify] https://crrev.com/20010e80b637b9c6173c2d3d3c2070bb3b184104/tests/TessellatingPathRendererTests.cpp
[modify] https://crrev.com/20010e80b637b9c6173c2d3d3c2070bb3b184104/src/gpu/GrTessellator.cpp

Project Member

Comment 19 by bugdroid1@chromium.org, Mar 29 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/555410b7ce91ef5cf31f480803c01c93d95c28cc

commit 555410b7ce91ef5cf31f480803c01c93d95c28cc
Author: skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Thu Mar 29 18:34:24 2018

Roll src/third_party/skia/ 702a7dfc9..c3bc425bd (8 commits)

https://skia.googlesource.com/skia.git/+log/702a7dfc91f9..c3bc425bd4d6

$ git log 702a7dfc9..c3bc425bd --date=short --no-merges --format='%ad %ae %s'
2018-03-28 halcanary SkDynamicMemoryWStream: clean up, asserts, etc.
2018-03-28 senorblanco Reland "GrTessellator: hang fix."
2018-03-29 angle-skia-autoroll Roll skia/third_party/externals/angle2/ a3b220f36..96310cdad (1 commit)
2018-03-29 skcms-skia-autoroll Roll skia/third_party/externals/skcms/ 5678b9d6a..3f0009288 (1 commit)
2018-03-28 kdonev Fixing build with SK_IGNORE_TO_STRING defined.
2018-03-28 ethannicholas fixed type mismatches in SkSL comparison operators
2018-03-28 csmartdalton Don't use gl_FragCoord on legacy Tegra hardware
2018-03-29 mtklein Revert "GrTessellator: hang fix."

Created with:
  roll-dep src/third_party/skia
BUG= chromium:825476 , chromium:802896 , chromium:802896 


The AutoRoll server is located here: https://autoroll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel;luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
TBR=mtklein@chromium.org

Change-Id: Iad642d09e901c9392b9a24294e457a74dbe94a97
Reviewed-on: https://chromium-review.googlesource.com/986464
Reviewed-by: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: Mike Klein <mtklein@chromium.org>
Commit-Queue: skia-chromium-autoroll <skia-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#546869}
[modify] https://crrev.com/555410b7ce91ef5cf31f480803c01c93d95c28cc/DEPS

Status: Fixed (was: Assigned)
This should be fixed as of r546822 above, and in the Chrome 67 Canary.
Project Member

Comment 21 by bugdroid1@chromium.org, Oct 5

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/cb4b9ea75c3b039492373f114ab63f44aee476bc

commit cb4b9ea75c3b039492373f114ab63f44aee476bc
Author: Florin Malita <fmalita@chromium.org>
Date: Fri Oct 05 14:54:50 2018

Rebaseline pending Skia suppressions

virtual/gpu/fast/canvas/canvas-arc-circumference.html
virtual/gpu/fast/canvas/canvas-drawImage-antiAlias.html
virtual/gpu/fast/canvas/canvas-ellipse-circumference.html
virtual/gpu/fast/canvas/canvas-ellipse-circumference-fill.html
virtual/gpu/fast/canvas/fillrect_gradient.html
virtual/gpu/fast/canvas/gradient-add-second-start-end-stop.html
virtual/gpu-rasterization/images/cross-fade-background-size.html

TBR=

Bug: 884166, 889940 , 888675 , 802896 
Change-Id: I43312a60d4e8784cd915533bda5cf54141160adb
Reviewed-on: https://chromium-review.googlesource.com/c/1262895
Reviewed-by: Florin Malita <fmalita@chromium.org>
Reviewed-by: Stephen White <senorblanco@chromium.org>
Commit-Queue: Florin Malita <fmalita@chromium.org>
Cr-Commit-Position: refs/heads/master@{#597120}
[modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/platform/linux/virtual/gpu/fast/canvas/fillrect_gradient-expected.png
[modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu-rasterization/images/cross-fade-background-size-expected.png
[modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/platform/mac/virtual/gpu/fast/canvas/fillrect_gradient-expected.png
[modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/platform/win/virtual/gpu-rasterization/images/cross-fade-background-size-expected.png
[modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/platform/win/virtual/gpu/fast/canvas/fillrect_gradient-expected.png
[modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-arc-circumference-expected.png
[modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-drawImage-antiAlias-expected.png
[modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-ellipse-circumference-expected.png
[add] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/canvas-ellipse-circumference-fill-expected.png
[modify] https://crrev.com/cb4b9ea75c3b039492373f114ab63f44aee476bc/third_party/WebKit/LayoutTests/virtual/gpu/fast/canvas/gradient-add-second-start-end-stop-expected.png

Sign in to add a comment